Unpin Flask and Werkzeug

[j5awry]

Is your feature request related to a problem? Please describe.
on 20210511, Flask and werkzeug released version 2.0.0. Flask had some API changes which led to breaks, but the community quickly found at least one. There's an upstream bug report in werkzeug that our tests are catching as well:

at least one is related to something report upstream to werkzeug: pallets/werkzeug#2115

We should do dependency upgrades and checks for Flask and werkzeug, run tests, see if any other errors occur in environments, and see what other issues arise in some integration tests.

Describe the solution you'd like
unpin flask and werkzeug

Describe alternatives you've considered
I refuse alternatives! As a maintainer, I maintain that right :P but, really, we should update tests and code as required for it to work. we do not want to stay pinned to lower versions as Flask and werkzeug merrily roll along.

Additional context
Pin PR: #311 311

PR to fix at least one Flask API change: #309

Original issue tracking the Flask API change: #308

[hbusul]

We are using flask-restx for quite a while, I like the idea of werkzeug 2.0 with flask-restx because of the upload speed. There is improvement in werkzeug for parsing uploaded files faster and since we could not benefited from that. We used some 3rd party parser. Is there any beginner issue or clear thing to do that I could do to help speed up the transition?

[j5awry]

@hbusul : the first place to start is running pulling the latest code for flask-restx, unpinning flask and werkzeug, and seeing what errors pop up. We also need to compare local outputs to what the Github Actions showed us:

https://github.com/python-restx/flask-restx/runs/2565726592

finally, it'd be very worthwhile if folks are willing / able to manually upgrade flask and werkzeug on testing setups and see if any other errors bubble from common use cases.

[hbusul]

I will run our internal tests with latest commit(not latest release?) with werkzeug 2.0 and pinpoint the warnings and errors then. I remember tests failing for the werkzeug rc, they probably will fail for 2.0 as well.

[cedricbonhomme]

I am now using latest versions of the Pallets projects with flask-restx 0.4.0.
If I find issues on my project(s) I will report and eventually propose fixes.

[kannanprasanna]

Even with flask-restx 0.4.0, having Flask 2.0.0 and Werkzeug 2.0.0 causes build/runtime issues like shown below. We had to pin the Flask to 1.1.2 and Werkzeug to 1.0.1 versions to resolve this. Could this be addressed in the next release?

/flask_restx/api.py", line 20, in
from flask.helpers import _endpoint_from_view_func
ImportError: cannot import name '_endpoint_from_view_func' from 'flask.helpers'

[hbusul]

@kannanprasanna they fixed it in the master branch, I guess it will be addressed in the next release.
@j5awry I ran our test suite with the master branch, tests are not failing but I'm getting some warnings:

/usr/local/lib/python3.7/site-packages/flask_restx/resource.py:46: DeprecationWarning: 'BaseResponse' is deprecated and will be removed in Werkzeug 2.1. Use 'isinstance(obj, Response)' instead.
  if isinstance(resp, BaseResponse):
/usr/local/lib/python3.7/site-packages/flask_restx/api.py:398: DeprecationWarning: 'BaseResponse' is deprecated and will be removed in Werkzeug 2.1. Use 'isinstance(obj, Response)' instead.
  if isinstance(resp, BaseResponse):
/home/broker/app/apis/ns_namespaces.py:264: DeprecationWarning: The 'attachment_filename' parameter has been renamed to 'download_name'. The old name will be removed in Flask 2.1.
/usr/local/lib/python3.7/site-packages/itsdangerous/jws.py:201: DeprecationWarning: JWS support is deprecated and will be removed in ItsDangerous 2.1. Use a dedicated JWS/JWT library such as authlib.
  super().__init__(secret_key, **kwargs)

attachment_filename getting this one where I use send_file from flask with attachment_filename that one is not related to flask-restx probably but still kept it.
Some related package versions.

Flask==2.0.0
flask-restx==0.4.1.dev0
Werkzeug==2.0.0
itsdangerous==2.0.0
Jinja2==3.0.0

[the-harpia-io]

When you are planning to release this fix?

[the-harpia-io]

Any updates?

[hbusul]

Any updates?

[aluttik]

@j5awry any updates?

[j5awry]

#341 has been merged. At the moment that looks like the only Flask and Werkzeug changes absolutely required.

I'm going to let it marinate on main for a little while though. If teams can pull from main and give the code a try in their environments to ensure everything is working appropriately, I'll put a release together. What I don't want is to merge this in and break a lot of people.

As you can tell, we're small and community driven (most folks making contributions are not maintainers at this point). That means response can be a bit slower when it comes to changes. I'm happy we were able to limit how many people got "broken" when flask rolled, and don't want to further break anyone when we unpin.

NOTE: If you're working in production, you should be freezing your deps. That means picking the versions of Flask and Werkzeug compatible with everything you do. we have tried to be as loosely pinned as possible and leave it to end-users. Double-edged sword there.

[Rafiot]

Thank you @j5awry!

I just tested the updated package and it works for me (important caveat: the tool I'm using it in is very fresh, and it's not in prod yet).

For the ones reading this issue and willing to give it a try, the easiest way is as follows (simply installing the repository doesn't work as you will be missing the swagger assets):

1. Clone python-restx
2. Initialize your virtualenv
3. Go to the directory you cloned python-restx into
4. Run pip install -r requirements/test.pip
5. Run inv assets
6. Run pip install .
7. Restart your flask app

[Rafiot]

One more thing: would it make sense to make a pre-release (https://packaging.python.org/guides/distributing-packages-using-setuptools/#pre-release-versioning)?
That would probably allow more people to give it a try but it will also not be installed by default for people who don't freeze their deps.

[j5awry]

I think it's safe to just release and work through things. At this point, teams should have already pinned Flask and Werkzeug (hopefully). They can unprev Flask and Werkzeug in a test environment after a release. and if there are still issues, we can work through them and try to push patch releases quickly.

[Rafiot]

This solution definitely work for me :)

[eran-gil2]

@j5awry is there an expected release date for the support of flask 2.0.1 and above?
Would really appreciate it :)

[j5awry]

on version 0.5.0, flask has been unpinned