Fix red CI tests caused by unbounded Flask/Werkzeug/bdkpython dependencies

[al-munazzim]

Bug Description

The GitHub Actions test jobs are currently red on PRs because dependency resolution now installs incompatible latest transitive/runtime packages.

Current failing checks seen on #62:

• Run tests (3.10): https://github.com/cryptoadvance/spectrum/actions/runs/27583305075/job/82082605598
• Integration Tests (3.10): https://github.com/cryptoadvance/spectrum/actions/runs/27583305078/job/82082606365

Both fail before executing tests with:

ImportError: cannot import name '_app_ctx_stack' from 'flask'

Root cause

requirements.txt currently pins:

Flask-SQLAlchemy==2.5.1
sqlalchemy>=1.4.42,<2.0
Flask>=2.1.1

Flask-SQLAlchemy==2.5.1 imports Flask internals such as _app_ctx_stack. Those are removed in newer Flask releases, so the unconstrained Flask>=2.1.1 lets CI install a Flask version that is too new for the pinned Flask-SQLAlchemy.

After forcing Flask<2.3, another compatibility issue appears with Flask 2.2.x and latest Werkzeug 3.x:

AttributeError: module 'werkzeug' has no attribute '__version__'

So the immediate compatibility pin needs both Flask and Werkzeug bounds.

I also checked what happens after those are pinned. The test extra currently allows latest bdkpython, which resolves to bdkpython==3.0.0. That changes the API used by tests/test_bdk.py and fails with:

ValueError: Network.REGTEST

The same test passes with bdkpython==0.32.1.

Proposed short-term fix

Make CI green again by pinning the currently expected dependency family:

Flask>=2.1.1,<2.3
Werkzeug<3
bdkpython==0.32.1

Suggested locations:

• requirements.txt:

-Flask>=2.1.1
+Flask>=2.1.1,<2.3
+Werkzeug<3
 Flask-SQLAlchemy==2.5.1
 sqlalchemy>=1.4.42,<2.0

• pyproject.toml test extra:

-  "bdkpython"
+  "bdkpython==0.32.1"

Alternatively, if we do not want runtime dependencies to carry old Flask/Werkzeug pins forever, create a constraints.txt and use it in CI:

Flask<2.3
Werkzeug<3
bdkpython==0.32.1

Then install with:

pip install -c constraints.txt -e '.[test]'

Longer-term fix

Modernize the stack instead of pinning old versions:

• upgrade to Flask-SQLAlchemy>=3.x
• keep SQLAlchemy>=2.x if compatible, or update model/query code accordingly
• update the bdkpython test/code for the 3.x API, or keep the test extra pinned until the migration is done

That is probably more invasive than needed for getting the current PR/test pipeline green again.

Verification performed

On the PR #62 checkout:

• Current CI logs fail at import time with Flask _app_ctx_stack removal.
• python -m compileall -q src/cryptoadvance/spectrum/elsock.py passes.
• With Flask<2.3 only, tests/test_util.py passes but Flask test-client tests fail on Werkzeug 3.x __version__ removal.
• With Flask<2.3 and Werkzeug<3, targeted tests pass:

pytest tests/test_util.py tests/test_se_healthz.py -q
2 passed, 18 warnings

• With bdkpython==0.32.1, the BDK test passes:

pytest tests/test_bdk.py -q
1 passed

Acceptance criteria

• CI Run tests (3.10) is green again.
• CI Integration Tests (3.10) gets past import/setup and either passes or exposes only real integration/environment failures.
• Dependency bounds are explicit enough that fresh CI runs are reproducible.

[al-munazzim]

Follow-up after checking Specter Desktop's current dependency set:

Specter Desktop master pins:

Flask==2.2.5
Werkzeug==3.0.3
cryptoadvance.spectrum==0.7.0

That changes the short-term recommendation slightly:

• Adding Flask>=2.1.1,<2.3 to Spectrum's runtime requirements is compatible with Specter Desktop's Flask==2.2.5 and prevents fresh Spectrum-only installs/CI from resolving to Flask 3.x, which breaks Flask-SQLAlchemy==2.5.1 via _app_ctx_stack removal.
• Adding Werkzeug<3 to Spectrum's runtime requirements would conflict with Specter Desktop's Werkzeug==3.0.3, so we should not put Werkzeug<3 in Spectrum's normal requirements.txt if Spectrum is intended to be consumed by Specter Desktop.
• The Werkzeug issue I observed is specifically Flask 2.2's app.test_client() expecting werkzeug.__version__; that affects Spectrum's tests, not necessarily Specter runtime. So if needed, keep Werkzeug<3 as a Spectrum CI/test-only constraint, not as a published runtime dependency.
• bdkpython==0.32.1 is also test-only (pyproject.toml [project.optional-dependencies].test), so it should not affect Specter Desktop unless Specter installs Spectrum's [test] extra.

Revised short-term proposal:

Runtime/package dependency:

-Flask>=2.1.1
+Flask>=2.1.1,<2.3
 Flask-SQLAlchemy==2.5.1
 sqlalchemy>=1.4.42,<2.0

CI/test-only constraint or workflow install pin:

Werkzeug<3
bdkpython==0.32.1

Longer-term, the clean fix is still to modernize Spectrum to Flask-SQLAlchemy>=3.x and current Flask/Werkzeug, then align with Specter Desktop deliberately.