search

VernonCo / ps_utils

Promostandards utilities -- Public repository for accessing PS services
1 stars 0 forks source link

Update dependency flask-appbuilder to v4 [SECURITY] (master) #126

Open renovate[bot] opened 6 months ago

renovate[bot] commented 6 months ago

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
flask-appbuilder ==2.3.0 -> ==4.5.1 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2021-29621

Impact

User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.

Patches

Upgrade to 3.3.0

For more information

If you have any questions or comments about this advisory:

CVE-2021-32805

Impact

If using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with Flask-AppBuilder, this URL can redirect a user to a malicious site. This is an open redirect vulnerability

Patches

Install Flask-AppBuilder 3.2.2 or above

Workarounds

Filter HTTP traffic containing ?next={next-site} where the next-site domain is different from the application you are protecting

CVE-2021-41265

Impact

Improper authentication on the REST API. Allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. Only affects non database authentication types, and new REST API endpoints.

Patches

Upgrade to Flask-AppBuilder 3.3.4

For more information

If you have any questions or comments about this advisory:

CVE-2022-21659

Impact

User enumeration in database authentication in Flask-AppBuilder < 3.4.4. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in.

Patches

Upgrade to 3.4.4

Workarounds

References

For more information

If you have any questions or comments about this advisory:

CVE-2022-24776

Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 3.4.5 contain an open redirect vulnerability when using the database authentication login page. There are no known workarounds. Users are recommended to upgrade to version 3.4.5 or later.

For more information

If you have any questions or comments about this advisory:

CVE-2022-31177

Impact

An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users.

Only when using AUTH_DB database authentication option.

Patches

Fixed on 4.1.3

For more information

If you have any questions or comments about this advisory:

CVE-2023-29005

Impact

Lack of rate limiting will allow an attacker to brute-force user credentials.

Patches

Ability to enable rate limiting on Flask-AppBuilder >= 4.3.0. Use AUTH_RATE_LIMITED = True and RATELIMIT_ENABLED = True set the limit itself by using AUTH_RATE_LIMIT. Will apply only to database authentication.

Workarounds

Implement rate limiting using a reverse proxy or other strategies.

CVE-2023-34110

Impact

An authenticated malicious actor with Admin privileges, could by adding a special character on the add, edit User forms trigger a database error, this error is surfaced back to this actor on the UI. On certain database engines this error can include the entire user row including the pbkdf2:sha256 hashed password.

Patches

Fixed on 4.3.2

CVE-2024-25128

Impact

When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, allows an attacker to forge an HTTP request, that could deceive the backend into using any requested OpenID service. This vulnerability could grant an attacker unauthorised privilege access if a custom OpenID service is deployed by the attacker and accessible by the backend.

This vulnerability is only exploitable when the application is using the old (deprecated 10 years ago) OpenID 2.0 authorization protocol (which is very different from the popular OIDC - Open ID Connect - popular protocol used today). Currently, this protocol is regarded as legacy, with significantly reduced usage and not supported for several years by major authorization providers.

Patches

Upgrade to Flask-AppBuilder 4.3.11

Workarounds

If upgrade is not possible add the following to your config:

from flask import flash, redirect
from flask_appbuilder import expose
from flask_appbuilder.security.sqla.manager import SecurityManager
from flask_appbuilder.security.views import AuthOIDView
from flask_appbuilder.security.forms import LoginForm_oid

basedir = os.path.abspath(os.path.dirname(__file__))

class FixedOIDView(AuthOIDView):
    @&#8203;expose("/login/", methods=["GET", "POST"])
    def login(self, flag=True):
        form = LoginForm_oid()
        if form.validate_on_submit():
            identity_url = None
            for provider in self.appbuilder.sm.openid_providers:
                if provider.get("url") == form.openid.data:
                    identity_url = form.openid.data
            if identity_url is None:
                flash(self.invalid_login_message, "warning")
                return redirect(self.appbuilder.get_url_for_login)
        return super().login(flag=flag)

class FixedSecurityManager(SecurityManager):
    authoidview = FixedOIDView

FAB_SECURITY_MANAGER_CLASS = "config.FixedSecurityManager"

CVE-2024-45314

Impact

Auth DB login form default cache directives allows browser to locally store sensitive data. This can be an issue on environments using shared computer resources.

