Software tests start failing with Apache Superset 3.x/4.x and PyJWT 2.10

[amotl]

Problem

As per CI job report summary, we observed the software tests accompanying the CrateDB integration started failing. It doesn't necessarily need to be related to CrateDB, but we don't know yet.

Details

 >           assert response.status_code in [200, 404], response.json()
E           AssertionError: {'msg': 'Subject must be a string'}
E           assert 422 in [200, 404]
E            +  where 422 = <Response [422]>.status_code

ERROR test.py::test_api - AssertionError: {'msg': 'Subject must be a string'}
assert 422 in [200, 404]
 +  where 422 = <Response [422]>.status_code
ERROR test.py::test_ui - AssertionError: {'msg': 'Subject must be a string'}
assert 422 in [200, 404]
 +  where 422 = <Response [422]>.status_code

-- Test run #332

Version

In both cases, it is using Apache Superset 3.1.3.

• Succeeds: Run #331
• Fails: Run #332

Quick Evaluation

We had a package switchover in this context recently. However, this has been validated sucessfully on the CI run #329 two days earlier already, so we guess it is not the culprit.

• [2024] Migration to sqlalchemy-cratedb crate-python#620

References

-- Build Status

[amotl]

That's the 422 response code at this spot now, instead of 200 or 404, as previously expected: HTTP 422 Unprocessable Content.

[amotl]

Apparently, PyJWT 2.10 was responsible, released on Nov 17, i.e. three days ago. Downgrading to PyJWT 2.9 helped to make the test suite succeed again.

• Apache Superset: Downgrade to PyJWT 2.9 #742

I don't know if this is any kind of red flag for you, @villebro? Within our test cases, we are not using the jwt module directly, only orchestrate CLI invocations of the superset program and HTTP calls to the Superset API. In this spirit, there is a chance others may also run into this problem?

[amotl]

We've just verified the problem also happens with Apache Superset 4.1.0.

[amotl]

Here we go.

{'msg': 'Subject must be a string'}

• sub must be a string now? jpadilla/pyjwt#1017

We reported the problem to the Apache Superset issue tracker.

• Problem with PyJWT 2.10: {'msg': 'Subject must be a string'} apache/superset#30995

[amotl]

We have been able to resolve this by updating to Flask-JWT-Extended 4.7.1 and configuring it using JWT_VERIFY_SUB = False.

• Problem with PyJWT 2.10: {'msg': 'Subject must be a string'} apache/superset#30995 (comment)
• Apache Superset: Fix JWT problem by updating to flask-jwt-extended 4.7.1 #749