security: upgrade Python dependencies to Flask 2.3.3 and Werkzeug 3.1.6 - #7719
Open
wtfiwtz wants to merge 2 commits into
Open
security: upgrade Python dependencies to Flask 2.3.3 and Werkzeug 3.1.6#7719wtfiwtz wants to merge 2 commits into
wtfiwtz wants to merge 2 commits into
Conversation
Upgrade security-critical Python dependencies while staying on Flask 2.x. Werkzeug 3.x is compatible with Flask 2.3.x and provides important security fixes without requiring a Flask 3 migration. Core dependency upgrades: - authlib: 0.15.5 → 1.7.2 (fixes CVEs in OAuth/OIDC flows) - cryptography: 43.0.1 → 48.0.0 - flask: 2.3.2 → 2.3.3 - flask-login: 0.6.0 → 0.6.3 - flask-wtf: 1.1.1 → 1.3.0 - itsdangerous: 2.1.2 → 2.2.0 - jinja2: 3.1.5 → 3.1.6 - pyjwt: 2.4.0 → 2.12.0 - pyopenssl: 24.2.1 → 26.2.0 - python-dotenv: 0.19.2 → 1.2.2 - requests: 2.32.3 → 2.33.0 - sqlparse: 0.5.0 → 0.5.4 - urllib3: 1.26.19 → 1.26.20 - werkzeug: 2.3.8 → 3.1.6 Added transitive dependency pins: pyasn1, mako, pynacl Data source dependency upgrades: - boto3/botocore: 1.28.8 → 1.43.7 - snowflake-connector-python: 3.12.3 → 4.5.0 - New additions: azure-core, grpcio, h11, httpcore, marshmallow Dev dependency upgrades: - pre-commit: 3.3.3 → 4.3.0 - Add filelock, pygments, virtualenv Code changes for authlib 1.x and Werkzeug 3.x compatibility: - Remove api_key_load_user_from_request from user_loader (belongs in request_loader) - Add TESTING-mode reset_request_g_cache hook to prevent g leakage across test requests - Pass explicit client_id/client_secret to oauth.register() (authlib 1.x API) - Replace flask.globals._app_ctx_stack with current_app (Werkzeug 3 removal) Co-authored-by: Cursor <cursoragent@cursor.com>
This was referenced Jun 1, 2026
wtfiwtz
marked this pull request as ready for review
June 1, 2026 06:42
Contributor
Author
CVE / advisory coverage for PR #7719 (
|
| Package | Version change | CVEs / advisories addressed |
|---|---|---|
| werkzeug | 2.3.8 → 3.1.6 | CVE-2026-27199 (GHSA-29vq-49wr-vm6x); also picks up earlier Werkzeug 3.x fixes (e.g. CVE-2024-34069, CVE-2024-49766, CVE-2024-49767) |
| jinja2 | 3.1.5 → 3.1.6 | CVE-2025-27516 (sandbox escape) |
| authlib | 0.15.5 → 1.7.2 | OAuth/OIDC advisory fixes (commit notes “CVEs in OAuth/OIDC flows”; includes issues such as CVE-2024-37568 class JWT/JWS handling) |
| cryptography | 43.0.1 → 48.0.0 | Multiple OpenSSL-binding CVEs in intervening releases |
| pyjwt | 2.4.0 → 2.12.0 | CVE-2022-29217 and related algorithm-confusion fixes |
| urllib3 | 1.26.19 → 1.26.20 | CVE-2025-50181, CVE-2025-50182 (redirect/SSRF-class fixes in 1.26.x) |
| flask | 2.3.2 → 2.3.3 | Flask security patch release |
| requests | 2.32.3 → 2.33.0 | Tracks urllib3 / cert handling fixes |
| sqlparse | 0.5.0 → 0.5.4 | SQL parsing DoS fixes in 0.5.x |
| itsdangerous | 2.1.2 → 2.2.0 | Serializer security improvements |
| pyopenssl | 24.2.1 → 26.2.0 | OpenSSL compatibility / advisory fixes |
| flask-login | 0.6.0 → 0.6.3 | Maintenance / security patch level |
| flask-wtf | 1.1.1 → 1.3.0 | Maintenance / security patch level |
| python-dotenv | 0.19.2 → 1.2.2 | Dependency refresh |
Transitive pins added
| Package | Version | Notes |
|---|---|---|
| pyasn1 | 0.6.3 | Addresses known advisories on dependency chain |
| pynacl | 1.6.2 | Addresses known advisories on dependency chain |
| mako | 1.3.12 | Addresses known advisories on dependency chain |
Data-source optional group upgrades (scanner-driven)
| Package | Version change | Notes |
|---|---|---|
| boto3 / botocore | 1.28.8 → 1.43.7 | AWS SDK security fixes |
| snowflake-connector-python | 3.12.3 → 4.5.0 | Connector security fixes |
| azure-core, grpcio, h11, httpcore, marshmallow | New minimum pins | Transitive vulnerability fixes in data-source stacks |
Compatibility code changes (not CVE fixes, but required for upgrades)
- Remove
