build(python): upgrade to Flask 3.x (#678)

Upgrade Flask from `<2.3.0` to `>=3.0.0` and Werkzeug from
`<2.3.0` to `>=3.0.0`, in line with the Invenio package upgrade
in reana-server. Bump marshmallow from `<3.0.0` to
`>=3.5.0,<4.0.0` and webargs to `>=8.0`, since the new Invenio
stack requires marshmallow 3 and the corresponding webargs 8.

Adapt the REST endpoints to the new marshmallow 3 and webargs 8
APIs. Replace the deprecated `missing=` keyword on schema fields
with `load_default=`. Add `unknown=marshmallow.EXCLUDE` to all
`@use_kwargs` and `@use_args` decorators that parse query
parameters, so that REANA-specific extras such as `access_token`
are silently ignored, matching the pre-upgrade webargs 5
behaviour.

Replace all remaining `Model.query` call sites in the REST
handlers, the workflow run manager, and the test suite with
explicit `Session.query(Model)` queries, since SQLAlchemy 2.x
no longer supports the `Base.query` shortcut.

Replace the deprecated `FLASK_ENV` setting with `FLASK_DEBUG`,
both in the runtime checks of the workflow run manager and in
the `DEBUG_ENV_VARS` injected into spawned workflow engine
containers. Update the test configuration to use `DEBUG` instead
of `FLASK_ENV`.

Remove pinned `reana-commons`, `reana-db`, and `kubernetes`
entries from `requirements.txt` so that `pip install .` resolves
them freshly from `setup.py` against the locally-mounted
`modules/reana-db` and `modules/reana-commons` shared sources
during development, avoiding version conflicts with PyPI
versions that still carry the old pins.

Closes reanahub/reana-server#770

Author: tiborsimko

reana_workflow_controller/config.py

@@ -227,7 +227,7 @@ def compose_reana_url(hostname: str, hostport: int) -> str:
         "value": os.getenv("WDB_SOCKET_SERVER", f"{REANA_COMPONENT_PREFIX}-wdb"),
     },
     {"name": "WDB_NO_BROWSER_AUTO_OPEN", "value": "True"},
-    {"name": "FLASK_ENV", "value": "development"},
+    {"name": "FLASK_DEBUG", "value": "1"},
 )
 """Common to all workflow engines environment variables for debug mode."""
 

reana_workflow_controller/rest/utils.py

@@ -266,10 +266,14 @@ def delete_workflow(workflow, all_runs=False, workspace=False):
                     remove_workflow_workspace(workflow.workspace_path)
                     # 3. update the disk usage of the user
                     disk_resource = get_default_quota_resource(ResourceType.disk.name)
-                    workflow_disk_resource = WorkflowResource.query.filter(
-                        WorkflowResource.workflow_id == workflow.id_,
-                        WorkflowResource.resource_id == disk_resource.id_,
-                    ).one_or_none()
+                    workflow_disk_resource = (
+                        Session.query(WorkflowResource)
+                        .filter(
+                            WorkflowResource.workflow_id == workflow.id_,
+                            WorkflowResource.resource_id == disk_resource.id_,
+                        )
+                        .one_or_none()
+                    )
                     disk_usage = None
                     if workflow_disk_resource:
                         disk_usage = workflow_disk_resource.quota_used

