diff --git a/CHANGES.rst b/CHANGES.rst
index b0a3a0ae..f9c3e92b 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -6,6 +6,17 @@ Version 2.2.0
 Unreleased
 
 
+Version 2.1.2
+-------------
+
+Unreleased
+
+-   Fix type annotation for ``json.loads``, it accepts str or bytes.
+    :issue:`4519`
+-   The ``--cert`` and ``--key`` options on ``flask run`` can be given
+    in either order. :issue:`4459`
+
+
 Version 2.1.1
 -------------
 
diff --git a/docs/testing.rst b/docs/testing.rst
index e259f098..6f9d6ee1 100644
--- a/docs/testing.rst
+++ b/docs/testing.rst
@@ -142,9 +142,9 @@ use ``pathlib.Path`` to get files relative to the current test file.
 
     def test_edit_user(client):
         response = client.post("/user/2/edit", data={
-            name="Flask",
-            theme="dark",
-            picture=(resources / "picture.png").open("rb"),
+            "name": "Flask",
+            "theme": "dark",
+            "picture": (resources / "picture.png").open("rb"),
         })
         assert response.status_code == 200
 
diff --git a/src/flask/cli.py b/src/flask/cli.py
index 972698df..36c4f1b6 100644
--- a/src/flask/cli.py
+++ b/src/flask/cli.py
@@ -763,7 +763,10 @@ class SeparatedPathType(click.Path):
 @click.option("--host", "-h", default="127.0.0.1", help="The interface to bind to.")
 @click.option("--port", "-p", default=5000, help="The port to bind to.")
 @click.option(
-    "--cert", type=CertParamType(), help="Specify a certificate file to use HTTPS."
+    "--cert",
+    type=CertParamType(),
+    help="Specify a certificate file to use HTTPS.",
+    is_eager=True,
 )
 @click.option(
     "--key",
diff --git a/src/flask/json/__init__.py b/src/flask/json/__init__.py
index 43c018e7..edc9793d 100644
--- a/src/flask/json/__init__.py
+++ b/src/flask/json/__init__.py
@@ -153,7 +153,11 @@ def dump(
     _json.dump(obj, fp, **kwargs)
 
 
-def loads(s: str, app: t.Optional["Flask"] = None, **kwargs: t.Any) -> t.Any:
+def loads(
+    s: t.Union[str, bytes],
+    app: t.Optional["Flask"] = None,
+    **kwargs: t.Any,
+) -> t.Any:
     """Deserialize an object from a string of JSON.
 
     Takes the same arguments as the built-in :func:`json.loads`, with
diff --git a/tests/test_cli.py b/tests/test_cli.py
index a2fcc5a1..f9f3673a 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -7,7 +7,6 @@ import sys
 import types
 from functools import partial
 from pathlib import Path
-from unittest.mock import patch
 
 import click
 import pytest
@@ -25,7 +24,6 @@ from flask.cli import FlaskGroup
 from flask.cli import get_version
 from flask.cli import load_dotenv
 from flask.cli import locate_app
-from flask.cli import main as cli_main
 from flask.cli import NoAppException
 from flask.cli import prepare_import
 from flask.cli import run_command
@@ -555,9 +553,14 @@ def test_run_cert_path():
     with pytest.raises(click.BadParameter):
         run_command.make_context("run", ["--key", __file__])
 
+    # cert specified first
     ctx = run_command.make_context("run", ["--cert", __file__, "--key", __file__])
     assert ctx.params["cert"] == (__file__, __file__)
 
+    # key specified first
+    ctx = run_command.make_context("run", ["--key", __file__, "--cert", __file__])
+    assert ctx.params["cert"] == (__file__, __file__)
+
 
 def test_run_cert_adhoc(monkeypatch):
     monkeypatch.setitem(sys.modules, "cryptography", None)
@@ -654,11 +657,3 @@ def test_cli_empty(app):
 
     result = app.test_cli_runner().invoke(args=["blue", "--help"])
     assert result.exit_code == 2, f"Unexpected success:\n\n{result.output}"
-
-
-def test_click_7_deprecated():
-    with patch("flask.cli.cli"):
-        if int(click.__version__[0]) < 8:
-            pytest.deprecated_call(cli_main, match=".* Click 7 is deprecated")
-        else:
-            cli_main()