api_key_load_user_from_requestfromuser_loader(belongs inrequest_loader) TESTING-modereset_request_g_cachehook to preventgleakage across test requests- Explicit
client_id/client_secretinoauth.register()(authlib 1.x API) - Replace
flask.globals._app_ctx_stackwithcurrent_app(Werkzeug 3 removal)
Out of scope for this PR (other split PRs)
| Area | PR |
|---|---|
| Frontend / npm CVEs | #7720 |
| urllib3 2.x + champion SSRF | #7721 |
| Flask 3 / SQLAlchemy 1.4 migration | #7722 |
| Debian OS / Docker build-time CVEs | #7718 |
Known remaining issues (not fixed on this branch)
| Package | CVE / advisory | Notes |
|---|---|---|
| jwcrypto 1.5.6 | CVE-2026-39373 | Fix requires 1.5.7 — not included in any split branch yet |
| bootstrap@3.4.1 (frontend) | CVE-2019-8331, CVE-2025-1647 | Frontend PR scope; CSS-only use |
| paramiko 3.4.1 | CVE-2026-44405 | Requires Paramiko 5.0.0 (breaking); blocked by unmaintained sshtunnel |
| pysaml2 7.3.1 | GMS-2016-67 | 7.5.x incompatible with pyOpenSSL 26.x constraint |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
Author
|
@zachliu @madmuffin1 should this be next? |
wtfiwtz
added a commit
to orchestrated-io/redash
that referenced
this pull request
Jul 8, 2026
Upgrade SQLAlchemy to 1.4.53 and Flask-SQLAlchemy to 3.0.5 while keeping
Flask at 2.3.3. This allows the ORM migration to land independently of the
Flask 3 upgrade.
Dependency upgrades:
- sqlalchemy: 1.3.24 → 1.4.53
- flask-sqlalchemy: 2.5.1 → 3.0.5 (requires Flask ≥ 2.2.5, SQLAlchemy ≥ 1.4.18)
- flask-migrate: 2.5.2 → 4.0.7 (requires Flask-SQLAlchemy 3.x)
- nzalchemy: ^11.0.2 → ^11.1.2 (SQLAlchemy 1.4 compatibility)
- pytest: 7.4.0 → 9.0.3
- coverage: 7.2.7 → 7.14.0
- pytest-cov: 4.1.0 → 6.0.0
- jwcrypto: 1.5.6 → 1.5.7
Code changes for SQLAlchemy 1.4 / Flask-SQLAlchemy 3.0 API compatibility:
- models/base.py: Replace BaseQuery with flask_sqlalchemy.query.Query; add
SearchBaseQuery._entities shim for sqlalchemy-searchable 1.2
- handlers/base.py: Update paginate() for FSA 3.0 signature change
- metrics/database.py: Replace .froms with .get_final_froms()
- models/__init__.py: Replace .options(load_only("id")) with .with_entities()
- utils/query_order.py: Replace removed internal APIs (_ColumnEntity,
_mapper_registry) with column_descriptions and _mapper_registries
- models/changes.py: Guard ChangeTrackingMixin against detached/deleted state
- tasks/queries/execution.py: Skip session.close() in TESTING mode
- authentication/__init__.py: Use flush() instead of commit() in TESTING mode
- utils/configuration.py: Compact JSON separators for test assertions
Test infrastructure:
- tests/__init__.py: Replace db.get_engine(app) with db.engine
- tests/destinations/__init__.py: Add package marker for pytest collection
- tests/tasks/test_worker.py: Add super().tearDown() calls
- tests/test_cli.py: Update compact-JSON expectations
- pytest.ini: Add pythonpath, logging config, addopts
Depends on getredash#7719 (Werkzeug 3 + authlib 1.7) merging first.
Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
@wtfiwtz A couple of things to sync up before more work here: Already merged to master:
You can drop the So after rebasing, #7719 should be just the Separately, heads-up on your own open stack (all draft, untouched since |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upgrade security-critical Python dependencies while staying on Flask 2.x. Werkzeug 3.x is compatible with Flask 2.3.x and provides important security fixes without requiring a Flask 3 migration.
Core dependency upgrades:
Added transitive dependency pins: pyasn1, mako, pynacl
Data source dependency upgrades:
Dev dependency upgrades:
Code changes for authlib 1.x and Werkzeug 3.x compatibility:
What type of PR is this?
Description
How is this tested?
Related Tickets & Documents
Mobile & Desktop Screenshots/Recordings (if there are UI changes)