Issue with Werkzeug bump

[ghawes85]

I have a few Flask applications running on Flask 2.3.2. On deployment today, the 2 apps went down. Error:

File "/tmp/8dbc37810e69912/wsgi.py", line 3, in
2023-10-03T02:41:50.698042229Z from application import create_app
2023-10-03T02:41:50.698045529Z File "/tmp/8dbc37810e69912/application/init.py", line 8, in
2023-10-03T02:41:50.698049029Z from flask_login import login_required
2023-10-03T02:41:50.698052329Z File "/tmp/8dbc37810e69912/antenv/lib/python3.10/site-packages/flask_login/init.py", line 12, in
2023-10-03T02:41:50.698055829Z from .login_manager import LoginManager
2023-10-03T02:41:50.698059729Z File "/tmp/8dbc37810e69912/antenv/lib/python3.10/site-packages/flask_login/login_manager.py", line 33, in
2023-10-03T02:41:50.698066830Z from .utils import _create_identifier
2023-10-03T02:41:50.698070030Z File "/tmp/8dbc37810e69912/antenv/lib/python3.10/site-packages/flask_login/utils.py", line 14, in
2023-10-03T02:41:50.698073530Z from werkzeug.urls import url_decode
2023-10-03T02:41:50.698076930Z ImportError: cannot import name 'url_decode' from 'werkzeug.urls'

I noticed that a few days ago werkzeug was bumped from 2.7.2 to 3.0.0

Pinning werkzeug back to 2.7.2 in my project resolves my issue.

Environment:

• Python version: 3.10.0
• Flask version: 2.3.2

[davidism]

When writing an application, you must use a tool like pip-tools to pin your application's full dependency tree. This gives you reproducible deployments, allowing you to control when you get updates. Be sure to run your tests with deprecation warnings treated as errors so that you get notified of those types of changes early.

Please review any of the following for more information:

• https://hynek.me/articles/semver-will-not-save-you/
• https://www.youtube.com/watch?v=WSVFw-3ssXM&t
• https://snarky.ca/why-i-dont-like-semver/
• https://caremad.io/posts/2016/02/versioning-software/
• https://bernat.tech/posts/version-numbers/
• https://iscinumpy.dev/post/bound-version-constraints/

[vimalloc]

In case other extension maintainers run into this issue while doing CI runs on the flask 2.x releases, I was able to lock the flask and werkzeug version in my tox.ini like such. Putting it here cause it took me a minute to figure out how to accomplish this in the tox.ini file, so maybe it will save someone else some time:

deps =
  flask2: Flask<3
  flask2: Werkzeug<3
  ...