build(python): upgrade to Flask 3.x (reanahub#678)

Upgrade Flask from `<2.3.0` to `>=3.0.0` and Werkzeug from
`<2.3.0` to `>=3.0.0`, in line with the Invenio package upgrade
in reana-server. Bump marshmallow from `<3.0.0` to
`>=3.5.0,<4.0.0` and webargs to `>=8.0`, since the new Invenio
stack requires marshmallow 3 and the corresponding webargs 8.

Adapt the REST endpoints to the new marshmallow 3 and webargs 8
APIs. Replace the deprecated `missing=` keyword on schema fields
with `load_default=`. Add `unknown=marshmallow.EXCLUDE` to all
`@use_kwargs` and `@use_args` decorators that parse query
parameters, so that REANA-specific extras such as `access_token`
are silently ignored, matching the pre-upgrade webargs 5
behaviour.

Replace all remaining `Model.query` call sites in the REST
handlers, the workflow run manager, and the test suite with
explicit `Session.query(Model)` queries, since SQLAlchemy 2.x
no longer supports the `Base.query` shortcut.

Replace the deprecated `FLASK_ENV` setting with `FLASK_DEBUG`,
both in the runtime checks of the workflow run manager and in
the `DEBUG_ENV_VARS` injected into spawned workflow engine
containers. Update the test configuration to use `DEBUG` instead
of `FLASK_ENV`.

Remove pinned `reana-commons`, `reana-db`, and `kubernetes`
entries from `requirements.txt` so that `pip install .` resolves
them freshly from `setup.py` against the locally-mounted
`modules/reana-db` and `modules/reana-commons` shared sources
during development, avoiding version conflicts with PyPI
versions that still carry the old pins.

Closes reanahub/reana-server#770

Author: tiborsimko

reana_workflow_controller/config.py

@@ -227,7 +227,7 @@ def compose_reana_url(hostname: str, hostport: int) -> str:
         "value": os.getenv("WDB_SOCKET_SERVER", f"{REANA_COMPONENT_PREFIX}-wdb"),
     },
     {"name": "WDB_NO_BROWSER_AUTO_OPEN", "value": "True"},
-    {"name": "FLASK_ENV", "value": "development"},
+    {"name": "FLASK_DEBUG", "value": "1"},
 )
 """Common to all workflow engines environment variables for debug mode."""
 

reana_workflow_controller/rest/utils.py

@@ -266,7 +266,7 @@ def delete_workflow(workflow, all_runs=False, workspace=False):
                     remove_workflow_workspace(workflow.workspace_path)
                     # 3. update the disk usage of the user
                     disk_resource = get_default_quota_resource(ResourceType.disk.name)
-                    workflow_disk_resource = WorkflowResource.query.filter(
+                    workflow_disk_resource = Session.query(WorkflowResource).filter(
                         WorkflowResource.workflow_id == workflow.id_,
                         WorkflowResource.resource_id == disk_resource.id_,
                     ).one_or_none()

reana_workflow_controller/rest/workflows.py

@@ -19,6 +19,7 @@
 from sqlalchemy import and_, nullslast, or_, select
 from sqlalchemy.orm import aliased
 from sqlalchemy.exc import IntegrityError
+import marshmallow
 from webargs import fields, validate
 from webargs.flaskparser import use_args, use_kwargs
 from reana_commons.config import WORKFLOW_TIME_FORMAT
@@ -80,18 +81,19 @@
     {
         "include_progress": fields.Bool(),
         "include_workspace_size": fields.Bool(),
-        "search": fields.String(missing=""),
-        "sort": fields.String(missing="desc"),
-        "status": fields.String(missing=""),
+        "search": fields.String(load_default=""),
+        "sort": fields.String(load_default="desc"),
+        "status": fields.String(load_default=""),
         "type": fields.String(required=True),
         "user": fields.String(required=True),
-        "verbose": fields.Bool(missing=False),
+        "verbose": fields.Bool(load_default=False),
         "workflow_id_or_name": fields.String(),
-        "shared": fields.Bool(missing=False),
+        "shared": fields.Bool(load_default=False),
         "shared_by": fields.String(),
         "shared_with": fields.String(),
     },
     location="query",
+    unknown=marshmallow.EXCLUDE,
 )
 def get_workflows(args, paginate=None):  # noqa
     r"""Get all workflows.
@@ -318,7 +320,7 @@ def get_workflows(args, paginate=None):  # noqa
 
     try:
 
