ajitraj88 opened a new issue, #52123: URL: https://github.com/apache/airflow/issues/52123
### Apache Airflow version 3.0.2 ### If "Other Airflow 2 version" selected, which one? _No response_ ### What happened? We are currently using airflow version 2.10.5 which uses Werkzeug version 2.2.3. We have got the security findings(https://nvd.nist.gov/vuln/detail/CVE-2024-49767) for this Werkzeug version and the recommendation is to use Werkzeug version >= 3.0. But when we try to update werkzeug to version 3.0.1 in the constraints file, we are getting the below error: ``` ERROR: Cannot install apache-airflow==2.10.5 because these package versions have conflicting dependencies. The conflict is caused by: apache-airflow 2.10.5 depends on werkzeug<3 and >=2.0 The user requested (constraint) werkzeug==3.0.1 ``` Which implies that Airflow version 2.10.5 is not compatible with Werkzeug version >= 3.0. Can you provide us with the solution ### What you think should happen instead? _No response_ ### How to reproduce 1. In the constraints file(https://github.com/apache/airflow/blob/constraints-2.10.5/constraints-3.9.txt) of ariflow version 2.10.5 change the airflow version to 3.0.1. 2. The build will fail with the below error: ``` ERROR: Cannot install apache-airflow==2.10.5 because these package versions have conflicting dependencies. The conflict is caused by: apache-airflow 2.10.5 depends on werkzeug<3 and >=2.0 The user requested (constraint) werkzeug==3.0.1 ``` ### Operating System NAME="Oracle Linux Server" VERSION="8.10" ### Versions of Apache Airflow Providers _No response_ ### Deployment Other Docker-based deployment ### Deployment details _No response_ ### Anything else? _No response_ ### Are you willing to submit PR? - [ ] Yes I am willing to submit a PR! ### Code of Conduct - [x] I agree to follow this project's [Code of Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
