Support latest Pallets stack (Flask 2.x, itsdangerous 2.x, Jinja 3.x)

[musicinmybrain]

First check

• I added a very descriptive title to this issue.
• I used the GitHub search to find a similar issue and didn't find it.
• I searched the FastAPI documentation, with the integrated search.
• I already searched in Google "How to X in FastAPI" and didn't find any information.
• I already read and followed all the tutorial in the docs and didn't find an answer.
• I already checked if it is not related to FastAPI but to Pydantic.
• I already checked if it is not related to FastAPI but to Swagger UI.
• I already checked if it is not related to FastAPI but to ReDoc.
• After submitting this, I commit to:
  • Read open issues with questions until I find 2 issues where I can help someone and add a comment to help there.
  • Or, I already hit the "watch" button in this repository to receive notifications and I commit to help at least 2 people that ask questions in the future.
  • Implement a Pull Request for a confirmed bug.
  • Sorry, I’m not a FastAPI user, so I’m unlikely to be able to answer usage questions. I’m the current maintainer of the python-fastapi package in Fedora Linux. I think this issue is helpful rather than distracting, even if I can’t sign up to help with tech support.

Example

Here's a self-contained minimal, reproducible, example with my use case:

Subset of FastAPI’s pyproject.toml:

[tool.flit.metadata.requires-extra]
test = [
    "flask >=1.1.2,<2.0.0"
]
all = [
    "jinja2 >=2.11.2,<3.0.0",
    "itsdangerous >=1.1.0,<2.0.0",
]

Inspection shows the mentioned versions are not supported.

Description

New major versions of the Pallets projects were released about two months ago, including FastAPI dependencies Flask, itsdangerous, and Jinja.

Links to changelogs:

• Flask 2.0.x
• Jinja 3.0.x
• itsdangerous 2.0.x

FastAPI should support the latest versions of these dependencies.

The solution you would like

Review changelogs for breaking changes relevant to FastAPI; test FastAPI with these versions; and adjust pyproject.toml to allow them.

Describe alternatives you've considered

In Fedora Linux:

• Temporarily introduce compatibility packages for the old dependencies, and patch FastAPI to use them—assuming support for the new versions is coming eventually. This is messy, and interactions between different Flask versions are likely to confuse users and break existing apps.
• Drop python-fastapi from the distribution if necessary.

Environment

• OS: [e.g. Linux / Windows / macOS]: Fedora Linux Rawhide (development version) – but this affects all users who need or want to use the latest Pallets stack

• FastAPI Version [e.g. 0.3.0]: 0.66.0

• Python version: Python 3.10.0b3

[musicinmybrain]

Adding a link to the blog post with an overview of the major release across the Pallets stack.

[Garito]

I understand jinja, even itsdangerous, but flask?
What's the point?

[musicinmybrain]

I understand jinja, even itsdangerous, but flask?
What's the point?

Flask is a test dependency because a Flask integration example is documented in docs_src/wsgi/tutorial001.py and tested in tests/test_tutorial/test_wsgi/test_tutorial001.py. It’s a trivial example, so I imagine it will work with Flask 2.0.x without any modifications.

Are you arguing for dropping the test dependency? As long as it’s there, using current major releases of itsdangerous and Jinja will mean testing with a compatible major release of Flask.

---

A quick grep of the FastAPI sources suggests the integrations with jinja2 and itsdangerous are trivial, and mostly just for the purpose of enabling optional features in starlette, so it’s likely that simply loosening the version requirements will suffice for all three packages. I can report that starlette’s test suite does work with the new versions of Jinja and itsdangerous.

[Garito]

Face palm...

[YuriiMotov]

Currently:

    "jinja2 >=3.1.5",

    "itsdangerous >=1.1.0",