flask-limiter

Feature

• Expose flask_limiter.Limit, flask_limiter.RouteLimit,
  flask_limiter.ApplicationLimit & flask_limiter.MetaLimit
  limit description classes that can be used to pass in default,
  application & meta limits to the Limiter extension.
  This allows for a more fine grained control for end users while also
  simplifying the internal implementation of different types
  of limits.

Compatibility

• Prefix all internal sub modules with underscore.
  All imports should be from the root flask_limiter
  namespace only.

Development

• Migrate all project metadata to pyproject
• Remove versioneer
• Use uv for development
• Use hatch for build

Feature

• Expose flask_limiter.Limit, flask_limiter.RouteLimit,
  flask_limiter.ApplicationLimit & flask_limiter.MetaLimit
  limit description classes that can be used to pass in default,
  application & meta limits to the Limiter extension. This allows
  for a more fine grained control for end users while also
  simplifying the internal implementation of different types
  of limits.

Compatibility

• Drop support for python 3.9
• Add install extra for valkey

Documentation

• Improve documentation about rate limiting strategies

Typing

• Use builtin types (list, set, tuple)

Security

• Change pypi release to use trusted publishing

Chores

• Fix typing error with exempt decorator
• Update types for window wrapper to use named tuple

Compatibility

• Ensure wheels are uploaded to pypi as well (for real)

Chores

• Update development dependencies

Compatibility

• Drop support for python 3.8
• Add support for python 3.13
• Add CI matrix entry for flask 3.1

Bug fix

• Ensure cost is accounted for when testing conditional limits

Bug fix

• Fix errors with concurrent access to internal exemption maps during application startup.

Bug fix

• Ensure exempt routes are exempt from meta limits as well

Chores

• Update development dependencies
• Use ruff for all linting
• Update CI compatibility matrix

Feature

• Add meta_limits to allow for creating upper limits for requesting clients to breach application rate limits.

Bug fix

• Ensure on breach callbacks can be configured using flask config

Bug fix

• Ensure _version.py has stable content when generated using git archive from a tag regardless of when it is run.

Feature

• Add extended configuration for application limits
  • application_limits_exempt_when
  • application_limits_deduct_when
  • application_limits_per_method

Bug fix

• Ensure blueprint static routes are exempt

Chores

• Improve default limits documentation
• Update documentation dependencies
• Fix typing compatibility errors in headers

Bug Fix

• Ensure per route limits are preferred (over application limits) when populating rate limiting headers in the case where no rate limit has been breached in the request.

v3.3.0

v3.3.0

Feature

• Allow configuring request identity

Chores

• Improve linting with ruff
• Update development dependencies

v3.2.0

v3.2.0

Feature

• Skip logging an error if a decorated limit uses a callable to return the "current" rate limit and returns an empty string. Treat this is a signal that the rate limit should be skipped for this request.

Breaking changes

• Change order of extension constructor arguments to only require key_func as the first positional argument and all other arguments as keyword arguments.
• Separate positional/keyword arguments in limit/shared_limit decorators
• Remove deprecated config variable RATELIMIT_STORAGE_URL
• Remove legacy backward compatibility path for flask < 2

Features

• Allow scoping regular limit decorators / context managers

Breaking changes

• Remove deprecated config variable RATELIMIT_STORAGE_URL
• Remove legacy backward compatibility path for flask < 2
• Enforce key_func as a required argument

Chores

• Simplify registration of decorated function & blueprint limits

Breaking changes

• Change order of extension constructor arguments to only require key_func as the first positional argument and all other arguments as keyword arguments.
• Separate positional/keyword arguments in limit/shared_limit decorators

Features

• Allow scoping regular limit decorators / context managers

Feature

• Extend customization by http method to shared_limit decorator

Chores

• Update documentation quick start
• Refresh documentation for class based views

Features

• Allow using limit & shared_limit decorators on pure functions that are not decorated as routes. The functions when called from within a request context will get rate limited.
• Allow using limit as a context manager to rate limit a code block explicitly within a request

Chores

• Updated development dependencies
• Fix error running tests depending on docker locally
• Update internals to use dataclasses

