chore(deps-dev): bump werkzeug from 3.1.8 to 3.1.9

[dependabot]

Bumps werkzeug from 3.1.8 to 3.1.9.

Release notes

Sourced from werkzeug's releases.

3.1.9

This is the Werkzeug 3.1.9 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.9/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-9 Milestone: https://github.com/pallets/werkzeug/milestone/46?closed=1

• safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. GHSA-g6x2-hccm-hh4m
• ProfilerMiddleware uses profiling.tracing on Python 3.15. #3207
• uri_to_iri and iri_to_uri preserve empty username, password, and port 0. #3189
• Improve performance of parse_options_header. #3231
• Improve performance of parse_etags. #3231
• Improve performance of parse_cookie. #3231
• get_host also checks that the port is in the valid range. #3236
• The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). #3237
• Improve debugger PIN generation from cgroup data inside Podman. #3245
• Authorization parsing basic auth disallows non-base64 characters. #3248
• application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. #3251
• LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. #3253
• Rules with 10 or more converters in a single part assign matched values correctly. #3254
• The invalid Range suffix length -0 is no longer accepted. #3255

Changelog

Sourced from werkzeug's changelog.

Version 3.1.9

Released 2026-09-27

• safe_join on Windows does not allow special devices names with empty ADS markers on NTFS. :ghsa:g6x2-hccm-hh4m
• ProfilerMiddleware uses profiling.tracing on Python 3.15. :issue:3207
• uri_to_iri and iri_to_uri preserve empty username, password, and port 0. :issue:3189
• Improve performance of parse_options_header. :pr:3231
• Improve performance of parse_etags. :pr:3231
• Improve performance of parse_cookie. :pr:3231
• get_host also checks that the port is in the valid range. :pr:3236
• The int URL converter returns a 404 instead of 500 error when the value is longer than sys.get_int_max_str_digits(). :issue:3237
• Improve debugger PIN generation from cgroup data inside Podman. :issue:3245
• Authorization parsing basic auth disallows non-base64 characters. :pr:3248
• application/x-www-form-urlencoded form data is no longer limited to max_form_memory_size, only max_content_length. :pr:3251
• LimitedStream.readinto does not resize the buffer when it reads less than the remaining size. :pr:3253
• Rules with 10 or more converters in a single part assign matched values correctly. :pr:3254
• The invalid Range suffix length -0 is no longer accepted. :pr:3255

Commits

• 6604c3b release version 3.1.9
• a78b30a update dependencies
• 8d77320 disallow special name with ads (#3309)
• b2a2c09 disallow special name with ads
• 4efac9d add links
• 400c23e Allow flit_core 4.x (#3261)
• 7132a19 allow flit_core 4
• 6fba87c only accept ASCII digits
• 263f5ca disallow range -0 (#3255)
• 0c419f9 disallow range -0
• Additional commits viewable in compare view

[github-actions]

Codecov Results 📊

✅ 130389 passed | ❌ 3 failed | ⏭️ 7276 skipped | Total: 137668 | Pass Rate: 94.71% | Execution Time: 425m 28s

📊 Comparison with Base Branch

Metric	Change
Total Tests	—
Passed Tests	📉 -1
Failed Tests	📈 +1
Skipped Tests	—

➕ New Tests (1)

View new tests

• test_handle_error_on_token_reset_isolation_scope[isolation_scope-ValueError]
  • File: tests.test_scope
  • Status: ❌ Failing

❌ Failed Tests

test_binary_content_encoding_mixed_content[False-False]

File: tests.integrations.litellm.test_litellm
Suite: py3.10-litellm-v1.83.14
Error: assert 0 == 1 + where 0 = len([])

Stack Trace

tests/integrations/litellm/test_litellm.py:3142: in test_binary_content_encoding_mixed_content
    assert len(chat_spans) == 1
E   assert 0 == 1
E    +  where 0 = len([])

test_handle_error_on_token_reset_isolation_scope[isolation_scope-ValueError]

File: tests.test_scope
Suite: py3.15t-common
Error: AssertionError: Expected 'capture_internal_exception' to have been called once. Called 2 times. Calls: [call((<class 'ValueError'>, ValueError(), <traceback object at 0x7f124e1d23c0>)), call((<class 'ValueError'>, ValueError(), <traceback object at 0x7f131a31f380>))].

Stack Trace

tests/test_scope.py:1012: in test_handle_error_on_token_reset_isolation_scope
    mock_capture.assert_called_once()
../../_temp/uv-python-dir/cpython-3.15.0rc2+freethreaded-linux-x86_64-gnu/lib/python3.15t/unittest/mock.py:965: in assert_called_once
    raise AssertionError(msg)
E   AssertionError: Expected 'capture_internal_exception' to have been called once. Called 2 times.
E   Calls: [call((<class 'ValueError'>, ValueError(), <traceback object at 0x7f124e1d23c0>)),
E    call((<class 'ValueError'>, ValueError(), <traceback object at 0x7f131a31f380>))].

✅ Patch coverage is 100.00%. Project has 2593 uncovered lines.
❌ Project coverage is 90.26%. Comparing base (f5bf69b) to head (11f4406).

Coverage diff

@@            Coverage Diff             @@
##        master       #PR       +/-##
==========================================
- Coverage    90.29%    90.26%    -0.03%
==========================================
  Files          202       202         —
  Lines        26625     26625         —
  Branches      9926      9926         —
==========================================
+ Hits         24039     24032        -7
- Misses        2586      2593        +7
- Partials      1515      1515         —

---

Generated by Codecov Action

[alexander-alderman-webb]

Resolved by 1ca0326

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.