[bug] Conan broken for <1.44 due to breaking change in Markupsafe (2.1) affecting Jinja2 (2.11)

[memsharded]

Main issue in Jinja tracker: pallets/jinja#1587

[czoido]

As a workaround, after installing conan<1.44 you can do:

pip install "markupsafe<2.1"

to override the broken version

[davidism]

You are using an unsupported version of Jinja, please update to the latest version if possible. Additionally, please read https://hynek.me/articles/semver-will-not-save-you/, then use a tool like pip-tools to pin your dependencies and control when you get updates. Be sure to run your tests with deprecation warnings treated as errors so that you get notified of these types of changes early.

[lasote]

@davidism Please, once you have demonstrated how you care about your users and the ecosystem, don't come here to tell us how to manage the dependencies (in a repository of a package manager). You are breaking because "it is unsupported", ok, enough. Thanks.

To the Conan users, we are going to backport (we still don't know how many versions) the patch to the releases <1.44 ASAP, because WE DO CARE.

[bldrvnlw]

@czoido Thanks! that got us running again!

As a workaround, after installing conan<1.44 you can do:

pip install "markupsafe<2.1"

to override the broken version

[rylim]

Looks like 1.43 has been fixed but 1.44 and 1.45 still have the issue if a user installs Jinja2 version 2.9+ (anything below version 3.0.0), is there a plan to add the markupsafe limit fix as well similar to #10616 to more recent versions?

Another thought, should Jinja2 be forced to be >=3.0 instead of >=2.9 since the 2.9+ versions are still broken?

conan/conans/requirements.txt

Line 13 in 5e3b304

Jinja2>=2.9, <4.0.0

Thanks for looking into this!

[memsharded]

We explicitly keep Jinja 2.9, because some users are jointly using Conan and Jinja2 and they have specific requirements on Jinja2, so we were trying not to break them because of using a too restrictive one. The thing is that Jinja2 2.11.3 do still work, just by pinning Markupsafe==2.0.1 instead of letting it go to 2.1, so maybe it better to leave it as-is

[rylim]

We explicitly keep Jinja 2.9, because some users are jointly using Conan and Jinja2 and they have specific requirements on Jinja2, so we were trying not to break them because of using a too restrictive one. The thing is that Jinja2 2.11.3 do still work, just by pinning Markupsafe==2.0.1 instead of letting it go to 2.1, so maybe it better to leave it as-is

Thanks for the clarification, that makes sense! So you will be adopting the Markupsafe<2.1 or Markupsafe==2.0.1 fix going forward?

[blackliner]

Lucky us who use poetry with its lockfile features to install conan (and all other stuff) 😅