Patches

Upgrade flask-appbuilder to version 4.5.1

Workarounds

If upgrading is not possible configure your web server to send the following HTTP headers for /login: "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0" "Pragma": "no-cache" "Expires": "0"

Release Notes

dpgaspar/flask-appbuilder (flask-appbuilder) ### [`v4.5.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-451) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.5.0...v4.5.1) - feat: add no cache directive to login forms ([#​2266](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2266)) \[Daniel Vaz Gaspar] - chore: bump cryptography to 42.0.4 ([#​2238](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2238)) \[Daniel Vaz Gaspar] - docs: Fixing broken link ([#​2252](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2252)) \[Chase Jones] - fix: rate limiter key function ([#​2254](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2254)) \[Daniel Vaz Gaspar] - chore: bump dnspython to fix vulnerability ([#​2255](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2255)) \[Daniel Vaz Gaspar] ### [`v4.5.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-450) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.4.1...v4.5.0) - feat: REST API new select columns query param ([#​2242](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2242)) \[Daniel Vaz Gaspar] - chore: bump werkzeug to 3.0.3 ([#​2237](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2237)) \[Daniel Vaz Gaspar] - fix: Keycloak OAuth2, get groups as role_keys per default ([#​2235](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2235)) \[Andreas 'count' Kotes] - fix: Check if Oauth login with OKTA is correct ([#​1926](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1926)) \[Hojjat Ali Mohammadi] - docs: Update quickcharts.rst for typo gold to goal ([#​2217](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2217)) \[Abhinav Pareek] ### [`v4.4.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-441) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.4.0...v4.4.1) - fix: user search list on stats ([#​2211](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2211)) \[Daniel Vaz Gaspar] - fix: performance issues on user and roles list ([#​2209](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2209)) \[Daniel Vaz Gaspar] ### [`v4.4.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-440) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.11...v4.4.0) - chore(deps): bump the github-actions group with 4 updates ([#​2201](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2201)) \[dependabot\[bot]] - fix: python versions setup.py ([#​2204](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2204)) \[Daniel Vaz Gaspar] - ci: refactor requirements structure and improve dependabot config ([#​2198](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2198)) \[Daniel Vaz Gaspar] - chore(deps): bump jinja2 from 3.0.3 to 3.1.3 ([#​2180](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2180)) \[dependabot\[bot]] - fix: authentik test ([#​2199](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2199)) \[Daniel Vaz Gaspar] - feat: Added authentik as new identity provider ([#​2168](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2168)) \[Jasper Schoenmaker] - chore(deps): bump requests from 2.26.0 to 2.31.0 ([#​2050](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2050)) \[dependabot\[bot]] - docs: updated Flask-Babel link and fix typo ([#​2166](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2166)) \[Gughanathan M] - chore: bump several non base dependencies ([#​2197](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2197)) \[Daniel Vaz Gaspar] - fix: Increase upper bound on marshmallow-sqlalchemy ([#​2191](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2191)) \[spike77453] - chore: remove email_validator constraint ([#​2167](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2167)) \[Marcus Lim] - chore: Upgrade to Pillow 10.0.1 ([#​2136](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2136)) \[Dosenpfand] - chore(docs): Update i18n.rst for Turkish ([#​2187](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2187)) \[coteli] - chore: upgrade werkzeug and Flask, deprecate OpenID and MongoEngine ([#​2196](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2196)) \[Daniel Vaz Gaspar] - feat: Turkish translations ([#​2185](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2185)) \[coteli] - feat: AUTH_REMOTE_USER_ENV_VAR config key for auth REMOTE_USER type ([#​2193](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2193)) \[Daniel Vaz Gaspar] - fix: don't load inactive users with sessions ([#​2192](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2192)) \[Daniel Vaz Gaspar] ### [`v4.3.11`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-4311) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.10...v4.3.11) - fix: openID provider validation flow ([#​2186](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2186)) \[Daniel Vaz Gaspar] - feat: support Auth0 OAuth2 ([#​2171](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2171)) \[Daniel Vaz Gaspar] ### [`v4.3.10`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-4310) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.9...v4.3.10) - fix: azure keep using upn if exists ([#​2163](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2163)) \[Daniel Vaz Gaspar] - docs: Update shield of supported Python versions ([#​2156](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2156)) \[Dosenpfand] - docs: update security policy ([#​2155](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2155)) \[Daniel Vaz Gaspar] - docs: improve LDAP auth auth_roles_mapping ([#​2149](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2149)) \[Daniel Vaz Gaspar] - docs: Update security docs to reflect LDAP casing issues ([#​2098](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2098)) \[Anders Bogsnes] - fix: old API api column edit ([#​2134](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2134)) \[Daniel Vaz Gaspar] - chore: add bootstrap min map ([#​2148](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2148)) \[Daniel Vaz Gaspar] - chore: Add support for Python 3.10, 3.11, 3.12 and drop 3.7 ([#​2147](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2147)) \[Dosenpfand] - chore: use npm for all frontend dependencies ([#​2144](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2144)) \[Daniel Vaz Gaspar] ### [`v4.3.9`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-439) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.8...v4.3.9) - ci: create release script ([#​2142](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2142)) \[Daniel Vaz Gaspar] - fix: wtforms compat on 3.1.0 ([#​2138](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2138)) \[Daniel Vaz Gaspar] - docs: fix RTD config requirements ([#​2140](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2140)) \[Daniel Vaz Gaspar] - docs: fix RTD config ([#​2139](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2139)) \[Daniel Vaz Gaspar] - docs: add RTD required config ([#​2135](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2135)) \[Daniel Vaz Gaspar] ### [`v4.3.8`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-438) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.7...v4.3.8) - fix: filter list UI spacing between elements ([#​2128](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2128)) \[Daniel Vaz Gaspar] - fix: add github sponsor ([#​2130](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2130)) \[Daniel Vaz Gaspar] - docs: add github sponsor ([#​2129](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2129)) \[Daniel Vaz Gaspar] - fix: swagger include js and css on static ([#​2127](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2127)) \[Daniel Vaz Gaspar] - fix: Remove erroring endpoint "/login//" from AuthOAuthView ([#​2120](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2120)) \[David Kalamarides] - fix: azure user info claims and JWT decode ([#​2121](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2121)) \[Daniel Vaz Gaspar] - fix: Validate Azure JWTs using `authlib` ([#​2112](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2112)) \[Daniel Wolf] - docs(typo): "preform" -> "perform" x4 ([#​2123](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2123)) \[Sam Firke] ### [`v4.3.7`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-437) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.6...v4.3.7) - fix: swagger missing nonce ([#​2116](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2116)) \[Daniel Vaz Gaspar] ### [`v4.3.6`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-436) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.5...v4.3.6) - fix: increase email field length ([#​2102](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2102)) \[Daniel Vaz Gaspar] ### [`v4.3.5`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-435) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.4...v4.3.5) - fix: release tests exclusion ([#​2093](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2093)) \[Daniel Vaz Gaspar] - fix: make deletion in quicktemplates example work again ([#​2088](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2088)) \[Fabian Halkivaha] - fix: MVC form action, broken reset my password ([#​2091](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2091)) \[Daniel Vaz Gaspar] - chore: dont add 'tests' package to wheel ([#​2087](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2087)) \[cwegener] - chore(deps): bump pygments from 2.13.0 to 2.15.0 ([#​2089](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2089)) \[dependabot\[bot]] ### [`v4.3.4`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-434) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.3...v4.3.4) - fix: select filters spacing, theme and operation select ([#​2079](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2079)) \[Daniel Vaz Gaspar] - refactor: Refactored logging functions to consistently use lazy interpolation ([#​2071](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2071)) \[Bruce] - feat: add optional flask-talisman and use csp nonce on scripts ([#​2075](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2075)) \[Daniel Vaz Gaspar] - chore: improve tests and test data load ([#​2072](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2072)) \[Daniel Vaz Gaspar] ### [`v4.3.3`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-433) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.2...v4.3.3) - fix: marshmallow enum by value keep compatibility ([#​2067](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2067)) \[Daniel Vaz Gaspar] - fix: marshmallow new min version to 3.18 ([#​2066](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2066)) \[Daniel Vaz Gaspar] - fix: select2-ajax-widget ([#​2052](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2052)) \[Nadir Can Kavkas] - chore: remove marshmallow-enum dependency ([#​2064](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2064)) \[Daniel Vaz Gaspar] - fix: Double escaping for next param in login with oauth ([#​2053](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2053)) \[Aleksandr Musorin] - chore: remove RemovedInMarshmallow4 warnings ([#​2024](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2024)) \[Sebastian Liebscher] - docs: Update docs/security.rst with Windows LDAP working Example ([#​2026](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2026)) \[verschlimmbesserer] - fix(translations): better translation of the pt_BR language ([#​2061](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2061)) \[Lucas Gonzalez de Queiroz] - fix: broken link to config.py template ([#​2056](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2056)) \[Alex Gordienko] - fix: user registration menu name ([#​2051](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2051)) \[Daniel Vaz Gaspar] ### [`v4.3.2`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-432) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.1...v4.3.2) - fix: CRUD MVC log message ([#​2045](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2045)) \[Daniel Vaz Gaspar] - fix: deprecated method for getting value on select2 ([#​2039](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2039)) \[Viacheslav] - chore: bump Flask and werkzeug ([#​2034](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2034)) \[Daniel Vaz Gaspar] - ci: improve codeql configuration ([#​2032](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2032)) \[Daniel Vaz Gaspar] - ci: add codeQL analysis ([#​2031](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2031)) \[Daniel Vaz Gaspar] - fix: cli create app ask for initial secret key ([#​2029](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2029)) \[Daniel Vaz Gaspar] - fix: using base_filters with FilterEqualFunction not working for relation fields ([#​2011](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2011)) \[ThomasP0815] - ci: bump ubuntu version, remove mockldap ([#​2013](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2013)) \[Daniel Vaz Gaspar] ### [`v4.3.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-4311) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.3.0...v4.3.1) - fix: openID provider validation flow ([#​2186](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2186)) \[Daniel Vaz Gaspar] - feat: support Auth0 OAuth2 ([#​2171](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/2171)) \[Daniel Vaz Gaspar] ### [`v4.3.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-430) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.2.1...v4.3.0) - fix: disable rate limit by default ([#​1999](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1999)) \[Daniel Vaz Gaspar] - fix: auth rate limit docs and default rate ([#​1997](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1997)) \[Daniel Vaz Gaspar] - feat: Add rate limiter ([#​1976](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1976)) \[bolkedebruin] - docs: Updated LDAP Documentation ([#​1988](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1988)) \[Alissa Gerhard] - fix: Save next URL on failed login attempt ([#​1936](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1936)) \[Dosenpfand] - fix: select2 theme use bootstrap ([#​1995](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1995)) \[Daniel Vaz Gaspar] - fix: CI broken by pyodbc vs unixodbc ([#​1996](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1996)) \[Daniel Vaz Gaspar] ### [`v4.2.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-421) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.2.0...v4.2.1) - ci: fix pyodbc install failure ([#​1992](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1992)) \[Daniel Vaz Gaspar] - fix: Remove unused parameter from QuerySelectMultipleField instantiation ([#​1991](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1991)) \[Dosenpfand] - fix: Make sure user input is not treated as safe in the oauth view ([#​1978](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1978)) \[Glenn Schuurman] - fix: don't use root logger on safe decorator ([#​1990](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1990)) \[Igor Khrol] - chore: upgrade Font Awesome to version 6 ([#​1979](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1979)) \[Daniel Vaz Gaspar] ### [`v4.2.