Re: [DISCUSS] Possible Werkzeug vulnerabilities fix for Airflow 2 (Connexion 2.15.0rc1)

2025-06-22 Thread Jarek Potiuk
Good news. As a result of our request, Connection 2.15.0rc2 was released in PyPI this morning with Flask>3. I am running now tests with it https://github.com/apache/airflow/pull/51681 and we **finally** have non-conflicting dependencies in Airflow 2.11 with it. It still fails - i.e. we will have t

Re: [DISCUSS] Possible Werkzeug vulnerabilities fix for Airflow 2 (Connexion 2.15.0rc1)

2025-06-18 Thread Jarek Potiuk
Dear Airflow community, Thank you. You are amazing. With all the upvotes and comments we had the contributor of connexion working on bringing Flask 2.3.3+ back to the upcoming Connexion release https://github.com/spec-first/connexion/pull/2058/ Particularly Kamil - thanks for the thoughtful comme

Re: [DISCUSS] Possible Werkzeug vulnerabilities fix for Airflow 2 (Connexion 2.15.0rc1)

2025-06-18 Thread Jarek Potiuk
Thank you Kamil - that's very thoughtful and nice to see your message back on the devlist :D On Wed, Jun 18, 2025 at 7:38 PM Kamil Breguła wrote: > I proposed to split the new connexion release into two versions. First > release one release that supports the new Werkzereg release, and then > rel

Re: [DISCUSS] Possible Werkzeug vulnerabilities fix for Airflow 2 (Connexion 2.15.0rc1)

2025-06-18 Thread Kamil Breguła
I proposed to split the new connexion release into two versions. First release one release that supports the new Werkzereg release, and then release a new Connexion release that supports Flask 3 only. This is not ideal, because Airflow 2 will still be on an unsupported version of Connexion, but we

Re: [DISCUSS] Possible Werkzeug vulnerabilities fix for Airflow 2 (Connexion 2.15.0rc1)

2025-06-17 Thread Jarek Potiuk
I WOULD LIKE TO TAP INTO POWER OF OUR COMMUNITY... PLEASE HELP. We again had another issue with FAB where the root cause was our old Werkzeug version - that we cannot upgrade until now) - old Werkzeug does not support `scrypt` hashing algorithm and latest FAB version defaulted password hashing to

[DISCUSS] Possible Werkzeug vulnerabilities fix for Airflow 2 (Connexion 2.15.0rc1)

2025-06-13 Thread Jarek Potiuk
Hello everyone, As you might know, Airflow 2 has a long-time issue with not being able to upgrade Werkzeug dependency to a non-vulnerable version and that raises a lot of alarms for users who run CVE checks on Airflow. We've been waiting for a long time for that - but it looks like there is a lig