accomodate type changes in werkzeug 3.1.4, resolve CVE-2025-66221

openapi_core/datatypes.py

@@ -6,10 +6,14 @@
 from dataclasses import field
 from typing import Any
 from typing import Mapping
+from typing import Union
 
 from werkzeug.datastructures import Headers
 from werkzeug.datastructures import ImmutableMultiDict
 
+# Type alias for headers that accepts both Mapping and werkzeug Headers
+HeadersType = Union[Mapping[str, Any], Headers]
+
 
 @dataclass
 class RequestParameters:
@@ -27,7 +31,7 @@ class RequestParameters:
     """
 
     query: Mapping[str, Any] = field(default_factory=ImmutableMultiDict)
-    header: Mapping[str, Any] = field(default_factory=Headers)
+    header: HeadersType = field(default_factory=Headers)
     cookie: Mapping[str, Any] = field(default_factory=ImmutableMultiDict)
     path: Mapping[str, Any] = field(default_factory=dict)
 

openapi_core/protocols.py

@@ -4,10 +4,16 @@
 from typing import Mapping
 from typing import Optional
 from typing import Protocol
+from typing import Union
 from typing import runtime_checkable
 
+from werkzeug.datastructures import Headers
+
 from openapi_core.datatypes import RequestParameters
 
+# Type alias for headers that accepts both Mapping and werkzeug Headers
+HeadersType = Union[Mapping[str, Any], Headers]
+
 
 @runtime_checkable
 class BaseRequest(Protocol):
@@ -109,7 +115,7 @@ def content_type(self) -> str:
         """The content type with parameters and always lowercase."""
 
     @property
-    def headers(self) -> Mapping[str, Any]:
+    def headers(self) -> HeadersType:
         """Response headers as Headers."""
 
     @property

openapi_core/validation/response/validators.py

@@ -15,6 +15,7 @@
 from openapi_core.casting.schemas import oas30_read_schema_casters_factory
 from openapi_core.casting.schemas import oas31_schema_casters_factory
 from openapi_core.exceptions import OpenAPIError
+from openapi_core.protocols import HeadersType
 from openapi_core.protocols import Request
 from openapi_core.protocols import Response
 from openapi_core.protocols import WebhookRequest
@@ -44,7 +45,7 @@ def _iter_errors(
         self,
         status_code: int,
         data: Optional[bytes],
-        headers: Mapping[str, Any],
+        headers: HeadersType,
         mimetype: str,
         operation: SchemaPath,
     ) -> Iterator[Exception]:
@@ -91,7 +92,7 @@ def _iter_data_errors(
     def _iter_headers_errors(
         self,
         status_code: int,
-        headers: Mapping[str, Any],
+        headers: HeadersType,
         operation: SchemaPath,
     ) -> Iterator[Exception]:
         try:
@@ -141,7 +142,7 @@ def _get_data_value(self, data: Optional[bytes]) -> bytes:
         return data
 
     def _get_headers(
-        self, headers: Mapping[str, Any], operation_response: SchemaPath
+        self, headers: HeadersType, operation_response: SchemaPath
     ) -> Dict[str, Any]:
         if "headers" not in operation_response:
             return {}

pyproject.toml

@@ -71,9 +71,7 @@ parse = "*"
 openapi-schema-validator = "^0.6.0"
 openapi-spec-validator = "^0.7.1"
 requests = {version = "*", optional = true}
-# werkzeug 3.1.2 changed the definition of Headers
-# See https://github.com/python-openapi/openapi-core/issues/938
-werkzeug = "<3.1.2"
+werkzeug = ">=2.1.0"
 jsonschema-path = "^0.3.4"
 jsonschema = "^4.23.0"
 multidict = {version = "^6.0.4", optional = true}