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user_uuid)}), 404
 
@@ -590,7 +592,7 @@ def create_workflow():  # noqa
     """
     try:
         user_uuid = request.args["user"]
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return (
                 jsonify(
@@ -946,7 +948,7 @@ def get_workflow_diff(workflow_id_or_name_a, workflow_id_or_name_b):  # noqa
 
 
 @blueprint.route("/workflows/<workflow_id_or_name>/retention_rules")
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs({"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE)
 def get_workflow_retention_rules(workflow_id_or_name: str, user: str):
     r"""Get the retention rules of a workflow.
 
@@ -1058,7 +1060,7 @@ def get_workflow_retention_rules(workflow_id_or_name: str, user: str):
 
 
 @blueprint.route("/workflows/<workflow_id_or_name>/share", methods=["POST"])
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs({"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE)
 @use_kwargs(
     {
         "user_email_to_share_with": fields.Str(required=True),
@@ -1170,7 +1172,7 @@ def share_workflow(
     valid_until = kwargs.get("valid_until")
 
     try:
-        sharer = User.query.filter(User.id_ == user).first()
+        sharer = Session.query(User).filter(User.id_ == user).first()
         if not sharer:
             return (
                 jsonify({"message": f"User with id '{user}' does not exist."}),
@@ -1243,6 +1245,7 @@ def share_workflow(
         "user_email_to_unshare_with": fields.Str(required=True),
     },
     location="query",
+    unknown=marshmallow.EXCLUDE,
 )
 def unshare_workflow(
     workflow_id_or_name: str, user: str, user_email_to_unshare_with: str
@@ -1362,7 +1365,7 @@ def unshare_workflow(
               }
     """
     try:
-        sharer = User.query.filter(User.id_ == user).first()
+        sharer = Session.query(User).filter(User.id_ == user).first()
         if not sharer:
             return (
                 jsonify({"message": f"User with id '{sharer}' does not exist."}),
@@ -1411,7 +1414,7 @@ def unshare_workflow(
 
 
 @blueprint.route("/workflows/<workflow_id_or_name>/share-status", methods=["GET"])
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs({"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE)
 def get_workflow_share_status(
     workflow_id_or_name: str,
     user: str,

reana_workflow_controller/rest/workflows_session.py

@@ -8,6 +8,7 @@
 
 """REANA Workflow Controller interactive sessions REST API."""
 
+import marshmallow
 from flask import Blueprint, jsonify, request
 from webargs import fields
 from webargs.flaskparser import use_kwargs
@@ -24,7 +25,7 @@
     "/workflows/<workflow_id_or_name>/open/<interactive_session_type>",
     methods=["POST"],
 )
-@use_kwargs({"user": fields.Str(required=True)}, location="query")
+@use_kwargs({"user": fields.Str(required=True)}, location="query", unknown=marshmallow.EXCLUDE)
 @use_kwargs({"image": fields.Str()}, location="json")
 def open_interactive_session(
     workflow_id_or_name, interactive_session_type, user, **kwargs

reana_workflow_controller/rest/workflows_status.py

@@ -11,6 +11,7 @@
 import json
 
 from flask import Blueprint, jsonify, request
+import marshmallow
 from webargs import fields
 from webargs.flaskparser import use_kwargs
 
@@ -362,6 +363,7 @@ def get_workflow_status(workflow_id_or_name):  # noqa
         "status": fields.Str(required=True),
     },
     location="query",
+    unknown=marshmallow.EXCLUDE,
 )
 def set_workflow_status(
     workflow_id_or_name: str, user: str, status: str, **parameters: dict

reana_workflow_controller/rest/workflows_workspace.py

@@ -24,6 +24,7 @@
 
 from reana_commons import workspace
 from reana_commons.errors import REANAWorkspaceError
+from reana_db.database import Session
 from reana_db.models import User
 from reana_db.utils import (
     _get_workflow_with_uuid_or_name,
@@ -248,7 +249,7 @@ def download_file(workflow_id_or_name, file_name):  # noqa
     """
     try:
         user_uuid = request.args["user"]
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user)}), 404
 
