Fix red CI tests caused by unbounded Flask/Werkzeug/bdkpython dependencies #63

Bug Description

The GitHub Actions test jobs are currently red on PRs because dependency resolution now installs incompatible latest transitive/runtime packages.

Current failing checks seen on #62:

• Run tests (3.10): https://github.com/cryptoadvance/spectrum/actions/runs/27583305075/job/82082605598
• Integration Tests (3.10): https://github.com/cryptoadvance/spectrum/actions/runs/27583305078/job/82082606365

Both fail before executing tests with:

ImportError: cannot import name '_app_ctx_stack' from 'flask'

Root cause

requirements.txt currently pins:

Flask-SQLAlchemy==2.5.1
sqlalchemy>=1.4.42,<2.0
Flask>=2.1.1

Flask-SQLAlchemy==2.5.1 imports Flask internals such as _app_ctx_stack. Those are removed in newer Flask releases, so the unconstrained Flask>=2.1.1 lets CI install a Flask version that is too new for the pinned Flask-SQLAlchemy.

After forcing Flask<2.3, another compatibility issue appears with Flask 2.2.x and latest Werkzeug 3.x:

AttributeError: module 'werkzeug' has no attribute '__version__'

So the immediate compatibility pin needs both Flask and Werkzeug bounds.

I also checked what happens after those are pinned. The test extra currently allows latest bdkpython, which resolves to bdkpython==3.0.0. That changes the API used by tests/test_bdk.py and fails with:

ValueError: Network.REGTEST

The same test passes with bdkpython==0.32.1.

Proposed short-term fix

Make CI green again by pinning the currently expected dependency family:

Flask>=2.1.1,<2.3
Werkzeug<3
bdkpython==0.32.1

Suggested locations:

• requirements.txt:

-Flask>=2.1.1
+Flask>=2.1.1,<2.3
+Werkzeug<3
 Flask-SQLAlchemy==2.5.1
 sqlalchemy>=1.4.42,<2.0

• pyproject.toml test extra:

-  "bdkpython"
+  "bdkpython==0.32.1"

Alternatively, if we do not want runtime dependencies to carry old Flask/Werkzeug pins forever, create a constraints.txt and use it in CI:

Flask<2.3
Werkzeug<3
bdkpython==0.32.1

Then install with:

pip install -c constraints.txt -e '.[test]'

Longer-term fix

Modernize the stack instead of pinning old versions:

• upgrade to Flask-SQLAlchemy>=3.x
• keep SQLAlchemy>=2.x if compatible, or update model/query code accordingly
• update the bdkpython test/code for the 3.x API, or keep the test extra pinned until the migration is done

That is probably more invasive than needed for getting the current PR/test pipeline green again.

Verification performed

On the PR #62 checkout:

• Current CI logs fail at import time with Flask _app_ctx_stack removal.
• python -m compileall -q src/cryptoadvance/spectrum/elsock.py passes.
• With Flask<2.3 only, tests/test_util.py passes but Flask test-client tests fail on Werkzeug 3.x __version__ removal.
• With Flask<2.3 and Werkzeug<3, targeted tests pass:

pytest tests/test_util.py tests/test_se_healthz.py -q
2 passed, 18 warnings

• With bdkpython==0.32.1, the BDK test passes:

pytest tests/test_bdk.py -q
1 passed

Acceptance criteria

• CI Run tests (3.10) is green again.
• CI Integration Tests (3.10) gets past import/setup and either passes or exposes only real integration/environment failures.
• Dependency bounds are explicit enough that fresh CI runs are reproducible.