The Fix
Upgrade to version 3.0.3 or later.
Based on closed pallets/flask issue #5537 · PR/commit linked
Production note: Most teams hit this during upgrades or environment changes. Roll out with a canary and smoke critical endpoints (health, OpenAPI/docs) before 100%.
@@ -1,9 +1,7 @@
#!/bin/bash
set -e
-
-python3 -m venv .venv
+python3 -m venv --upgrade-deps .venv
Option A — Upgrade to fixed release\nUpgrade to version 3.0.3 or later.\nWhen NOT to use: Do not use this fix if mypy is required for your project's type checking.\n\n
Why This Fix Works in Production
- Trigger: If this was an intentional change of type checkers, then would expect that `mypy` be completely removed, and `pyright` be the command run in `tox typing`.
- Mechanism: The project was still using mypy for type checking instead of the newly added pyright
- Why the fix works: Updated project files to include pyright for type checking instead of mypy. (first fixed release: 3.0.3).
- If left unfixed, the same config can fail only in production (env differences), causing startup failures or partial feature outages.
Why This Breaks in Prod
- The project was still using mypy for type checking instead of the newly added pyright
- Production symptom (often without a traceback): If this was an intentional change of type checkers, then would expect that `mypy` be completely removed, and `pyright` be the command run in `tox typing`.
Proof / Evidence
- GitHub issue: #5537
- Fix PR: https://github.com/pallets/flask/pull/5457
- First fixed release: 3.0.3
- Reproduced locally: No (not executed)
- Last verified: 2026-02-09
- Confidence: 0.95
- Did this fix it?: Yes (upstream fix exists)
- Own content ratio: 0.72
Discussion
High-signal excerpts from the issue thread (symptoms, repros, edge-cases).
“We added pyright in 3.0.3 (see: https://github.com/pallets/flask/pull/5457), but mypy is still being used for type checking https://github.com/pallets/flask/blob/main/tox.ini#L29-L32, and pyright is not. If this was an intentional change of”
Failure Signature (Search String)
- If this was an intentional change of type checkers, then would expect that `mypy` be completely removed, and `pyright` be the command run in `tox typing`.
- It should be noted, however, that running `pyright` yields 90 errors (71 tests/19 src). Is there an upgrade path or was this an oversight?
Copy-friendly signature
Failure Signature
-----------------
If this was an intentional change of type checkers, then would expect that `mypy` be completely removed, and `pyright` be the command run in `tox typing`.
It should be noted, however, that running `pyright` yields 90 errors (71 tests/19 src). Is there an upgrade path or was this an oversight?
Error Message
Signature-only (no traceback captured)
Error Message
-------------
If this was an intentional change of type checkers, then would expect that `mypy` be completely removed, and `pyright` be the command run in `tox typing`.
It should be noted, however, that running `pyright` yields 90 errors (71 tests/19 src). Is there an upgrade path or was this an oversight?
What Broke
Type checking errors were not being reported correctly, leading to potential undetected issues.
Why It Broke
The project was still using mypy for type checking instead of the newly added pyright
Fix Options (Details)
Option A — Upgrade to fixed release Safe default (recommended)
Upgrade to version 3.0.3 or later.
Use when you can deploy the upstream fix. It is usually lower-risk than long-lived workarounds.
Fix reference: https://github.com/pallets/flask/pull/5457
First fixed release: 3.0.3
Last verified: 2026-02-09. Validate in your environment.
When NOT to Use This Fix
- Do not use this fix if mypy is required for your project's type checking.
Did This Fix Work in Your Case?
Quick signal helps us prioritize which fixes to verify and improve.
Prevention
- Capture the exact failing error string in logs and tests so you can reproduce via a minimal script.
- Pin production dependencies and upgrade only with a reproducible test that hits the failing path.
Version Compatibility Table
| Version | Status |
|---|---|
| 3.0.3 | Fixed |
Related Issues
No related fixes found.
Sources
We don’t republish the full GitHub discussion text. Use the links above for context.