@@ -337,7 +338,7 @@ def delete_file(workflow_id_or_name, file_name):  # noqa
     """
     try:
         user_uuid = request.args["user"]
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user)}), 404
 
@@ -471,7 +472,7 @@ def get_files(workflow_id_or_name, paginate=None):  # noqa
     try:
         user_uuid = request.args["user"]
         search = request.args.get("search")
-        user = User.query.filter(User.id_ == user_uuid).first()
+        user = Session.query(User).filter(User.id_ == user_uuid).first()
         if not user:
             return jsonify({"message": "User {} does not exist".format(user)}), 404
 

reana_workflow_controller/workflow_run_manager.py

@@ -167,7 +167,7 @@ def _validate_interactive_session_image(type_: str, user_image: Optional[str]) -
 class WorkflowRunManager:
     """Interface which specifies how to manage workflow runs."""
 
-    if os.getenv("FLASK_ENV") == "development":
+    if os.getenv("FLASK_DEBUG", "").lower() in ("1", "true"):
         WORKFLOW_ENGINE_COMMON_ENV_VARS.extend(DEBUG_ENV_VARS)
 
     engine_mapping = {
@@ -533,7 +533,7 @@ def start_interactive_session(self, interactive_session_type, image=None, **kwar
 
     def stop_interactive_session(self, interactive_session_id):
         """Stop an interactive workflow run."""
-        int_session = InteractiveSession.query.filter_by(
+        int_session = Session.query(InteractiveSession).filter_by(
             id_=interactive_session_id
         ).first()
 
@@ -867,7 +867,7 @@ def _create_job_spec(
         # filter out volumes with the same name
         spec.template.spec.volumes = list({v["name"]: v for v in volumes}.values())
 
-        if os.getenv("FLASK_ENV") == "development":
+        if os.getenv("FLASK_DEBUG", "").lower() in ("1", "true"):
             code_volume_name = "reana-code"
             code_mount_path = "/code"
             k8s_code_volume = client.V1Volume(name=code_volume_name)

