Airflow Constraints vs FAB providers pyproject

[mclenz]

We are trying to transition from Airflow 2.11.0 to Airflow 3.0.6. Our team is using Chainguard vendor images for security purposes. While testing the Airflow 3.0.6 image, we noticed the Werkzeug version is 3.1.3. This is causing import errors when we try to use FAB with LDAP authentication.

I noticed the constraints file for airflow as a whole lists 2.2.3 as the compatible version, but the fab provider seems to list werkzeug>=2.2,<4 as the supported versions. Is this an unexpected mismatch?

We downgraded to match all versions listed in the constraints file, and authentication is working properly. We brought this up with the Chainguard support team, and they indicated they are following the recommendations of the fab provider, which shows it supports anything less than version 4.

Thank you for any suggestions/feedback.

[utieyin]

I ran into this same werkzeug error from airflow when testing ldap user creation. Looking at the code and error this line

airflow/providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py

Line 806 in 20783d8

from werkzeug import __version__ as werkzeug_version

seems to be the culprit. Since the requirement says werkzeug greater than 2 but less than 4 is allowed, is there a reason this logic can't be changed?
I am happy to provide a patch for this.

[potiuk]

It is not mentioned what error is raised when higher version of werkzeug is used, so hard to say - but yes. @vincbeck. I noticed that Werkzeug in the constraints is kept to this lower version because connexion[flask] is still a dependency of the FAB provider - but I believe, it's not used in Fab any more. Maybe you could remove it and potentially fix any of the errors caused by higher Werkzeug version?

[vincbeck]

It is not mentioned what error is raised when higher version of werkzeug is used, so hard to say - but yes. @vincbeck. I noticed that Werkzeug in the constraints is kept to this lower version because connexion[flask] is still a dependency of the FAB provider - but I believe, it's not used in Fab any more. Maybe you could remove it and potentially fix any of the errors caused by higher Werkzeug version?

connexion is still used in fab provider to power FAB api (list users, list roles etc).

I am happy to provide a patch for this.

Please do and ping me in the PR :)

[utieyin]

This issue seems to now be fixed in 3.1.0!

[potiuk]

Plase @salimuddin07 stop - I am for now hiding those generated answers but one or few more times and I will report it as spam and your account will be blocked by Github as countless others.

[utieyin]

Apologies, this isn't fixed.
@vincbeck I created this PR #56398.
Appreciate your feedback on this