Replace flex module with openapi-spec-validator and regenerate lockfile/requirements

Lockfile diff: lockfiles/st2.lock [st2]
==                      Added dependencies                      ==
  jsonschema-spec                0.1.6
  lazy-object-proxy              1.12.0
  openapi-schema-validator       0.4.4
  openapi-spec-validator         0.5.7
  pathable                       0.4.4
  rfc3339-validator              0.1.4
==                     Removed dependencies                     ==
  flex                           6.14.1
  jsonpointer                    3.1.1
  rfc3987                        1.3.8
  strict-rfc3339                 0.7
  validate-email                 1.3

Author: nzlosh

BUILD

@@ -2,8 +2,8 @@ python_requirements(
     name="reqs",
     source="requirements-pants.txt",
     overrides={
-        # flex and stevedore uses pkg_resources w/o declaring the dep
-        ("flex", "stevedore"): dict(
+        # stevedore uses pkg_resources w/o declaring the dep
+        ("stevedore"): dict(
             dependencies=[
                 "//:reqs#setuptools",
             ]

CHANGELOG.rst

@@ -23,7 +23,8 @@ Changed
  * Removed Python 3.8 and 3.9 from testing and CI/CD.
  * Removed mongodb 7.0, rabbitmq 3.13 and redis 8.0
  * Replaced deprecated `pkg_resources` module with `importlib-metadata` and `importlib-resources`.
- 
+ * Replaced abandoned `flex` module by `openapi-spec-validator`
+
 Added
 ~~~~~
 

fixed-requirements.txt

@@ -12,20 +12,21 @@ chardet==5.2.0
 cffi==1.17.1
 cryptography==43.0.3
 eventlet==0.39.1
-flex==6.14.1
 # Note: installs gitpython==3.1.37 (security fixed) under py3.8 and gitpython==3.1.18 (latest available, vulnerable) under py3.6
 gitpython==3.1.45
 # Needed by gitpython, old versions used to bundle it
 gitdb==4.0.12
 # Note: greenlet is used by eventlet
 greenlet==3.1.1
 gunicorn==23.0.0
-# importlib backport to replace pkg_resrouce from setuptools.
-importlib-metadata==6.5
-importlib-resources==5.12
+# importlib backport replaces setuptool's pkg_resource.
+importlib_resources==6.5.2
+importlib_metadata==9.0.0
 jsonpath-rw==1.4.0
 # Using jsonschema>=4.18.0 requires refactoring/debugging use of $ref.
 jsonschema==4.17.3
+# openapi-spec-validator pinned to align with st2's jsonschema pinning constraint
+openapi-spec-validator==0.5.7
 kombu==5.5.4
 lockfile==0.12.2
 mongoengine==0.29.1
@@ -64,7 +65,6 @@ six==1.17.0
 argparse==1.4.0
 argcomplete==3.6.2
 prettytable==3.11.0
-importlib-metadata==8.5.0
 # 20250909 virtualenv 20.34.0 requires typing-extension>=4.13.2
 typing-extensions>=4.13.2; python_version < "3.11"
 # NOTE: sseclient has various issues which sometimes hang the connection for a long time, etc.

lockfiles/st2.lock

@@ -13,8 +13,8 @@ ciso8601
 cryptography
 editor
 eventlet
-# flex parses the openapi 2 spec in our router
-flex
+# openapi-spec-validator parses the openapi 2 spec in our router
+openapi-spec-validator
 # gitpython & gitdb are used for pack management
 gitdb
 gitpython

requirements-pants.txt

@@ -19,12 +19,12 @@ decorator==5.2.1
 dnspython
 editor==1.6.6
 eventlet==0.39.1
-flex==6.14.1
 gitdb==4.0.12
 gitpython==3.1.45
 greenlet==3.1.1
 gunicorn==23.0.0
-importlib-metadata==8.5.0
+importlib-metadata
+importlib_resources==6.5.2
 jinja2==3.1.6
 jsonpath-rw==1.4.0
 jsonschema==4.17.3
@@ -34,6 +34,7 @@ logshipper@ git+https://github.com/StackStorm/logshipper.git ; platform_system==
 mock==5.2.0
 mongoengine==0.29.1
 networkx==3.1
+openapi-spec-validator==0.5.7
 orjson==3.10.15
 orquesta@ git+https://github.com/StackStorm/orquesta.git@updates_st2v3.10
 oslo.config==9.6.0

requirements.txt

@@ -10,7 +10,7 @@ cffi==1.17.1
 chardet==5.2.0
 cryptography==43.0.3
 editor==1.6.6
-importlib-metadata==8.5.0
+importlib-metadata
 jsonpath-rw==1.4.0
 jsonschema==4.17.3
 orjson==3.10.15

st2client/requirements.txt

@@ -9,6 +9,7 @@ jinja2
 jsonschema
 kombu
 mongoengine
+importlib_resources
 networkx
 # used by networkx
 decorator
@@ -40,7 +41,7 @@ zake
 # default coordinator backend configured for tooz
 redis
 routes
-flex
+openapi-spec-validator
 webob
 jsonpath-rw
 pyOpenSSL

st2common/in-requirements.txt

@@ -15,17 +15,18 @@ cryptography==43.0.3
 decorator==5.2.1
 dnspython
 eventlet==0.39.1
-flex==6.14.1
 gitdb==4.0.12
 gitpython==3.1.45
 greenlet==3.1.1
+importlib_resources==6.5.2
 jinja2==3.1.6
 jsonpath-rw==1.4.0
 jsonschema==4.17.3
 kombu==5.5.4
 lockfile==0.12.2
 mongoengine==0.29.1
 networkx==3.1
+openapi-spec-validator==0.5.7
 orjson==3.10.15
 orquesta@ git+https://github.com/StackStorm/orquesta.git@updates_st2v3.10
 oslo.config==9.6.0

st2common/requirements.txt

@@ -22,7 +22,7 @@
 import copy
 import traceback
 
-from flex.core import validate
+from openapi_spec_validator import validate_spec
 import jsonschema
 from oslo_config import cfg
 import routes
@@ -238,7 +238,7 @@ def add_spec(self, spec, transforms):
         self.spec = spec
         self.spec_resolver = jsonschema.RefResolver("", self.spec)
 
-        validate(fast_deepcopy_dict(self.spec))
+        validate_spec(fast_deepcopy_dict(self.spec))
 
         for filter in transforms:
             for (path, methods) in six.iteritems(spec["paths"]):