Airflow Constraints vs FAB providers pyproject

[mclenz]

We are trying to transition from Airflow 2.11.0 to Airflow 3.0.6. Our team is using Chainguard vendor images for security purposes. While testing the Airflow 3.0.6 image, we noticed the Werkzeug version is 3.1.3. This is causing import errors when we try to use FAB with LDAP authentication.

I noticed the constraints file for airflow as a whole lists 2.2.3 as the compatible version, but the fab provider seems to list werkzeug>=2.2,<4 as the supported versions. Is this an unexpected mismatch?

We downgraded to match all versions listed in the constraints file, and authentication is working properly. We brought this up with the Chainguard support team, and they indicated they are following the recommendations of the fab provider, which shows it supports anything less than version 4.

Thank you for any suggestions/feedback.

[utieyin]

I ran into this same werkzeug error from airflow when testing ldap user creation. Looking at the code and error this line

airflow/providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py

Line 806 in 20783d8

from werkzeug import __version__ as werkzeug_version

seems to be the culprit. Since the requirement says werkzeug greater than 2 but less than 4 is allowed, is there a reason this logic can't be changed?
I am happy to provide a patch for this.