[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
flower	2.0.1 → 2.2.0

---

Release Notes

mher/flower (flower)

v2.2.0

Compare Source

Security

• Added CSRF protection for cookie-authenticated sessions
• Added protection against cross-site state-changing requests
• Added an OAuth state check to all login handlers
• Restricted the post-login redirect to local paths
• Enabled TLS certificate validation for the RabbitMQ management API
• Escaped all table cells on the tasks and workers pages
• Escaped load average values in the workers grid
• Added HttpOnly and SameSite to session cookies
• Added the X-Content-Type-Options: nosniff header
• Limited CORS headers to the unauthenticated API
• Served API error messages as plain text

Features

• Added a logout link for OAuth sessions #​1074
• Added a timeout option to the task apply API
• Added a page size selector to the tasks page #​1518
• Linked task names to a list of all tasks with that name
• Linked the task counts on the workers page to the matching tasks
• Honored the column order of the tasks_columns option #​1262
• Added thousands separators to task counts #​1374
• Formatted durations and showed a dash for missing values
• Added search examples as placeholder text
• Made wide tables scroll sideways and shortened UUIDs on mobile
• Limited worker page task lists to 50 entries by default #​1087
• Removed the Retried column from the workers page
• Named browser tabs by page

Performance and reliability

• Made persistent state saves atomic #​1403
• Fixed startup failing on a corrupt persistent state database #​1398
• Added a warning when state saving dominates the save interval
• Reapplied --max-tasks to restored persistent state #​1380
• Honored the --purge-offline-workers grace period after worker-offline events #​1190
• Inspected a worker lazily on its first page visit #​1388
• Fetched worker task lists only when inspecting a single worker
• Validated the --broker-api URL at startup
• Required both --certfile and --keyfile when either is set
• Validated task API query parameters and publish payloads

Bug fixes

• Fixed worker task table column widths #​1521 by @​ShubhAtWork
• Fixed the default RabbitMQ management API URL to use the management port #​1232
• Fixed the theme dropdown not closing and stuck navbar tooltips
• Fixed a server error on the task page for tasks without a name
• Fixed search queries containing quotes or brackets
• Fixed Redis Sentinel authentication with a username #​1386
• Fixed GitHub OAuth login on GitHub Enterprise Server #​1308
• Fixed a raw HTTP 400 error after a failed OAuth login #​1404
• Fixed a 404 on the login route with a trailing slash #​1322
• Fixed error messages containing percent signs
• Fixed the prefetched tasks gauge drifting up for tasks that never start #​1364
• Fixed restoring persistent state that reads options during unpickling #​1328

Documentation

• Documented how to require basic auth for /metrics #​1342
• Documented how to disable /metrics #​1379
• Documented option precedence
• Documented the rules for --auth email patterns
• Fixed the --broker-api example #​1425
• Fixed the format_task example

Compatibility and packaging

• Built Docker images from source and rebuilt them weekly #​1423
• Upgraded all base packages in the Docker image
• Removed pip from the Docker image
• Fixed the documentation build
• Removed the stale Swagger spec

Full changelog: v2.1.0...v2.2.0

v2.1.0

Compare Source

Features

• Added read-only mode for the UI and API by @​MrEarle #​1468
• Updated the UI with a responsive design
• Added persistent dark mode with light and system theme options
• Added a browser favicon by @​rolfws #​1502
• Improved task search with boolean operators and field filters
• Preserved task-table preferences across visits by @​fretman92 #​1333
• Added TLS support for Redis Sentinel by @​cyberjunk #​1327
• Added AMQPS support for RabbitMQ connections by @​borland667
• Updated and auto-provisioned the Grafana dashboard

Performance and reliability

• Moved blocking broker and control operations off the I/O loop
• Made Redis queue inspection asynchronous and pipelined
• Prevented duplicate worker inspections
• Fixed broker connection leaks #​1490
• Purged stale offline-worker Prometheus metrics #​1128
• Persisted dashboard counters across restarts #​787
• Improved handling of missing custom configuration files

Bug fixes

• Fixed Redis SSL configurations #​1177
• Fixed percent-encoded IPv6 broker addresses #​1220
• Stopped exposing broker alternate URLs in worker statistics #​1512
• Fixed broker page rendering when queue inspection fails by @​alexei #​1501
• Fixed autoscaling response interpolation by @​funkyrailroad #​1427
• Improved GitHub OAuth errors when email access is unavailable by @​bysiber #​1486
• Prevented authentication failures while rendering error pages #​1268, #​1499
• Fixed task search for non-string values #​1401
• Fixed task state filters to require the state prefix by @​AleksaMCode #​1516
• Fixed worker names in timeout and rate-limit error responses by @​phanky1 #​1506
• Fixed startup banner output when using a dynamic port #​1449
• Fixed worker active-task totals when counts are null by @​M4RC0Sx #​1511
• Fixed undefined worker pool grow and shrink values by @​daydaychen #​1324

Documentation

• Documented custom authentication providers #​1344
• Fixed the GitLab authentication handler name by @​Saluev #​1325
• Fixed the persistent database CLI example by @​hatamiarash7 #​1326
• Fixed the Grafana example URL by @​NiclasvanEyk #​1345
• Fixed the nginx reverse-proxy example by @​titovanton
• Added the GitHub repository link to the documentation by @​PamelaM
• Fixed the documented database filename by @​WilliamDEdwards #​1494
• Fixed the documented max tasks default by @​masahiro331 #​1415
• Clarified task API options #​1269

Compatibility and packaging

• Added Python 3.13 and 3.14 support; Python 3.10+ is now required #​1439
• Added Python 3.12 support and package classification by @​foarsitter #​1334
• Removed obsolete Python versions from CI and tox by @​auvipy #​1442
• Added Celery 5.6 CI coverage
• Updated the tox compatibility matrix by @​auvipy #​1451, #​1452
• Raised the minimum Tornado version to 6.5.7 #​1439
• Upgraded OpenSSL in the Docker image by @​matheusnascgomes #​1483
• Added Dependabot management for GitHub Actions by @​cclauss #​1383
• Improved CI linting reliability by @​Nusnus #​1445
• Updated .gitignore to exclude local Python version files by @​Nusnus #​1444
• Ran unit tests before lint checks by @​auvipy #​1447
• Removed the obsolete Travis CI configuration by @​auvipy
• Enabled API access in the Docker Compose demo

Full changelog: v2.0.1...v2.1.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.39%. Comparing base (c5e2d9a) to head (c12cd13).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #105      +/-   ##
==========================================
+ Coverage   85.71%   88.39%   +2.67%     
==========================================
  Files           5        5              
  Lines         112      112              
==========================================
+ Hits           96       99       +3     
+ Misses         16       13       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.