The Fix
Upgrade to version 1.0.3 or later.
Based on closed pallets/flask issue #2960 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -9,6 +9,12 @@ Version 1.1
Unreleased
+- :meth:`flask.RequestContext.copy` includes the current session
+ object in the request context copy. This prevents ``flask.session``
+ pointing to an out-of-date object. (`#2935`)
Option A — Upgrade to fixed release\nUpgrade to version 1.0.3 or later.\nWhen NOT to use: This fix is not suitable for applications that do not require thread safety for request contexts.\n\n
Why This Fix Works in Production
- Trigger: raise RuntimeError('This decorator can only be used at local scopes '
- Mechanism: The current implementation of copy_current_request_context does not perform a deep copy of the request context
- Why the fix works: Updates `flask.copy_current_request_context` to include a copy of the current session object in the request context copy, preventing `flask.session` from pointing to an out-of-date object. (first fixed release: 1.0.3).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- The current implementation of copy_current_request_context does not perform a deep copy of the request context
- Production symptom (often without a traceback): raise RuntimeError('This decorator can only be used at local scopes '
Proof / Evidence
- GitHub issue: #2960
- Fix PR: https://github.com/pallets/flask/pull/2936
- First fixed release: 1.0.3
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.85
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.81
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“@dchevell Ok, thanks for the clarification!”
“Just for clarity @okeuday, a deepcopy of the session is *not* the purpose of #2936 (as mentioned in my last comment there). This issue here…”
“It is unfortunate that the flask source code considers threaded use uncommon and not worthy of development or testing because that avoids providing a single…”
“I don't consider threads uncommon, what I consider uncommon is what's being asked for in this issue, when extension points to support if if needed…”
Failure Signature (Search String)
- raise RuntimeError('This decorator can only be used at local scopes '
Copy-friendly signature
Failure Signature
-----------------
raise RuntimeError('This decorator can only be used at local scopes '
Error Message
Signature-only (no traceback captured)
Error Message
-------------
raise RuntimeError('This decorator can only be used at local scopes '
What Broke
Using the same request context in multiple threads can lead to data inconsistency and unexpected behavior.
Why It Broke
The current implementation of copy_current_request_context does not perform a deep copy of the request context
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 1.0.3 or later.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/pallets/flask/pull/2936
First fixed release: 1.0.3
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not suitable for applications that do not require thread safety for request contexts.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Version Compatibility Table
| Version | Status |
|---|---|
| 1.0.3 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.