# Contributor handoff — pallets/werkzeug

> Canonical page: https://codevetter.com/unpack/werkzeug/agent-handoff

# Contributor handoff — pallets/werkzeug

Scanned commit 594452f6a4fe4de38a544962fbf04bfc9d37fbc2 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Start with the public WSGI contract, then inspect the relevant protocol, adapter, and test layers together. Preserve stream ownership, cleanup, route-building parity, and documented compatibility behavior. Tests and CI were inspected, not executed; the brief establishes neither passing checks nor exhaustive coverage. Future implementation work should use the existing locked tooling only when execution is separately authorized.
- Read README's callable example and docs/levels before editing public APIs: the project explicitly supports both Request/Response wrappers and lower-level utility functions. — [README.md#L44-L62](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/README.md#L44-L62) [docs/levels.rst#L6-L12](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/docs/levels.rst#L6-L12)
- For body changes, inspect Request, FormDataParser, MultipartDecoder, and get_input_stream together; multipart limits and server-terminated stream handling are separate controls. — [src/werkzeug/wrappers/request.py#L77-L112](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/request.py#L77-L112) [src/werkzeug/formparser.py#L422-L452](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/formparser.py#L422-L452) [src/werkzeug/sansio/multipart.py#L127-L138](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/sansio/multipart.py#L127-L138) [src/werkzeug/wsgi.py#L187-L205](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wsgi.py#L187-L205)
- Preserve upload cleanup and cached-body reparsing: Request.close closes parsed file objects, cached input is re-exposed through BytesIO, and MultiPartParser closes created streams on errors. — [src/werkzeug/wrappers/request.py#L478-L493](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/request.py#L478-L493) [src/werkzeug/formparser.py#L367-L378](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/formparser.py#L367-L378)
- Routing edits must account for both matcher state and endpoint builders: Rule.compile installs generated build functions, while Map.update sorts matcher and endpoint rules under its remapping lock. — [src/werkzeug/routing/rules.py#L698-L737](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/routing/rules.py#L698-L737) [src/werkzeug/routing/map.py#L401-L415](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/routing/map.py#L401-L415)
- Keep Werkzeug 3.2 compatibility paths explicit: parser hooks and configurable storage classes emit deprecation warnings, and tests treat warnings as errors unless deliberately handled. — [src/werkzeug/wrappers/request.py#L329-L360](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/wrappers/request.py#L329-L360) [src/werkzeug/formparser.py#L209-L220](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/src/werkzeug/formparser.py#L209-L220) [pyproject.toml#L93-L98](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/pyproject.toml#L93-L98)
- When execution is authorized, use the configured uv/tox pytest workflow with the smallest relevant test-file positional argument first; tests and CI were inspected here, not executed, and test existence supplies no passing result. — [pyproject.toml#L160-L172](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/pyproject.toml#L160-L172) [.github/workflows/tests.yaml#L42-L44](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/.github/workflows/tests.yaml#L42-L44) [tests/test_formparser.py#L43-L62](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_formparser.py#L43-L62)
- Follow existing style and verification configuration: Ruff uses single-line imports and excludes examples, mypy is strict over src, pre-commit runs repository hooks, and the docs tox environment builds Sphinx with warnings as errors. — [pyproject.toml#L114-L147](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/pyproject.toml#L114-L147) [pyproject.toml#L181-L197](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/pyproject.toml#L181-L197) [.github/workflows/pre-commit.yaml#L25-L29](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/.github/workflows/pre-commit.yaml#L25-L29)
- Distinguish runnable demonstrations from supported library boundaries: Shortly requires Redis/Jinja and enables development debugging, while deployment docs require production WSGI hosting; bounded example inspection does not establish persistence integration coverage. — [examples/shortly/shortly.py#L5-L15](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L5-L15) [examples/shortly/shortly.py#L135-L139](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L135-L139) [docs/deployment/index.rst#L4-L27](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/docs/deployment/index.rst#L4-L27) [pyproject.toml#L93-L98](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/pyproject.toml#L93-L98)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)