reana_workflow_controller/rest/workflows.py

@@ -19,6 +19,7 @@
 from sqlalchemy import and_, nullslast, or_, select
 from sqlalchemy.orm import aliased
 from sqlalchemy.exc import IntegrityError
+import marshmallow
 from webargs import fields, validate
 from webargs.flaskparser import use_args, use_kwargs
 from reana_commons.config import WORKFLOW_TIME_FORMAT
@@ -80,18 +81,19 @@
     {
         "include_progress": fields.Bool(),
         "include_workspace_size": fields.Bool(),
-        "search": fields.String(missing=""),
-        "sort": fields.String(missing="desc"),
-        "status": fields.String(missing=""),
+        "search": fields.String(load_default=""),
+        "sort": fields.String(load_default="desc"),
+        "status": fields.String(load_default=""),
         "type": fields.String(required=True),
         "user": fields.String(required=True),
-        "verbose": fields.Bool(missing=False),
+        "verbose": fields.Bool(load_default=False),
         "workflow_id_or_name": fields.String(),
-        "shared": fields.Bool(missing=False),
+        "shared": fields.Bool(load_default=False),
         "shared_by": fields.String(),
         "shared_with": fields.String(),
     },
     location="query",
+    unknown=marshmallow.EXCLUDE,
 )
 def get_workflows(args, paginate=None):  # noqa
     r"""Get all workflows.
@@ -318,7 +320,7 @@ def get_workflows(args, paginate=None):  # noqa
 
     try:
 
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user_uuid)}), 404
 
@@ -590,7 +592,7 @@ def create_workflow():  # noqa
     """
     try:
         user_uuid = request.args["user"]
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return (
                 jsonify(
@@ -946,7 +948,9 @@ def get_workflow_diff(workflow_id_or_name_a, workflow_id_or_name_b):  # noqa
 
 
 @blueprint.route("/workflows/<workflow_id_or_name>/retention_rules")
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs(
+    {"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE
+)
 def get_workflow_retention_rules(workflow_id_or_name: str, user: str):
     r"""Get the retention rules of a workflow.
 
@@ -1058,7 +1062,9 @@ def get_workflow_retention_rules(workflow_id_or_name: str, user: str):
 
 
 @blueprint.route("/workflows/<workflow_id_or_name>/share", methods=["POST"])
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs(
+    {"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE
+)
 @use_kwargs(
     {
         "user_email_to_share_with": fields.Str(required=True),
@@ -1170,7 +1176,7 @@ def share_workflow(
     valid_until = kwargs.get("valid_until")
 
     try:
-        sharer = User.query.filter(User.id_ == user).first()
+        sharer = Session.query(User).filter(User.id_ == user).first()
         if not sharer:
             return (
                 jsonify({"message": f"User with id '{user}' does not exist."}),
@@ -1243,6 +1249,7 @@ def share_workflow(
         "user_email_to_unshare_with": fields.Str(required=True),
     },
     location="query",
+    unknown=marshmallow.EXCLUDE,
 )
 def unshare_workflow(
     workflow_id_or_name: str, user: str, user_email_to_unshare_with: str
@@ -1362,7 +1369,7 @@ def unshare_workflow(
               }
     """
     try:
-        sharer = User.query.filter(User.id_ == user).first()
+        sharer = Session.query(User).filter(User.id_ == user).first()
         if not sharer:
             return (
                 jsonify({"message": f"User with id '{sharer}' does not exist."}),
@@ -1411,7 +1418,9 @@ def unshare_workflow(
 
 
 @blueprint.route("/workflows/<workflow_id_or_name>/share-status", methods=["GET"])
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs(
+    {"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE
+)
 def get_workflow_share_status(
     workflow_id_or_name: str,
     user: str,

reana_workflow_controller/rest/workflows_session.py

@@ -8,6 +8,7 @@
 
 """REANA Workflow Controller interactive sessions REST API."""
 
+import marshmallow
 from flask import Blueprint, jsonify, request
 from webargs import fields
 from webargs.flaskparser import use_kwargs
@@ -24,7 +25,9 @@
     "/workflows/<workflow_id_or_name>/open/<interactive_session_type>",
     methods=["POST"],
 )
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs(
+    {"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE
+)
 @use_kwargs({"image": fields.Str()}, location="json")
 def open_interactive_session(
     workflow_id_or_name, interactive_session_type, user, **kwargs

reana_workflow_controller/rest/workflows_status.py

@@ -11,6 +11,7 @@
 import json
 
 from flask import Blueprint, jsonify, request
+import marshmallow
 from webargs import fields
 from webargs.flaskparser import use_kwargs
 