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-420) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.1.6...v4.2.0) - feat: add opt-in outer default load option to model REST API ([#​1971](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1971)) \[Daniel Vaz Gaspar] - chore: Add more type annotation to REST API module ([#​1969](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1969)) \[Daniel Vaz Gaspar] - fix: upgrade Select2 to 4.0.13 ([#​1968](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1968)) \[Nicola Gramola] - fix: REST API one-to-one relationship ([#​1965](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1965)) \[Daniel Vaz Gaspar] - fix(api): \_info HTTP 500 when exists a defined invalid search field ([#​1963](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1963)) \[Daniel Vaz Gaspar] - chore: Use implicit default loading rather than explicit joined eager loading ([#​1961](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1961)) \[John Bodley] - chore: Increase upper-bound on apispec ([#​1903](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1903)) \[Tomáš Drtina] - fix: replace deprecated attachment_filename ([#​1956](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1956)) \[Steve Embling] ### [`v4.1.6`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-416) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.1.5...v4.1.6) - feat: add utility method on SM for fetching all roles and perms for a user ([#​1950](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1950)) \[Daniel Vaz Gaspar] ### [`v4.1.5`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-415) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.1.4...v4.1.5) - fix: HTML label IDs for db and ldap login ([#​1935](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1935)) \[Dosenpfand] - fix: OAuth state parameter ([#​1932](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1932)) \[Daniel Vaz Gaspar] - docs: Fix a few typos ([#​1929](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1929)) \[Tim Gates] - chore: Update compiled german translation, delete backup file ([#​1928](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1928)) \[Dosenpfand] - fix: addon managers import ([#​1920](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1920)) \[Daniel Vaz Gaspar] ### [`v4.1.4`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-414) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.1.3...v4.1.4) - chore: Redirect to prev url on login for AuthRemoteUserView ([#​1901](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1901)) \[Alexander Ryndin] - chore: Bump upper bounds on wtforms and flask-wtf ([#​1904](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1904)) \[Tomáš Drtina] - fix(mvc): related model view setting default related field value ([#​1898](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1898)) \[Daniel Vaz Gaspar] - fix: DateTimePicker rendering in forms ([#​1698](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1698)) \[Federico Padua] - test(fab_cli): tag tests that need internet so they can be skipped ([#​1880](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1880)) \[jnahmias] - fix: fix a wrong 'next' URL in javascript ([#​1897](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1897)) \[Sansarun Sukawongviwat] - chore: allow authlib > 1 updated docs ([#​1891](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1891)) \[Daniel Vaz Gaspar] - docs: fix oauth example config ([#​1890](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1890)) \[Daniel Vaz Gaspar] - docs: fix oauth example config ([#​1889](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1889)) \[Daniel Vaz Gaspar] ### [`v4.1.3`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-413) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.1.2...v4.1.3) - fix: user stats view search ([#​1887](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1887)) \[Daniel Vaz Gaspar] - fix: Do not render hidden form fields twice ([#​1848](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1848)) \[Dosenpfand] - chore: Bump requirements pillow version, remove PIL from doc ([#​1873](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1873)) \[Dosenpfand] - fix: custom menu option ([#​1884](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1884)) \[Daniel Vaz Gaspar] - fix: FAB_INDEX_VIEW type check ([#​1883](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1883)) \[Daniel Vaz Gaspar] - fix(api): register responses with apispec using components.response() ([#​1881](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1881)) \[jnahmias] - docs: add responsible disclosure text to security ([#​1882](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1882)) \[Daniel Vaz Gaspar] - chore: Improve german translation ([#​1872](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1872)) \[Dosenpfand] - fix: populating permission and vm instead of just setting the id ([#​1874](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1874)) \[Zef Lin] ### [`v4.1.2`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-412) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.1.1...v4.1.2) - fix: remove sqlite dbs from examples ([#​1853](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1853)) \[Daniel Vaz Gaspar] - fix(MVC): discard excluded filters from query ([#​1862](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1862)) \[Daniel Vaz Gaspar] ### [`v4.1.