Chores

• Add sponsorship banner to rtd
• Update documentation dependencies

Breaking changes

• Any exception raised when calling an on_breach callback will be re-raised instead of being absorbed unless swallow_errors is set. In the case of swallow_errors the exception will now be logged at ERROR level instead of WARN
• Reduce log level of rate limit exceeded log messages to INFO

Bug Fix

• Add default value for RateLimitExceeded optional parameter
• Fix suppression of errors when using conditional deduction (Issue 363)

Compatibility

• Ensure typing_extensions dependency has a minimum version

Chores

• Documentation tweaks
• Update CI to use 3.11 rc2

Chores

• Improve quick start documentation

Usability

• Emit warning when in memory storage is used as a default when no storage uri is provided

Feature

• Expand use of on_breach callback to return a Response object that will be used as the error response on rate limits being exceeded

Compatibility

• Migrate use of flask._request_ctx_stack to flask.globals.request_ctx to support Flask 2.2+

Chores

• Expand CI matrix to test against Flask 2.0,2.1 & 2.2
• Make tests compatible with Flask 2.2.+

Features

• Ensure multiple extension instances registered on a single application exercise before/after request hooks

Chores

• Improve documentation

Chore

• Add python 3.11 to CI matrix

Chore

• Automate github releases

Release Date: 2022-04-21

• Chore

  • Automate github releases

Release Date: 2022-04-21

• Chore

  • Automate github releases

Release Date: 2022-04-21

• Chore

  • Second attempt to generate release notes

Release Date: 2022-04-21

• Chore

  • Test for automating github release notes

Release Date: 2022-04-21

• Chore

  • Automate github releases

Feature

• Add CLI for inspecting & clearing rate limits

Bug Fix

• Ensure exempt decorator can be used with flags for view functions

Chores

• Refactor rate limit resolution to limit manager

Bug Fix

• Ensure request.blueprint is actually registered on the current app before using it for blueprint limits or exemptions. (Issue 336)

Feature

• Extend cost parameter to default & application limits

Chore

• Improve type strictness / checking
• Improve documentation on landing page

Bug Fixes

• Add missing extras requirements for installation
• Add py.typed for PEP 561 compliance

Features

• Expose option to register a callback for rate limit breaches of default limits via the ~flask_limiter.Limiter.on_breach constructor parameter
• Replace use of flask.g with request context for keeping track of extension state (327)
• Rework implementation of ~flask_limiter.Limiter.exempt to accomodate nested blueprints. (326)

Chores

• Add python 3.11 to CI
• Extract management and filtering of limits to LimitManager
• Improve correctness of resolving inherited limits & extensions when working with Blueprints (especially nested ones)

Feature

• Allow a function to be used for the cost parameter to limiter decorators.

Release Date: 2022-01-30

• Chore

  • Update documentation theme

Chore

• Update documentation theme

Feature

• Add current_limit attribute to extension to allow clients to fetch the relevant current limit that was evaluated.
• Update extension constructor parameters to match flask config for header control
• Add on_breach callback for limit and shared_limit decorators to be used as hooks for when a limit is breached
• Add cost argument to limit and shared_limit to control how much is deducted when a hit occurs.

Chore

• Improve documentation around configuration

Deprecation

• Remove hacks for managing incorrectly ordered limit/route decorators

Chore

• Documentation theme upgrades
• Integrate pytest-docker plugin
• Mass linting

Deprecation

• Removed deprecated RATELIMIT_GLOBAL config
• Added deprecation doc for RATELIMIT_STORAGE_URL config

Release Date: 2021-12-15

Documentation & test tweaks

Features

• Pin Flask, limits to >= 2
• Add type hints

Deprecations

• Remove deprecated get_ipaddr method
• Remove use of six
• Remove backward compatibility hacks for RateLimit exceptions

Drop support for python < 3.7 & Flask < 2.0

Final Release for python < 3.7

Features

• Prepend key_prefix to extension variables attached to g
• Expose g.view_limits

Bug Fix

• Always set headers for conditional limits
• Skip init_app sequence when the rate limiter is disabled