diff --git a/pkgs/development/python-modules/flask/default.nix b/pkgs/development/python-modules/flask/default.nix
index 760c3ee671ae..7f0ac90533c2 100644
--- a/pkgs/development/python-modules/flask/default.nix
+++ b/pkgs/development/python-modules/flask/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "flask";
-  version = "2.1.3";
+  version = "2.2.2";
 
   src = fetchPypi {
     pname = "Flask";
     inherit version;
-    sha256 = "sha256-FZcuUBffBXXD1sCQuhaLbbkCWeYgrI1+qBOjlrrVtss=";
+    sha256 = "sha256-ZCxFDRnErUgvlnKb0qj20yVUqh4jH09rTn5SZLFsyis=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/werkzeug/default.nix b/pkgs/development/python-modules/werkzeug/default.nix
index aaaecc6098fa..d31fd1569f28 100644
--- a/pkgs/development/python-modules/werkzeug/default.nix
+++ b/pkgs/development/python-modules/werkzeug/default.nix
@@ -9,11 +9,12 @@
 , pytest-timeout
 , pytest-xprocess
 , pytestCheckHook
+, markupsafe
 }:
 
 buildPythonPackage rec {
   pname = "werkzeug";
-  version = "2.1.2";
+  version = "2.2.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -21,10 +22,12 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "Werkzeug";
     inherit version;
-    sha256 = "sha256-HOCOgJPtZ9Y41jh5/Rujc1gX96gN42dNKT9ZhPJftuY=";
+    sha256 = "sha256-fqLUgyLMfA+LOiFe1z6r17XXXQtQ4xqwBihsz/ngC48=";
   };
 
-  propagatedBuildInputs = lib.optionals (!stdenv.isDarwin) [
+  propagatedBuildInputs = [
+    markupsafe
+  ] ++ lib.optionals (!stdenv.isDarwin) [
     # watchdog requires macos-sdk 10.13+
     watchdog
   ] ++ lib.optionals (pythonOlder "3.7") [