diff --git a/ihatemoney/tests/budget_test.py b/ihatemoney/tests/budget_test.py
index b4ec2c248..11ae38523 100644
--- a/ihatemoney/tests/budget_test.py
+++ b/ihatemoney/tests/budget_test.py
@@ -1,5 +1,6 @@
 from collections import defaultdict
 import datetime
+import markupsafe
 import re
 from urllib.parse import urlparse, urlunparse
 
@@ -587,7 +588,7 @@ def test_admin_authentication(self):
 
         # test the redirection to the authentication page when trying to access admin endpoints
         resp = self.client.get("/create")
-        assert '<a href="/admin?goto=%2Fcreate">' in resp.data.decode("utf-8")
+        assert f'<a href="{markupsafe.escape("/admin?goto=/create")}">' in resp.data.decode("utf-8")
 
         # test right password
         resp = self.client.post(
diff --git a/pyproject.toml b/pyproject.toml
index 42369a33f..1785f3fce 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -39,8 +39,8 @@ dependencies = [
     "Flask-Talisman>=0.8,<2",
     "Flask-WTF>=0.14.3,<2",
     "WTForms>=2.3.1,<3.1",
-    "Flask>=2,<2.3",
-    "Werkzeug>=2,<2.3",
+    "Flask>=2,<3",
+    "Werkzeug>=2,<3",
     "itsdangerous>=2,<3",
     "Jinja2>=3,<4",
     "qrcode>=7.1,<8",