This looks good, and I've verified it works with both previous and new werkzeug versions. Given that this became necessary though, I'm a little uneasy depending on ANYTHING inside werkzeug submodules, because I don't see the things we care about documented so they clearly would feel free to change these whenever they see fit.

So I wonder if we could minimize the chance of future problems... first, gen_salt could be inlined easily:

def gen_salt(chars):
    return "".join(secrets.choice(string.ascii_letters + string.digits) for _ in range(chars))

Second, as nice as tbtools HTML output is, can we have a second fallback in case we don't find either of these (or perhaps in case we don't even find the tbtools module), that just uses traceback.format_exc() or something?