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-411) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.1.0...v4.1.1) - fix: custom security class import, bad cast ([#​1851](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1851)) \[Daniel Vaz Gaspar] - fix: Set certificates before reconnecting to LDAP ([#​1846](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1846)) \[Sebastian Bernauer] ### [`v4.1.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-410) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v4.0.0...v4.1.0) - docs: add FAB_ADD_SECURITY_API config option ([#​1840](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1840)) \[Daniel Vaz Gaspar] - feat: add keycloak auth provider options ([#​1832](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1832)) \[nilivingston] - docs: add Azure OAUTH example ([#​1837](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1837)) \[Mathew Wicks] - fix: security api ([#​1831](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1831)) \[Daniel Vaz Gaspar] - fix: dependency constraints, bump flask-login, flask-wtf ([#​1838](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1838)) \[Daniel Vaz Gaspar] - fix: noop user update on Auth db, use set user model ([#​1834](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1834)) \[Daniel Vaz Gaspar] - chore: bump postgres to 14 ([#​1833](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1833)) \[Daniel Vaz Gaspar] - chore: Update and fix german translation ([#​1827](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1827)) \[Dosenpfand] - chore: Enhance is_safe_redirect_url ([#​1826](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1826)) \[Geido] - feat: Add CRUD apis for role, permission, user ([#​1801](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1801)) \[Mayur] - docs: updated brackets in OAuth Authentication ([#​1798](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1798)) \[David Berg] - chore: add Slovenian language ([#​1828](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1828)) \[dkrat7] - fix: doc requirements ([#​1820](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1820)) \[Daniel Vaz Gaspar] ### [`v4.0.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-400) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.4.5...v4.0.0) - chore: major bumps Flask, Click, PyJWT and flask-jwt-extended ([#​1817](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1817)) \[Daniel Vaz Gaspar] \[Breaking changes] ### [`v3.4.5`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-345) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.4.4...v3.4.5) - test: Add test for `export-roles --indent`'s argument “duck casting” to int ([#​1811](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1811)) \[Étienne Boisseau-Sierra] - fix: next url on login (OAuth, OID, DB) ([#​1804](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1804)) \[Daniel Vaz Gaspar] - docs: Update doc i18 to flask_babel ([#​1792](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1792)) \[Federico Padua] - feat(cli): allow `export-roles` to be beautified ([#​1724](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1724)) \[Étienne Boisseau-Sierra] ### [`v3.4.4`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-344) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.4.3...v3.4.4) - fix: Support SQLAlchemy 1.4.X ([#​1786](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1786)) \[Daniel Vaz Gaspar] - feat: allow multiple values for the same filter ([#​1737](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1737)) \[Will Rogers] - fix: Only update user.last_login on successful authentication ([#​1775](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1775)) \[blag] - chore: update jsonschema pip package ([#​1782](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1782)) \[Hugh A. Miles II] ### [`v3.4.3`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-343) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.4.2...v3.4.3) - fix: openapi on and off config flag ([#​1770](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1770)) \[Daniel Vaz Gaspar] - fix: data not defined in azure oauth ([#​1769](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1769)) \[Dalton Pearson] - fix: Handle authorize_access_token exception ([#​1766](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1766)) \[Michał Konarski] - fix: Set role and confirm password