[RELEASE] Werkzeug debugger is loopback-only (carries #5382)

[vivekchand]

Publishes #5382 (merged) to PyPI.

Why this needs to ship, not just merge. The fix lives in dashboard.py and helpers/server.py — both in the wheel — so no user is protected until the package is on PyPI. Nothing about it reaches a machine through a cloud render-only pin.

What rides this: #5382 only.

_run_server called app.run(..., debug=True, ...) unconditionally. Two defaults turn that into real exposure rather than a theoretical one:

• --debug is store_true, default=True (dashboard.py:13697) — dev mode is what you get unless you ask for --no-debug;
• the startup banner advertises the LAN and public URLs, so reaching the dashboard from another machine means adding --host 0.0.0.0.

Do both — which the product invites — and any unhandled exception serves Werkzeug's interactive traceback page, with source, local variables and a PIN-gated eval console, to whoever reached the port. Bandit B201, HIGH.

Verified live before release, one fresh process per host, intercepting what _run_server actually hands app.run:

host=127.0.0.1      debug=True  use_reloader=True
host=localhost      debug=True  use_reloader=True
host=::1            debug=True  use_reloader=True
host=0.0.0.0        debug=False use_reloader=True
host=192.168.1.50   debug=False use_reloader=True
host=::             debug=False use_reloader=True

The same probe on the pre-fix tree returns debug=True for 0.0.0.0 and 192.168.1.50. use_reloader stays True on every bind — auto-reload is what dev mode is for, and it is separately pinned.

25 tests in tests/test_debugger_loopback_only.py, named in ci.yml, with both regressions proven red: debug=True (the original bug) and debug=False (which passes a naive "not True" check while removing the debugger for everyone).

No-PRD: publishes an already-merged and already-recorded security fix; the constraint is documented on the Local Observability Service blueprint.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01Xb6A5G74JiMe3zHFs1JZEP

[8090-software-factory]

✅ Drift Bot (ClawMetry): no drift detected

Drift Bot analyzed the changed files against this project's blueprints and requirements and found no drift.