# Testing signals — pallets/werkzeug

> Canonical page: https://codevetter.com/unpack/werkzeug/testing-signals

# Testing signals — pallets/werkzeug

Scanned commit 594452f6a4fe4de38a544962fbf04bfc9d37fbc2 (2026-10-01). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Tests and CI were inspected, not executed; no passing result or coverage percentage is established. Pytest covers protocol utilities and adapters, with separate middleware and Sans-I/O test files plus subprocess-based live-server fixtures. The inspected assertions address parsing limits, routing trust, JSON failures, file transfer, security helpers, and redirect behavior. This inventory is bounded, and example persistence/concurrency behavior was not established by the inspected tests.
- Pytest discovers tests under tests/, treats warnings as errors, and declares a dev_server marker; tox's configured test command is pytest -v --tb=short with forwarded positional arguments. — [pyproject.toml#L93-L98](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/pyproject.toml#L93-L98) [pyproject.toml#L160-L172](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/pyproject.toml#L160-L172)
- TestFormParser asserts early total-length rejection, multipart field-memory rejection, part-count rejection, and URL-encoded exemption from max_form_parts; a separate test checks memory limits across multiple decoder events. — [tests/test_formparser.py#L43-L108](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_formparser.py#L43-L108) [tests/test_formparser.py#L430-L439](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_formparser.py#L430-L439)
- Routing tests reject disallowed WebSocket methods and verify Request.trusted_hosts during Map.bind_to_environ; ProxyFix tests exercise the resulting request root, route building, matching, and redirect location. — [tests/test_routing.py#L1777-L1787](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_routing.py#L1777-L1787) [tests/test_routing.py#L1896-L1907](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_routing.py#L1896-L1907) [tests/middleware/test_proxy_fix.py#L162-L196](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/middleware/test_proxy_fix.py#L162-L196)
- JSON tests assert successful request/response decoding, 415 for an unsupported content type, silent and forced parsing behavior, 400 for malformed data, and body consumption when caching is disabled. — [tests/test_wrappers.py#L1091-L1131](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_wrappers.py#L1091-L1131)
- File tests assert conditional 304 responses, cache-age behavior, ETag options, and traversal rejection; range tests assert 206 output, clamping, 416 failures, first-range-only behavior, and POST exemption. — [tests/test_send_file.py#L123-L181](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_send_file.py#L123-L181) [tests/test_apply_range.py#L56-L106](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_apply_range.py#L56-L106)
- Security tests assert scrypt/PBKDF2 formats, salt variability, and unsafe-path rejection; Client tests reject external redirect following and redirect loops. These assertions exist but were not executed in this investigation. — [tests/test_security.py#L10-L55](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_security.py#L10-L55) [tests/test_security.py#L71-L82](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_security.py#L71-L82) [tests/test_test.py#L487-L516](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_test.py#L487-L516)
- DevServerClient launches a subprocess and reserves ports; live-server tests include HTTP, TLS, reloading, and Unix sockets, with platform skips and a Windows-CI skip for a reloader test. — [tests/conftest.py#L70-L105](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/conftest.py#L70-L105) [tests/test_serving.py#L31-L60](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_serving.py#L31-L60) [tests/test_serving.py#L90-L115](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/tests/test_serving.py#L90-L115)
- Inspected CI config runs locked uv/tox tests across Python 3.11–3.15, free-threaded 3.14, PyPy, Windows, and macOS, plus mypy and pre-commit jobs; docs-only/README changes skip the tests workflow, and no execution or example Redis concurrency coverage is established here. — [.github/workflows/tests.yaml#L1-L44](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/.github/workflows/tests.yaml#L1-L44) [.github/workflows/tests.yaml#L45-L63](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/.github/workflows/tests.yaml#L45-L63) [.github/workflows/pre-commit.yaml#L14-L29](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/.github/workflows/pre-commit.yaml#L14-L29) [examples/shortly/shortly.py#L93-L101](https://github.com/pallets/werkzeug/blob/594452f6a4fe4de38a544962fbf04bfc9d37fbc2/examples/shortly/shortly.py#L93-L101)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)