@@ -362,6 +363,7 @@ def get_workflow_status(workflow_id_or_name):  # noqa
         "status": fields.Str(required=True),
     },
     location="query",
+    unknown=marshmallow.EXCLUDE,
 )
 def set_workflow_status(
     workflow_id_or_name: str, user: str, status: str, **parameters: dict

reana_workflow_controller/rest/workflows_workspace.py

@@ -24,6 +24,7 @@
 
 from reana_commons import workspace
 from reana_commons.errors import REANAWorkspaceError
+from reana_db.database import Session
 from reana_db.models import User
 from reana_db.utils import (
     _get_workflow_with_uuid_or_name,
@@ -248,7 +249,7 @@ def download_file(workflow_id_or_name, file_name):  # noqa
     """
     try:
         user_uuid = request.args["user"]
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user)}), 404
 
@@ -337,7 +338,7 @@ def delete_file(workflow_id_or_name, file_name):  # noqa
     """
     try:
         user_uuid = request.args["user"]
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user)}), 404
 
@@ -471,7 +472,7 @@ def get_files(workflow_id_or_name, paginate=None):  # noqa
     try:
         user_uuid = request.args["user"]
         search = request.args.get("search")
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user)}), 404
 

reana_workflow_controller/workflow_run_manager.py

@@ -167,7 +167,7 @@ def _validate_interactive_session_image(type_: str, user_image: Optional[str]) -
 class WorkflowRunManager:
     """Interface which specifies how to manage workflow runs."""
 
-    if os.getenv("FLASK_ENV") == "development":
+    if os.getenv("FLASK_DEBUG", "").lower() in ("1", "true"):
         WORKFLOW_ENGINE_COMMON_ENV_VARS.extend(DEBUG_ENV_VARS)
 
     engine_mapping = {
@@ -533,9 +533,11 @@ def start_interactive_session(self, interactive_session_type, image=None, **kwar
 
     def stop_interactive_session(self, interactive_session_id):
         """Stop an interactive workflow run."""
-        int_session = InteractiveSession.query.filter_by(
-            id_=interactive_session_id
-        ).first()
+        int_session = (
+            Session.query(InteractiveSession)
+            .filter_by(id_=interactive_session_id)
+            .first()
+        )
 
         if not int_session:
             raise REANAInteractiveSessionError(
@@ -867,7 +869,7 @@ def _create_job_spec(
         # filter out volumes with the same name
         spec.template.spec.volumes = list({v["name"]: v for v in volumes}.values())
 
-        if os.getenv("FLASK_ENV") == "development":
+        if os.getenv("FLASK_DEBUG", "").lower() in ("1", "true"):
             code_volume_name = "reana-code"
             code_mount_path = "/code"
             k8s_code_volume = client.V1Volume(name=code_volume_name)

