From 460364fd42b401676c52cc6f276b0bf901aa9738 Mon Sep 17 00:00:00 2001 From: webdevdot Date: Sat, 4 Jul 2026 04:53:42 +0000 Subject: [PATCH 1/2] fix: copy jinja_options per-instance to prevent shared mutable class default Class-level jinja_options = {} is shared across all Flask instances and subclasses, so mutations on one instance silently affect all others. Copy it in __init__ so each app gets its own dict. Co-Authored-By: Claude Sonnet 4.6 --- src/flask/sansio/app.py | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/flask/sansio/app.py b/src/flask/sansio/app.py index 74c5b3232f..ddb370c299 100644 --- a/src/flask/sansio/app.py +++ b/src/flask/sansio/app.py @@ -315,6 +315,9 @@ def __init__( #: to load a config from files. self.config = self.make_config(instance_relative_config) + #: Per-instance copy so subclass mutations don't bleed across instances. + self.jinja_options = dict(self.__class__.jinja_options) + #: An instance of :attr:`aborter_class` created by #: :meth:`make_aborter`. This is called by :func:`flask.abort` #: to raise HTTP errors, and can be called directly as well. From 60ec3ed3d7a573a8bfb39fb8d053b424bfcfee49 Mon Sep 17 00:00:00 2001 From: webdevdot Date: Sat, 4 Jul 2026 05:01:25 +0000 Subject: [PATCH 2/2] fix(cli): remove ParamType subscript for click <8.2 compatibility --- src/flask/cli.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/flask/cli.py b/src/flask/cli.py index 1a9159ec7c..53b4e6752d 100644 --- a/src/flask/cli.py +++ b/src/flask/cli.py @@ -777,7 +777,7 @@ def show_server_banner(debug: bool, app_import_path: str | None) -> None: click.echo(f" * Debug mode: {'on' if debug else 'off'}") -class CertParamType(click.ParamType[t.Any]): +class CertParamType(click.ParamType): # type: ignore[type-arg] """Click option type for the ``--cert`` option. Allows either an existing file, the string ``'adhoc'``, or an import for a :class:`~ssl.SSLContext` object.