chore: bump werkzeug and Flask (#23965)

requirements/base.txt

@@ -35,7 +35,7 @@ cffi==1.15.1
     # via
     #   cryptography
     #   pynacl
-click==8.0.4
+click==8.1.3
     # via
     #   apache-superset
     #   celery
@@ -70,7 +70,7 @@ dnspython==2.1.0
     # via email-validator
 email-validator==1.1.3
     # via flask-appbuilder
-flask==2.1.3
+flask==2.2.5
     # via
     #   apache-superset
     #   flask-appbuilder
@@ -130,11 +130,11 @@ idna==3.2
     # via email-validator
 isodate==0.6.0
     # via apache-superset
-itsdangerous==2.1.1
+itsdangerous==2.1.2
     # via
     #   flask
     #   flask-wtf
-jinja2==3.0.3
+jinja2==3.1.2
     # via
     #   flask
     #   flask-babel
@@ -152,6 +152,7 @@ markupsafe==2.1.1
     # via
     #   jinja2
     #   mako
+    #   werkzeug
     #   wtforms
 marshmallow==3.13.0
     # via
@@ -281,8 +282,9 @@ wcwidth==0.2.5
     # via prompt-toolkit
 webencodings==0.5.1
     # via bleach
-werkzeug==2.1.2
+werkzeug==2.3.3
     # via
+    #   apache-superset
     #   flask
     #   flask-jwt-extended
     #   flask-login

requirements/docker.txt

@@ -12,9 +12,11 @@
     #   -r requirements/docker.in
 gevent==21.8.0
     # via -r requirements/docker.in
-greenlet==1.1.3.post0
-    # via gevent
-psycopg2-binary==2.9.5
+greenlet==2.0.2
+    # via
+    #   -r requirements/docker.in
+    #   gevent
+psycopg2-binary==2.9.6
     # via apache-superset
 zope-event==4.5.0
     # via gevent

requirements/integration.txt

@@ -9,7 +9,9 @@ build==0.8.0
     # via pip-tools
 cfgv==3.3.0
     # via pre-commit
-click==8.0.4
+chardet==5.1.0
+    # via tox
+click==8.1.3
     # via
     #   pip-compile-multi
     #   pip-tools

requirements/testing.txt

@@ -116,7 +116,9 @@ pyhive[presto]==0.6.5
     # via apache-superset
 pylint==2.9.6
     # via -r requirements/testing.in
-pytest==6.2.4
+pyhive[presto]==0.6.5
+    # via apache-superset
+pytest==7.3.1
     # via
     #   -r requirements/testing.in
     #   pytest-cov

setup.py

@@ -82,7 +82,7 @@ def get_git_sha() -> str:
         "cron-descriptor",
         "cryptography>=39.0.0,<40",
         "deprecation>=2.1.0, <2.2.0",
-        "flask>=2.1.3, <2.2",
+        "flask>=2.2.5, <3.0.0",
         "flask-appbuilder>=4.3.0, <5.0.0",
         "flask-caching>=1.10.1, <1.11",
         "flask-compress>=1.13, <2.0",
@@ -123,7 +123,8 @@ def get_git_sha() -> str:
         "tabulate>=0.8.9, <0.9",
         "typing-extensions>=4, <5",
         "waitress; sys_platform == 'win32'",
-        "wtforms>=2.3.3, <2.4",
+        "werkzeug>=2.3.3, <3",
+        "wtforms>=2.3.3, <4",
         "wtforms-json",
         "xlsxwriter>=3.0.7, <3.1",
     ],

tests/integration_tests/async_events/api_tests.py

@@ -33,6 +33,7 @@ def fetch_events(self, last_id: Optional[str] = None):
 
     @mock.patch("uuid.uuid4", return_value=UUID)
     def test_events(self, mock_uuid4):
+        app._got_first_request = False
         async_query_manager.init_app(app)
         self.login(username="admin")
         with mock.patch.object(async_query_manager._redis, "xrange") as mock_xrange:
@@ -46,6 +47,7 @@ def test_events(self, mock_uuid4):
 
     @mock.patch("uuid.uuid4", return_value=UUID)
     def test_events_last_id(self, mock_uuid4):
+        app._got_first_request = False
         async_query_manager.init_app(app)
         self.login(username="admin")
         with mock.patch.object(async_query_manager._redis, "xrange") as mock_xrange:
@@ -59,6 +61,7 @@ def test_events_last_id(self, mock_uuid4):
 
     @mock.patch("uuid.uuid4", return_value=UUID)
     def test_events_results(self, mock_uuid4):
+        app._got_first_request = False
         async_query_manager.init_app(app)
         self.login(username="admin")
         with mock.patch.object(async_query_manager._redis, "xrange") as mock_xrange:
@@ -107,6 +110,7 @@ def test_events_results(self, mock_uuid4):
         self.assertEqual(response, expected)
 
     def test_events_no_login(self):
+        app._got_first_request = False
         async_query_manager.init_app(app)
         rv = self.fetch_events()
         assert rv.status_code == 401

tests/integration_tests/charts/data/api_tests.py

@@ -28,10 +28,7 @@
 from flask import Response
 from tests.integration_tests.conftest import with_feature_flags
 from superset.models.sql_lab import Query
-from tests.integration_tests.base_tests import (
-    SupersetTestCase,
-    test_client,
-)
+from tests.integration_tests.base_tests import SupersetTestCase, test_client
 from tests.integration_tests.annotation_layers.fixtures import create_annotation_layers
 from tests.integration_tests.fixtures.birth_names_dashboard import (
     load_birth_names_dashboard_with_slices,
@@ -602,6 +599,7 @@ def test_when_where_parameter_is_template_and_query_result_type__query_is_templa
     @pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
     def test_chart_data_async(self):
         self.logout()
+        app._got_first_request = False
         async_query_manager.init_app(app)
         self.login("admin")
         rv = self.post_assert_metric(CHART_DATA_URI, self.query_context_payload, "data")
@@ -619,6 +617,7 @@ def test_chart_data_async_cached_sync_response(self):
         Chart data API: Test chart data query returns results synchronously
         when results are already cached.
         """
+        app._got_first_request = False
         async_query_manager.init_app(app)
 
