The Fix
Upgrade to version 2.2.0 or later.
Based on closed pallets/flask issue #4716 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -27,6 +27,11 @@ Unreleased
mode. Debug mode should be controlled directly using the ``--debug``
option or ``app.run(debug=True)``. :issue:`4714`
+- Some attributes that proxied config keys on ``app`` are deprecated:
+ ``session_cookie_name``, ``send_file_max_age_default``,
+ ``use_x_sendfile``, ``propagate_exceptions``, and
Option A — Upgrade to fixed release\nUpgrade to version 2.2.0 or later.\nWhen NOT to use: This fix is not suitable for applications that depend on deprecated attributes.\n\n
Why This Fix Works in Production
- Trigger: * `session_cookie_name` It's not clear why this is an attribute. None of the other session cookie options are exposed as attributes, and it seems much more…
- Mechanism: Several config attributes in the Flask app object were inconsistent and not useful
- Why the fix works: Deprecates several config attributes in the Flask app object, encouraging the use of the relevant config keys instead. (first fixed release: 2.2.0).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- Several config attributes in the Flask app object were inconsistent and not useful
- Production symptom (often without a traceback): * `session_cookie_name` It's not clear why this is an attribute. None of the other session cookie options are exposed as attributes, and it seems much more common to want to change those.
Proof / Evidence
- GitHub issue: #4716
- Fix PR: https://github.com/pallets/flask/pull/4722
- First fixed release: 2.2.0
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.95
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.61
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“permanent_session_lifetime is a helper for custom session interfaces to not need to do the int/timedelta conversion, so I'll leave that.”
Failure Signature (Search String)
- * `session_cookie_name` It's not clear why this is an attribute. None of the other session cookie options are exposed as attributes, and it seems much more common to want to
- * `propagate_exceptions` is only used in `handle_exception`, and is a very internal behavior. This property can't be set, but it does have some logic to fall back to `testing` or
Copy-friendly signature
Failure Signature
-----------------
* `session_cookie_name` It's not clear why this is an attribute. None of the other session cookie options are exposed as attributes, and it seems much more common to want to change those.
* `propagate_exceptions` is only used in `handle_exception`, and is a very internal behavior. This property can't be set, but it does have some logic to fall back to `testing` or `debug`.
Error Message
Signature-only (no traceback captured)
Error Message
-------------
* `session_cookie_name` It's not clear why this is an attribute. None of the other session cookie options are exposed as attributes, and it seems much more common to want to change those.
* `propagate_exceptions` is only used in `handle_exception`, and is a very internal behavior. This property can't be set, but it does have some logic to fall back to `testing` or `debug`.
What Broke
Deprecation of attributes may cause confusion for users relying on them.
Why It Broke
Several config attributes in the Flask app object were inconsistent and not useful
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 2.2.0 or later.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/pallets/flask/pull/4722
First fixed release: 2.2.0
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- This fix is not suitable for applications that depend on deprecated attributes.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Version Compatibility Table
| Version | Status |
|---|---|
| 2.2.0 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.