Pinning Flask<2 requires pinning ItsDangerous<2.1 and MarkupSafe<2.1

1 min read Original article ↗

Since the update of itsdangerous module to version 2.1.0, Flask 1.1.2 fails to run.
This is because Flask’s requirements.txt indicates to install itsdangerous >= 0.24, it automatically installs the newest version which leads to using deprecated feature.
I can do a workaround in my project’s requirements.txt to install itsdangerous <= 2.0.1 before installing Flask but is it possible to fix the requirements.txt in Flask to install itsdangerous not upper than 2.0.1?

To replicate the bug,

  1. install Flask 1.1.2
  2. flask run in terminal
  3. it will produce ImportError: cannot import name 'json' from 'itsdangerous'

Thank you in advance.

Environment:

  • Python version: 3.8
  • Flask version: 1.1.2