Upgrade werkzeug dependency version to >=1.0.1

[Bl3f]

Describe the bug

When using poetry to install dbt with apache-airflow==2.0.0 poetry is not able to solve the dependencies tree. The reason is because airflow depends on werkzeug>=1.0.1 and dbt-core pins an old version of werkzeug<0.17.

Traceback

dbt-bug ❯ poetry add dbt
Using version ^0.18.1 for dbt

Updating dependencies
Resolving dependencies... (1.6s)

  SolverProblemError

  Because no versions of dbt match >0.18.1,<0.19.0
   and dbt (0.18.1) depends on dbt-core (0.18.1), dbt (>=0.18.1,<0.19.0) requires dbt-core (0.18.1).
  And because dbt-core (0.18.1) depends on werkzeug (>=0.15,<0.17), dbt (>=0.18.1,<0.19.0) requires werkzeug (>=0.15,<0.17).
  And because apache-airflow (2.0.0) depends on werkzeug (>=1.0.1,<2.0)
   and no versions of apache-airflow match >2.0.0,<3.0.0, dbt (>=0.18.1,<0.19.0) is incompatible with apache-airflow (>=2.0.0,<3.0.0).
  So, because dbt-bug depends on both apache-airflow (^2.0.0) and dbt (^0.18.1), version solving failed.

  at ~/.virtualenvs/dbt-bug/lib/python3.8/site-packages/poetry/puzzle/solver.py:241 in _solve
      237│             packages = result.packages
      238│         except OverrideNeeded as e:
      239│             return self.solve_in_compatibility_mode(e.overrides, use_latest=use_latest)
      240│         except SolveFailure as e:
    → 241│             raise SolverProblemError(e)
      242│
      243│         results = dict(
      244│             depth_first_search(
      245│                 PackageNode(self._package, packages), aggregate_package_nodes

Steps To Reproduce

Tested with Python3.8.

poetry init
poetry add apache-airflow
poetry add dbt

Additional context

It seems in the past the issue already happened: #1697.

[jtcohen6]

Good call @Bl3f, thanks for opening!

From #1814:

I've verified that werkzeug==0.15.6 and the current git master both work ok, so we should feel good about raising the werkzeug version to >=0.15.6,<2 whenever they release 1.0... unless they make more breaking changes before release.

It looks like dbt has been working with v0.16.1, which is one the last release prior to v1.0. There's a pretty extensive list of changes, but it looks like most of them are removing support for things previously deprecated.

I'm in favor of bumping the upper bound of the dbt-core dependency to werkzeug>=0.15,<2. Given that werkzeug pretty integral to the functioning of the RPC server, I don't think we should try to sneak this in for v0.19.0. As long as there are no breaking changes, we could consider it for a patch release.

[Bl3f]

Oh perfect. I just tried locally to bump the version ('werkzeug>=1.0.1,<2.0',) and the test suite passed well:

=========== 864 passed, 1 skipped, 26 warnings in 174.68s (0:02:54) ==========

I wrote a PR #3011 to bump the upper bound!