requirements.txt

@@ -9,26 +9,27 @@ amqp==5.3.1               # via kombu
 appdirs==1.4.4            # via fs
 arrow==1.4.0              # via isoduration
 attrs==26.1.0             # via jsonschema, referencing
+blinker==1.9.0            # via flask
 bracex==2.6               # via wcmatch
 bravado==10.3.2           # via reana-commons
 bravado-core==6.1.0       # via bravado, reana-commons
-certifi==2026.2.25        # via kubernetes, opensearch-py, requests
+certifi==2026.4.22        # via kubernetes, opensearch-py, requests
 cffi==2.0.0               # via cryptography
-charset-normalizer==3.4.6  # via requests
+charset-normalizer==3.4.7  # via requests
 checksumdir==1.1.9        # via reana-commons
-click==8.3.1              # via flask, reana-commons
-cryptography==46.0.6      # via google-auth, sqlalchemy-utils
+click==8.3.3              # via flask, reana-commons
+cryptography==47.0.0      # via sqlalchemy-utils
+durationpy==0.10          # via kubernetes
 events==0.5               # via opensearch-py
-flask==2.2.5              # via reana-workflow-controller (setup.py)
+flask==3.1.3              # via reana-workflow-controller (setup.py)
 fqdn==1.5.1               # via jsonschema
 fs==2.4.16                # via reana-commons
 gherkin-official==39.0.0  # via reana-commons
 gitdb==4.0.12             # via gitpython
-gitpython==3.1.46         # via reana-workflow-controller (setup.py)
-google-auth==2.49.1       # via kubernetes
-greenlet==3.3.2           # via sqlalchemy
-idna==3.11                # via jsonschema, requests
-importlib-resources==6.5.2  # via swagger-spec-validator
+gitpython==3.1.48         # via reana-workflow-controller (setup.py)
+greenlet==3.5.0           # via sqlalchemy
+idna==3.13                # via jsonschema, requests
+importlib-resources==7.1.0  # via swagger-spec-validator
 isoduration==20.11.0      # via jsonschema
 itsdangerous==2.2.0       # via flask
 jinja2==3.1.6             # via flask
@@ -38,52 +39,50 @@ jsonref==1.1.0            # via bravado-core
 jsonschema[format]==4.26.0  # via bravado-core, reana-commons, swagger-spec-validator
 jsonschema-specifications==2025.9.1  # via jsonschema
 kombu==5.6.2              # via reana-commons
-kubernetes==26.1.0        # via reana-commons
-mako==1.3.10              # via alembic
-markupsafe==3.0.3         # via jinja2, mako, werkzeug
-marshmallow==2.21.0       # via reana-workflow-controller (setup.py), webargs
+kubernetes==35.0.0        # via reana-commons
+mako==1.3.11              # via alembic
+markupsafe==3.0.3         # via flask, jinja2, mako, werkzeug
+marshmallow==3.26.2       # via reana-workflow-controller (setup.py), webargs
 mock==3.0.5               # via reana-commons
 monotonic==1.6            # via bravado
 msgpack==1.1.2            # via bravado-core
 msgpack-python==0.5.6     # via bravado
 oauthlib==3.3.1           # via requests-oauthlib
 opensearch-py==2.7.1      # via reana-workflow-controller (setup.py)
-packaging==26.0           # via kombu, reana-workflow-controller (setup.py)
+packaging==26.2           # via kombu, marshmallow, reana-workflow-controller (setup.py), webargs
 parse==1.21.1             # via reana-commons
-psycopg2-binary==2.9.11   # via reana-db
-pyasn1==0.6.3             # via pyasn1-modules
-pyasn1-modules==0.4.2     # via google-auth
+psycopg2-binary==2.9.12   # via reana-db
 pycparser==3.0            # via cffi
 python-dateutil==2.9.0.post0  # via arrow, bravado, bravado-core, kubernetes, opensearch-py
 pytz==2026.1.post1        # via bravado-core
 pyuwsgi==2.0.30.post1     # via reana-workflow-controller (setup.py)
 pyyaml==6.0.3             # via bravado, bravado-core, kubernetes, reana-commons, swagger-spec-validator
-reana-commons[kubernetes]==0.95.0a14  # via reana-db, reana-workflow-controller (setup.py)
-reana-db==0.95.0a6        # via reana-workflow-controller (setup.py)
+reana-commons[kubernetes]==0.95.0a15  # via reana-db, reana-workflow-controller (setup.py)
+reana-db==0.95.0a7        # via reana-workflow-controller (setup.py)
 referencing==0.37.0       # via jsonschema, jsonschema-specifications
-requests==2.33.0          # via bravado, bravado-core, kubernetes, opensearch-py, reana-workflow-controller (setup.py), requests-oauthlib
+requests==2.33.1          # via bravado, bravado-core, kubernetes, opensearch-py, reana-workflow-controller (setup.py), requests-oauthlib
 requests-oauthlib==2.0.0  # via kubernetes
 rfc3339-validator==0.1.4  # via jsonschema
 rfc3987==1.3.8            # via jsonschema
 rpds-py==0.30.0           # via jsonschema, referencing
-simplejson==3.20.2        # via bravado, bravado-core
+simplejson==4.1.1         # via bravado, bravado-core
 six==1.17.0               # via bravado, bravado-core, fs, kubernetes, mock, python-dateutil, rfc3339-validator
 smmap==5.0.3              # via gitdb
-sqlalchemy==1.4.54        # via alembic, reana-db, sqlalchemy-utils
-sqlalchemy-utils[encrypted]==0.42.1  # via reana-db, reana-workflow-controller (setup.py)
+sqlalchemy==2.0.49        # via alembic, reana-db, sqlalchemy-utils
+sqlalchemy-utils[encrypted]==0.41.2  # via reana-db, reana-workflow-controller (setup.py)
 swagger-spec-validator==3.0.4  # via bravado-core
-typing-extensions==4.15.0  # via alembic, bravado, gherkin-official, referencing, swagger-spec-validator
-tzdata==2025.3            # via arrow, kombu
+typing-extensions==4.15.0  # via alembic, bravado, gherkin-official, referencing, sqlalchemy, swagger-spec-validator
+tzdata==2026.2            # via arrow, kombu
 uri-template==1.3.0       # via jsonschema
 urllib3==2.6.3            # via kubernetes, opensearch-py, requests
 uwsgi-tools==1.1.1        # via reana-workflow-controller (setup.py)
 uwsgitop==0.12            # via reana-workflow-controller (setup.py)
 vine==5.1.0               # via amqp, kombu
 wcmatch==8.4.1            # via reana-commons
-webargs==6.1.1            # via reana-workflow-controller (setup.py)
+webargs==8.7.1            # via reana-workflow-controller (setup.py)
 webcolors==25.10.0        # via jsonschema
 websocket-client==1.9.0   # via kubernetes
-werkzeug==2.2.3           # via flask, reana-commons, reana-workflow-controller (setup.py)
+werkzeug==3.1.8           # via flask, reana-commons, reana-workflow-controller (setup.py)
 