         class QueryContext:
@@ -648,6 +647,7 @@ def test_chart_data_async_results_type(self):
         """
         Chart data API: Test chart data query non-JSON format (async)
         """
+        app._got_first_request = False
         async_query_manager.init_app(app)
         self.query_context_payload["result_type"] = "results"
         rv = self.post_assert_metric(CHART_DATA_URI, self.query_context_payload, "data")
@@ -659,6 +659,7 @@ def test_chart_data_async_invalid_token(self):
         """
         Chart data API: Test chart data query (async)
         """
+        app._got_first_request = False
         async_query_manager.init_app(app)
         test_client.set_cookie(
             "localhost", app.config["GLOBAL_ASYNC_QUERIES_JWT_COOKIE_NAME"], "foo"
@@ -974,6 +975,7 @@ def test_chart_data_cache(self, cache_loader):
         """
         Chart data cache API: Test chart data async cache request
         """
+        app._got_first_request = False
         async_query_manager.init_app(app)
         cache_loader.load.return_value = self.query_context_payload
         orig_run = ChartDataCommand.run
@@ -1000,6 +1002,7 @@ def test_chart_data_cache_run_failed(self, cache_loader):
         """
         Chart data cache API: Test chart data async cache request with run failure
         """
+        app._got_first_request = False
         async_query_manager.init_app(app)
         cache_loader.load.return_value = self.query_context_payload
         rv = self.get_assert_metric(
@@ -1017,8 +1020,9 @@ def test_chart_data_cache_no_login(self, cache_loader):
         """
         Chart data cache API: Test chart data async cache request (no login)
         """
-        self.logout()
+        app._got_first_request = False
         async_query_manager.init_app(app)
+        self.logout()
         cache_loader.load.return_value = self.query_context_payload
         orig_run = ChartDataCommand.run
 
@@ -1039,6 +1043,7 @@ def test_chart_data_cache_key_error(self):
         """
         Chart data cache API: Test chart data async cache request with invalid cache key
         """
+        app._got_first_request = False
         async_query_manager.init_app(app)
         rv = self.get_assert_metric(
             f"{CHART_DATA_URI}/test-cache-key", "data_from_cache"
@@ -1156,10 +1161,10 @@ def test_data_cache_default_timeout(
 
 
 def test_chart_cache_timeout(
+    load_energy_table_with_slice: List[Slice],
     test_client,
     login_as_admin,
     physical_query_context,
-    load_energy_table_with_slice: List[Slice],
 ):
     # should override datasource cache timeout
 
@@ -1178,7 +1183,6 @@ def test_chart_cache_timeout(
     db.session.commit()
 
     physical_query_context["form_data"] = {"slice_id": slice_with_cache_timeout.id}
-
     rv = test_client.post(CHART_DATA_URI, json=physical_query_context)
     assert rv.json["result"][0]["cache_timeout"] == 20
 

tests/integration_tests/core_tests.py

@@ -1088,6 +1088,7 @@ def test_explore_json_async(self):
             "groupby": ["gender"],
             "row_limit": 100,
         }
+        app._got_first_request = False
         async_query_manager.init_app(app)
         self.login(username="admin")
         rv = self.client.post(
@@ -1119,6 +1120,7 @@ def test_explore_json_async_results_format(self):
             "groupby": ["gender"],
             "row_limit": 100,
         }
+        app._got_first_request = False
         async_query_manager.init_app(app)
         self.login(username="admin")
         rv = self.client.post(

tests/integration_tests/dashboards/permalink/api_tests.py

@@ -66,7 +66,7 @@ def permalink_salt() -> Iterator[str]:
 
 
 def test_post(
-    test_client, login_as_admin, dashboard_id: int, permalink_salt: str
+    dashboard_id: int, permalink_salt: str, test_client, login_as_admin
 ) -> None:
     resp = test_client.post(f"api/v1/dashboard/{dashboard_id}/permalink", json=STATE)
     assert resp.status_code == 201
@@ -93,14 +93,14 @@ def test_post_access_denied(test_client, login_as, dashboard_id: int):
     assert resp.status_code == 404
 
 
-def test_post_invalid_schema(test_client, login_as_admin, dashboard_id: int):
+def test_post_invalid_schema(dashboard_id: int, test_client, login_as_admin):
     resp = test_client.post(
         f"api/v1/dashboard/{dashboard_id}/permalink", json={"foo": "bar"}
     )
     assert resp.status_code == 400
 
 
-def test_get(test_client, login_as_admin, dashboard_id: int, permalink_salt: str):
+def test_get(dashboard_id: int, permalink_salt: str, test_client, login_as_admin):
     key = test_client.post(
         f"api/v1/dashboard/{dashboard_id}/permalink", json=STATE
     ).json["key"]

tests/integration_tests/datasource_tests.py

@@ -543,7 +543,7 @@ def test_get_samples_with_filters(test_client, login_as_admin, virtual_dataset):
         f"/datasource/samples?datasource_id={virtual_dataset.id}&datasource_type=table"
     )
     rv = test_client.post(uri, json=None)
-    assert rv.status_code == 400
+    assert rv.status_code == 415
 
     rv = test_client.post(uri, json={})
     assert rv.status_code == 200