Bump Flask & Werkzeug in requires-install.txt

[gothicVI]

Fixes #2592

optionals

• I have added entry in the CHANGELOG.md

[alexcjohnson]

Thanks @gothicVI - Flask 2.3 is ok with most of the dash ecosystem but there are some packages (including some on our enterprise side that unfortunately are not visible open-source) that we still need to update before we'll be ready to allow Flask 2.3. Thank you for your patience!

[Moisan]

@alexcjohnson could you point out which open source packages are not currently compatible? Maybe we could open a PR for them.

For the non-open source ones, wouldn't it be possible to limit the flask version on your side? The current requirements are quite open (Flask>=1.0.4,<2.3.0), I suspect forcing Flask<2.3.0 on a project depending on Dash, even after this PR is merged, would work.

[gothicVI]

I'd opt for removing the upper version limit entirely:
https://iscinumpy.dev/post/bound-version-constraints/

[alexcjohnson]

I'd opt for removing the upper version limit entirely

That’s what we used to do, see #2538 for context on why we added an upper bound

could you point out which open source packages are not currently compatible?

I’m not sure. The open-source ones maintained by Plotly are good AFAIK, but I would look at 3rd-party packages that alter the back end.

For the non-open source ones, wouldn't it be possible to limit the flask version on your side?

Plausible, assuming we can identify ahead of time where the potential issues are.

[gothicVI]

That’s what we used to do, see #2538 for context on why we added an upper bound

Which from my point of view is the wrong approach. That should be dealt with by the user using venvs or requirement.txts but artificially breaking install dependencies for other packages on a package level is leading us into hell at some point (see the linked article).
If every package comes with lower and upper bounds we'll soo be unable to install anything because it'll break some dependencies...
Just my two cents though ;)

[alexcjohnson]

I linked to exactly that article in #2538 and explained why we feel our decision is consistent with it. It’s not every package. It’s just Flask, which has consistently broken something in Dash with every minor update. Thus an upper bound here is just a statement that we expect this to be true in the future as well. No other package has such a history, hence we don’t specify any other upper bounds.

I’m sorry that it is taking us a while to find and fix the other Flask 2.3 issues but we feel strongly that this is better than uncontrolled breakage.

[alexcjohnson]

superseded by #2674