abhinav-phi commented on issue #64921: URL: https://github.com/apache/airflow/issues/64921#issuecomment-5632042383
Hi @vincbeck — I went through the full history here (#65376, #65463, #67141, #69368) and believe this is already fixed but the issue was simply never closed. #66565 (merged 2026-05-08, shipped in `apache-airflow-providers-fab` 3.6.4 per its changelog) removed the `self.serializer = _LazySafeSerializer()` assignment from `SessionExemptMixin.__init__` and kept it only on `AirflowDatabaseSessionInterface`. `AirflowSecureCookieSessionInterface` now uses Flask's default serializer, which returns a `str`, so Werkzeug 3.x `dump_cookie` no longer receives bytes — I confirmed this is still the shape of `providers/fab/src/airflow/providers/fab/www/session.py` on current main. This also preserves what @gavrik found in this thread: `flask_session.sqlalchemy` requires bytes for its `LargeBinary` column, which is why the later attempts (#67141's msgpack-to-JSON switch and #69368's `dumps` change, which @Lee-W flagged as wrong) were at the wrong layer. Caveat: I verified by reading the code and the released changelog, not with a runtime repro. @ashwani4588 reported testing 3.6.4 successfully, but #69368 was opened in July — so if anyone can still reproduce on fab >= 3.6.4, that deserves a fresh issue with the exact provider version rather than continuing this one. Otherwise, could a maintainer close this so it stops attracting duplicate PRs? Happy to help verify on a concrete 3.6.4+ install if that would help. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
