Dependencies

Core Dependencies

These are the runtime dependencies in the [project] table of pyproject.toml. Flask 3.2.0.dev is built on Werkzeug and Jinja2 and adds a small set of focused libraries.

Web and WSGI layer

  • werkzeug>=3.1.0 is the foundation of the framework and the most widely imported dependency. Its uses by module:
    • Routing:
      • flask.sansio.app imports Map, Rule and BuildError.
      • flask.app imports MapAdapter, RequestRedirect, RoutingException, Rule and BuildError.
      • flask.ctx imports MapAdapter.
      • flask.debughelpers imports RequestRedirect.
    • HTTP exceptions:
      • flask.sansio.scaffold imports default_exceptions and HTTPException.
      • flask.sansio.app imports Aborter, BadRequest and BadRequestKeyError.
      • flask.app imports InternalServerError.
      • flask.helpers imports abort.
    • Request/response objects: flask.wrappers imports Request, Response, BadRequest, HTTPException and Rule. flask.app and flask.sansio.app import Response classes, and flask.typing and flask.json.provider import werkzeug.sansio.response.Response.
    • Data structures: flask.app imports Headers and ImmutableDict. flask.sessions imports CallbackDict.
    • Utilities:
      • import_string is imported by flask.cli and flask.config.
      • cached_property is imported by flask.sansio.app and flask.sansio.scaffold.
      • redirect is imported by flask.helpers and flask.sansio.app.
      • http_date is imported by flask.json.provider and flask.json.tag.
      • parse_date is imported by flask.json.tag.
      • get_host is imported by flask.app.
    • Context proxies: werkzeug.local.LocalProxy is imported by flask.globals and flask.logging.
    • Dev server and testing:
      • run_simple and is_running_from_reloader are imported by flask.app and flask.cli.
      • werkzeug.test.Client and TestResponse are imported by flask.testing.

Templating and serialization

  • jinja2>=3.1.2 provides templating.
    • flask.templating imports Environment, Template, BaseLoader and TemplateNotFound.
    • flask.sansio.scaffold imports BaseLoader and FileSystemLoader for template folders.
    • flask.debughelpers uses BaseLoader in _dump_loader_info() and explain_template_loading_attempts(), which report which loader tried to locate a template and whether it matched.
  • markupsafe>=2.1.1 supplies Markup, which flask.json.tag imports.
  • itsdangerous>=2.2.0 supports sessions. flask.sessions imports URLSafeTimedSerializer and BadSignature.

CLI

  • click>=8.1.3 powers the flask command.
    • flask.cli builds cli = FlaskGroup(name="flask", ...), whose main() calls cli.main().
    • flask.cli uses click.echo() and click.secho() for output, and imports click.core.ParameterSource.
    • flask.testing imports click.testing.CliRunner and Result.
    • flask.sansio.scaffold imports click.Group only for type checking, under t.TYPE_CHECKING.

Signals

  • blinker>=1.9.0 supplies Namespace, which flask.signals imports. The top-level flask package re-exports signals such as request_started, request_finished, got_request_exception, template_rendered and message_flashed.

Optional Dependencies

Two extras are declared under [project.optional-dependencies]:

Extra Requirement Used by
async asgiref>=3.2 flask.app imports asgiref.sync.async_to_sync
dotenv python-dotenv flask.cli imports dotenv

Install them with pip install "Flask[async]" or pip install "Flask[dotenv]".

flask.helpers has get_load_dotenv(), which reads the FLASK_SKIP_DOTENV environment variable. FlaskGroup takes a load_dotenv option and passes it to ScriptInfo as load_dotenv_defaults.

flask.cli also imports cryptography. It is declared only in the typing dependency group, not among the runtime dependencies or extras.

Development dependency groups

These are declared under [dependency-groups] and are not installed with the package.

Group Packages Purpose
dev ruff, tox, tox-uv Linting and running test environments
tests asgiref, pytest, python-dotenv Test suite, including the async and dotenv paths
typing asgiref, cryptography, mypy, pyright, pytest, python-dotenv, types-contextvars, types-dataclasses Type checking with mypy and pyright. The optional dependencies are included so their imports resolve.
docs pallets-sphinx-themes, sphinx<9, sphinx-tabs, sphinxcontrib-log-cabinet Documentation build
docs-auto sphinx-autobuild Live-rebuilding docs
pre-commit pre-commit, pre-commit-uv Git hook management
gha-update gha-update ; python_full_version >= '3.12' Updating GitHub Actions versions, only on Python 3.12+

Version Requirements

  • Python >=3.10 (requires-python).
  • Runtime minimums:
    • blinker>=1.9.0
    • click>=8.1.3
    • itsdangerous>=2.2.0
    • jinja2>=3.1.2
    • markupsafe>=2.1.1
    • werkzeug>=3.1.0
  • Extras: asgiref>=3.2. python-dotenv has no version constraint.
  • Docs: sphinx<9 is the only upper bound among the dependency groups.
  • Build: flit_core>=3.11,<4 with backend flit_core.buildapi.
  • Project version: 3.2.0.dev.

Every runtime dependency uses a lower bound only, with no upper cap. The sphinx<9 cap and the flit_core cap are the only upper-bound constraints in the manifest.

Integration Points

Shared base class

Scaffold in flask.sansio.scaffold is the common base for Flask and Blueprint. It is where Jinja2's FileSystemLoader, Werkzeug's default_exceptions and cached_property, and the typed decorators (T_route, T_error_handler, and so on) come together. The @setupmethod decorator wraps registration methods and calls _check_setup_finished() first.

Blueprint in flask.sansio.blueprints implements _check_setup_finished() to raise an AssertionError once the blueprint has been registered, so setup changes cannot be applied inconsistently.

Sans-IO split

flask.sansio.app holds the application state that depends on Werkzeug's Map, Rule, Aborter and sansio Response. flask.app adds the WSGI-specific pieces: run_simple, MapAdapter, get_host, and the optional async_to_sync.

Thin wrappers over Werkzeug

  • flask.helpers imports Werkzeug's abort and redirect under the private aliases _wz_abort and _wz_redirect, and re-exposes abort and redirect from the top-level flask package.
  • flask.globals builds current_app, g, request and session on LocalProxy, and flask.logging also uses LocalProxy.
  • flask.wrappers provides the framework's Request and Response on top of Werkzeug's.

CLI

FlaskGroup in flask.cli extends Click's group behavior.

  • make_context() sets FLASK_RUN_FROM_CLI=true so app.run() becomes a no-op while a CLI command runs.
  • make_context() also creates a ScriptInfo as the context object when none is supplied.
  • list_commands() merges in commands from the loaded app's cli. A NoAppException prints only the error message in red, and any other exception prints the full traceback.
  • parse_args() handles --env-file and --app early, so help output can include app.cli commands.
  • The routes command formats url_map rules into a table with click.echo().
cli = FlaskGroup(name="flask", help="A general utility script for Flask applications. ...")

def main() -> None:
    cli.main()

Sessions, signals and JSON

  • flask.sessions combines URLSafeTimedSerializer and BadSignature from itsdangerous with Werkzeug's CallbackDict.
  • flask.signals creates its signals from blinker.Namespace.
  • flask.json.tag combines markupsafe.Markup with Werkzeug's http_date and parse_date.

Testing

flask.testing builds on werkzeug.test.Client, werkzeug.wrappers.Request and click.testing.CliRunner, so tests can exercise both the WSGI app and CLI commands.