requirements.txt

@@ -4,7 +4,6 @@
 #
 #    pip-compile --annotation-style=line --output-file=requirements.txt setup.py
 #
-alembic==1.18.4           # via reana-db
 amqp==5.3.1               # via kombu
 appdirs==1.4.4            # via fs
 arrow==1.4.0              # via isoduration
@@ -19,29 +18,23 @@ checksumdir==1.1.9        # via reana-commons
 click==8.3.1              # via flask, reana-commons
 cryptography==46.0.6      # via google-auth, sqlalchemy-utils
 events==0.5               # via opensearch-py
-flask==2.2.5              # via reana-workflow-controller (setup.py)
 fqdn==1.5.1               # via jsonschema
 fs==2.4.16                # via reana-commons
 gherkin-official==39.0.0  # via reana-commons
 gitdb==4.0.12             # via gitpython
 gitpython==3.1.46         # via reana-workflow-controller (setup.py)
 google-auth==2.49.1       # via kubernetes
-greenlet==3.3.2           # via sqlalchemy
 idna==3.11                # via jsonschema, requests
 importlib-resources==6.5.2  # via swagger-spec-validator
 isoduration==20.11.0      # via jsonschema
-itsdangerous==2.2.0       # via flask
-jinja2==3.1.6             # via flask
 jsonpickle==4.1.1         # via reana-workflow-controller (setup.py)
 jsonpointer==3.1.1        # via jsonschema
 jsonref==1.1.0            # via bravado-core
 jsonschema[format]==4.26.0  # via bravado-core, reana-commons, swagger-spec-validator
 jsonschema-specifications==2025.9.1  # via jsonschema
 kombu==5.6.2              # via reana-commons
-kubernetes==26.1.0        # via reana-commons
 mako==1.3.10              # via alembic
 markupsafe==3.0.3         # via jinja2, mako, werkzeug
-marshmallow==2.21.0       # via reana-workflow-controller (setup.py), webargs
 mock==3.0.5               # via reana-commons
 monotonic==1.6            # via bravado
 msgpack==1.1.2            # via bravado-core
@@ -58,8 +51,6 @@ python-dateutil==2.9.0.post0  # via arrow, bravado, bravado-core, kubernetes, op
 pytz==2026.1.post1        # via bravado-core
 pyuwsgi==2.0.30.post1     # via reana-workflow-controller (setup.py)
 pyyaml==6.0.3             # via bravado, bravado-core, kubernetes, reana-commons, swagger-spec-validator
-reana-commons[kubernetes]==0.95.0a14  # via reana-db, reana-workflow-controller (setup.py)
-reana-db==0.95.0a6        # via reana-workflow-controller (setup.py)
 referencing==0.37.0       # via jsonschema, jsonschema-specifications
 requests==2.33.0          # via bravado, bravado-core, kubernetes, opensearch-py, reana-workflow-controller (setup.py), requests-oauthlib
 requests-oauthlib==2.0.0  # via kubernetes
@@ -69,8 +60,6 @@ rpds-py==0.30.0           # via jsonschema, referencing
 simplejson==3.20.2        # via bravado, bravado-core
 six==1.17.0               # via bravado, bravado-core, fs, kubernetes, mock, python-dateutil, rfc3339-validator
 smmap==5.0.3              # via gitdb
-sqlalchemy==1.4.54        # via alembic, reana-db, sqlalchemy-utils
-sqlalchemy-utils[encrypted]==0.42.1  # via reana-db, reana-workflow-controller (setup.py)
 swagger-spec-validator==3.0.4  # via bravado-core
 typing-extensions==4.15.0  # via alembic, bravado, gherkin-official, referencing, swagger-spec-validator
 tzdata==2025.3            # via arrow, kombu
@@ -80,10 +69,8 @@ uwsgi-tools==1.1.1        # via reana-workflow-controller (setup.py)
 uwsgitop==0.12            # via reana-workflow-controller (setup.py)
 vine==5.1.0               # via amqp, kombu
 wcmatch==8.4.1            # via reana-commons
-webargs==6.1.1            # via reana-workflow-controller (setup.py)
 webcolors==25.10.0        # via jsonschema
 websocket-client==1.9.0   # via kubernetes
-werkzeug==2.2.3           # via flask, reana-commons, reana-workflow-controller (setup.py)
 
 # The following packages are considered to be unsafe in a requirements file:
 # setuptools

setup.py

@@ -44,11 +44,11 @@
     extras_require["all"].extend(reqs)
 
 install_requires = [
-    "Flask>=2.1.1,<2.3.0",  # same upper pin as invenio-base/reana-server
-    "Werkzeug>=2.1.0,<2.3.0",  # same upper pin as invenio-base
+    "Flask>=3.0.0,<4.0.0",
+    "Werkzeug>=3.0.0",
     "gitpython>=2.1",
     "jsonpickle>=0.9.6",
-    "marshmallow>2.13.0,<3.0.0",  # same upper pin as reana-server
+    "marshmallow>=3.5.0,<4.0.0",
     "opensearch-py>=2.7.0,<2.8.0",
     "packaging>=18.0",
     "reana-commons[kubernetes]>=0.95.0a14,<0.96.0",
@@ -58,7 +58,7 @@
     "uwsgi-tools>=1.1.1",
     "pyuwsgi>=2.0.17",
     "uwsgitop>=0.10",
-    "webargs>=6.1.0,<7.0.0",
+    "webargs>=8.0",
 ]
 
 packages = find_packages()

tests/conftest.py

@@ -51,7 +51,7 @@ def base_app(tmp_shared_volume_path):
         "SHARED_VOLUME_PATH": tmp_shared_volume_path,
         "SQLALCHEMY_DATABASE_URI": os.getenv("REANA_SQLALCHEMY_DATABASE_URI"),
         "SQLALCHEMY_TRACK_MODIFICATIONS": False,
-        "FLASK_ENV": "development",
+        "DEBUG": True,
         "ORGANIZATIONS": ["default"],
     }
     app_ = create_app(config_mapping=config_mapping)