Upgrade FAB to 4+

[potiuk]

Body

FAB 4.0.0 keeps a lot of our imporant dependencies from upgrading - including some with CVEs. We should make the effort to upgrade FAB to 4.0.0 soon to make sure we have it in 2.4.0 (or if possible even in 2.3.* line.

It has a number of UI dependencies though - including breaking changes in some libraries like PyJWT especially around authentication, so rather serious testing is needed I think.

Committer

• I acknowledge that I am a maintainer/committer of the Apache Airflow project.

[potiuk]

cc: @jedcunningham @kaxil @ephraimbuddy @bbovenzi @jhtimmins

I think we get more and more pressure to get FAB 4.0.* in.

[potiuk]

I looked through https://flask-appbuilder.readthedocs.io/en/latest/breaking.html#version-4-0-0 and the number of breaking changes is well, quite serious.

@dpgaspar - the changelog mostly links to changes from all the libraries that got bumped. Any comments maybe on the actual problems we might expect (I see that 4.1.1rc1 had just been released, so can we assume 4.1.1 is past the teething problems ?

[eladkal]

Dup #22397 ?

[dpgaspar]

I looked through https://flask-appbuilder.readthedocs.io/en/latest/breaking.html#version-4-0-0 and the number of breaking changes is well, quite serious.

@dpgaspar - the changelog mostly links to changes from all the libraries that got bumped. Any comments maybe on the actual problems we might expect (I see that 4.1.1rc1 had just been released, so can we assume 4.1.1 is past the teething problems ?

@potiuk Should be stable yes, 4.0.0 is on Apache Superset since 16 March. Here's the PR with the bump: apache/superset#19168. On other projects I found that flask-jwt-extended and pyJWT are the areas that need more attention.

In fact 4.1.1 fixes a bug introduced on 4.1.0 :)

[potiuk]

Thanks Daniel. It will be definitely helpful to look at the superset change !

[potiuk]

Dup #22397 ?

yes.