Webargs

Latest version: v8.6.0

Safety actively analyzes 714772 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 4 of 18

6.0.0b5

********************

Refactoring:

* *Backwards-incompatible*: `DelimitedList` now requires that its input be a
string and always serializes as a string. It can still serialize and deserialize
using another field, e.g. `DelimitedList(Int())` is still valid and requires
that the values in the list parse as ints.

6.0.0b4

Not secure
********************

Bug fixes:

* :cve:`CVE-2020-7965`: Don't attempt to parse JSON if request's content type is mismatched
(bugfix from 5.5.3).

6.0.0b3

Not secure
********************

Features:

* *Backwards-incompatible*: Support Falcon 2.0. Drop support for Falcon 1.x
(:pr:`459`). Thanks :user:`dodumosu` and :user:`Nateyo` for the PR.

6.0.0b2

Not secure
********************

Other changes:

* *Backwards-incompatible*: Drop support for Python 2 (:issue:`440`).
Thanks :user:`hugovk` for the PR.

6.0.0b1

Not secure
********************

Features:

* *Backwards-incompatible*: Schemas will now load all data from a location, not
only data specified by fields. As a result, schemas with validators which
examine the full input data may change in behavior. The `unknown` parameter
on schemas may be used to alter this. For example,
`unknown=marshmallow.EXCLUDE` will produce a behavior similar to webargs v5.

Bug fixes:

* *Backwards-incompatible*: All parsers now require the Content-Type to be set
correctly when processing JSON request bodies. This impacts ``DjangoParser``,
``FalconParser``, ``FlaskParser``, and ``PyramidParser``

Refactoring:

* *Backwards-incompatible*: Schema fields may not specify a location any
longer, and `Parser.use_args` and `Parser.use_kwargs` now accept `location`
(singular) instead of `locations` (plural). Instead of using a single field or
schema with multiple `locations`, users are recommended to make multiple
calls to `use_args` or `use_kwargs` with a distinct schema per location. For
example, code should be rewritten like this:

.. code-block:: python

webargs 5.x and older
parser.use_args(
{
"q1": ma.fields.Int(location="query"),
"q2": ma.fields.Int(location="query"),
"h1": ma.fields.Int(location="headers"),
},
locations=("query", "headers"),
)
def foo(q1, q2, h1): ...


webargs 6.x
parser.use_args({"q1": ma.fields.Int(), "q2": ma.fields.Int()}, location="query")
parser.use_args({"h1": ma.fields.Int()}, location="headers")
def foo(q1, q2, h1): ...

* The `location_handler` decorator has been removed and replaced with
`location_loader`. `location_loader` serves the same purpose (letting you
write custom hooks for loading data) but its expected method signature is
different. See the docs on `location_loader` for proper usage.

Thanks :user:`sirosen` for the PR!

5.5.3

******************

Bug fixes:

* :cve:`CVE-2020-7965`: Don't attempt to parse JSON if request's content type is mismatched.

Page 4 of 18

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.