Webargs

Latest version: v8.6.0

Safety actively analyzes 714772 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 2 of 18

8.0.1

******************

Bug fixes:

* Fix "``DelimitedList`` deserializes empty string as ``['']``" (:issue:`623`).
Thanks :user:`TTWSchell` for reporting and for the PR.

Other changes:

* New documentation theme with `furo`. Thanks to :user:`pradyunsg` for writing
furo!
* Webargs has a new logo. Thanks to :user:`michaelizergit`! (:issue:`312`)
* Don't build universal wheels. We don't support Python 2 anymore.
(:pr:`632`)
* Make the build reproducible (:pr:`631`).

8.0.0

******************

Features:

* Add `Parser.pre_load` as a method for allowing users to modify data before
schema loading, but without redefining location loaders. See advanced docs on
`Parser pre_load` for usage information. (:pr:`583`)

* *Backwards-incompatible*: ``unknown`` defaults to `None` for body locations
(`json`, `form` and `json_or_form`) (:issue:`580`).

* Detection of fields as "multi-value" for unpacking lists from multi-dict
types is now extensible with the ``is_multiple`` attribute. If a field sets
``is_multiple = True`` it will be detected as a multi-value field. If
``is_multiple`` is not set or is set to ``None``, webargs will check if the
field is an instance of ``List`` or ``Tuple``. (:issue:`563`)

* A new attribute on ``Parser`` objects, ``Parser.KNOWN_MULTI_FIELDS`` can be
used to set fields which should be detected as ``is_multiple=True`` even when
the attribute is not set (:pr:`592`).

See docs on "Multi-Field Detection" for more details.

Bug fixes:

* ``Tuple`` field now behaves as a "multiple" field (:pr:`585`).

7.0.1

******************

Bug fixes:

* Fix `DelimitedList` and `DelimitedTuple` to pass additional keyword arguments
through their `_serialize` methods to the child fields and fix type checking
on these classes. (:issue:`569`)
Thanks to :user:`decaz` for reporting.

7.0.0

******************

Changes:

* *Backwards-incompatible*: Drop support for webapp2 (:pr:`565`).

* Add type annotations to `Parser` class, `DelimitedList`, and
`DelimitedTuple`. (:issue:`566`)

7.0.0b2

********************

Features:

* `DjangoParser` now supports the `headers` location. (:issue:`540`)

* `FalconParser` now supports a new `media` location, which uses
Falcon's `media` decoding. (:issue:`253`)

`media` behaves very similarly to the `json` location but also supports any
registered media handler. See the
`Falcon documentation on media types
<https://falcon.readthedocs.io/en/stable/api/media.html>`_ for more details.

Changes:

* `FalconParser` defaults to the `media` location instead of `json`. (:issue:`253`)
* Test against Python 3.9 (:pr:`552`).
* *Backwards-incompatible*: Drop support for Python 3.5 (:pr:`553`).

7.0.0b1

********************

Refactoring:

* *Backwards-incompatible*: Remove support for marshmallow2 (:issue:`539`)

* *Backwards-incompatible*: Remove `dict2schema`

Users desiring the `dict2schema` functionality may now rely upon
`marshmallow.Schema.from_dict`. Rewrite any code using `dict2schema` like so:

.. code-block:: python

import marshmallow as ma

webargs 6.x and older
from webargs import dict2schema

myschema = dict2schema({"q1", ma.fields.Int()})

webargs 7.x
myschema = ma.Schema.from_dict({"q1", ma.fields.Int()})

Features:

* Add ``unknown`` as a parameter to ``Parser.parse``, ``Parser.use_args``,
``Parser.use_kwargs``, and parser instantiation. When set, it will be passed
to ``Schema.load``. When not set, the value passed will depend on the parser's
settings. If set to ``None``, the schema's default behavior will be used (i.e.
no value is passed to ``Schema.load``) and parser settings will be ignored.

This allows usages like

.. code-block:: python

import marshmallow as ma


parser.use_kwargs(
{"q1": ma.fields.Int(), "q2": ma.fields.Int()}, location="query", unknown=ma.EXCLUDE
)
def foo(q1, q2): ...

* Defaults for ``unknown`` may be customized on parser classes via
``Parser.DEFAULT_UNKNOWN_BY_LOCATION``, which maps location names to values
to use.

Usages are varied, but include

.. code-block:: python

import marshmallow as ma
from webargs.flaskparser import FlaskParser


as well as...
class MyParser(FlaskParser):
DEFAULT_UNKNOWN_BY_LOCATION = {"query": ma.INCLUDE}


parser = MyParser()

Setting the ``unknown`` value for a Parser instance has higher precedence. So

.. code-block:: python

parser = MyParser(unknown=ma.RAISE)

will always pass ``RAISE``, even when the location is ``query``.

* By default, webargs will pass ``unknown=EXCLUDE`` for all locations except
for request bodies (``json``, ``form``, and ``json_or_form``) and path
parameters. Request bodies and path parameters will pass ``unknown=RAISE``.
This behavior is defined by the default value for
``DEFAULT_UNKNOWN_BY_LOCATION``.

Changes:

* Registered `error_handler` callbacks are required to raise an exception.
If a handler is invoked and no exception is raised, `webargs` will raise
a `ValueError` (:issue:`527`)

Page 2 of 18

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.