 # The following packages are considered to be unsafe in a requirements file:
 # setuptools

setup.py

@@ -33,7 +33,7 @@
         "sphinxcontrib-redoc>=1.5.1",
     ],
     "tests": [
-        "pytest-reana>=0.95.0a4,<0.96.0",
+        "pytest-reana>=0.95.0a9,<0.96.0",
     ],
 }
 
@@ -44,21 +44,21 @@
     extras_require["all"].extend(reqs)
 
 install_requires = [
-    "Flask>=2.1.1,<2.3.0",  # same upper pin as invenio-base/reana-server
-    "Werkzeug>=2.1.0,<2.3.0",  # same upper pin as invenio-base
+    "Flask>=3.0.0,<4.0.0",
+    "Werkzeug>=3.0.0",
     "gitpython>=2.1",
     "jsonpickle>=0.9.6",
-    "marshmallow>2.13.0,<3.0.0",  # same upper pin as reana-server
+    "marshmallow>=3.5.0,<4.0.0",
     "opensearch-py>=2.7.0,<2.8.0",
     "packaging>=18.0",
-    "reana-commons[kubernetes]>=0.95.0a14,<0.96.0",
-    "reana-db>=0.95.0a6,<0.96.0",
+    "reana-commons[kubernetes]>=0.95.0a15,<0.96.0",
+    "reana-db>=0.95.0a7,<0.96.0",
     "requests>=2.25.0",
     "sqlalchemy-utils>=0.31.0",
     "uwsgi-tools>=1.1.1",
     "pyuwsgi>=2.0.17",
     "uwsgitop>=0.10",
-    "webargs>=6.1.0,<7.0.0",
+    "webargs>=8.0",
 ]
 
 packages = find_packages()

tests/conftest.py

@@ -51,7 +51,7 @@ def base_app(tmp_shared_volume_path):
         "SHARED_VOLUME_PATH": tmp_shared_volume_path,
         "SQLALCHEMY_DATABASE_URI": os.getenv("REANA_SQLALCHEMY_DATABASE_URI"),
         "SQLALCHEMY_TRACK_MODIFICATIONS": False,
-        "FLASK_ENV": "development",
+        "DEBUG": True,
         "ORGANIZATIONS": ["default"],
     }
     app_ = create_app(config_mapping=config_mapping)