while adding user mandatory ([#​1758](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1758)) \[Mayur] - fix: required roles on user form not showing error msg ([#​1772](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1772)) \[Daniel Vaz Gaspar] - fix: make servers be actual servers on swagger, full endpoint paths ([#​1773](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1773)) \[Daniel Vaz Gaspar] - docs: adds missing config key FAB_OPENAPI_SERVERS ([#​1776](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1776)) ### [`v3.4.2`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-342) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.4.1...v3.4.2) - chore: Use assertEqual instead of assertEquals for Python 3.11 compatibility ([#​1763](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1763)) \[Karthikeyan Singaravelan] - chore: improve code quality and balance ([#​1761](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1761)) \[Daniel Vaz Gaspar] ### [`v3.4.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-341) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.4.0...v3.4.1) - feat: Adding role_keys into Azure OAuth ([#​1744](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1744)) \[Michael Yee] - docs: Fix small documentation issues ([#​1755](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1755)) \[Dosenpfand] - fix: 1154 Add LOGOUT_REDIRECT_URL setting ([#​1749](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1749)) \[blag] - fix: optional unauthorized status codes ([#​1753](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1753)) \[Daniel Vaz Gaspar] - docs: Fix indentation of function content ([#​1752](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1752)) \[akettmann-e24] - fix: optionally return HTTP 403 instead of 401 when unauthorized ([#​1748](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1748)) \[Daniel Vaz Gaspar] - chore: Redirect to prev url on login ([#​1747](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1747)) \[Geido] - docs: add aws cognito setup code examples ([#​1746](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1746)) \[Pin Jin] - fix: Added sr-only class to icon only links ([#​1727](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1727)) \[Thomas Stivers] - chore: \[Deprecation] Use Markup instead of HTMLString ([#​1729](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1729)) \[Andrey Polegoshko] ### [`v3.4.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-340) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.3.4...v3.4.0) - chore: pin down WTForms ([#​1735](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1735)) \[Daniel Vaz Gaspar] - fix: ModuleNotFoundError from wtforms 3.0.0 ([#​1733](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1733)) \[Ke Zhu] - fix: add .env for docker-compose ([#​1728](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1728)) \[Daniel Vaz Gaspar] - fix: OAuth login flow ([#​1707](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1707)) \[Daniel Vaz Gaspar] ### [`v3.3.4`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-334) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.3.3...v3.3.4) - chore: improve tests more coverage ([#​1713](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1713)) \[Daniel Vaz Gaspar] - docs: fix requirements funcparserlib ([#​1703](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1703)) \[Daniel Vaz Gaspar] - chore: improve schema validation ([#​1712](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1712)) \[Daniel Vaz Gaspar] - chore: bump dependencies ([#​1697](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1697)) \[Daniel Vaz Gaspar] - docs: fix requirements ([#​1702](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1702)) \[Daniel Vaz Gaspar] - docs: fix issue 1700 ([#​1701](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1701)) \[Federico Padua] ### [`v3.3.3`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-333) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.3.2...v3.3.3) - fix: related filters with bogus data ([#​1695](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1695)) \[Daniel Vaz Gaspar] - chore: Bump flask-openid to 1.3.0 ([#​1693](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1693)) \[Daniel Vaz Gaspar] - chore: bump JQuery to 3.6.0 ([#​1688](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1688)) \[Daniel Vaz Gaspar] - chore: bump prison version ([#​1689](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1689)) \[Beto Dealmeida] - feat: password complexity option on DB Auth ([#​1687](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1687)) \[Daniel Vaz Gaspar] - fix: check if there is an email field in userinfo ([#​1663](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1663)) \[Yoshitaka Sakurai] ### [`v3.3.2`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-332) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.3.1...v3.3.2) - fix: improve next URL on OAuth ([#​1668](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1668)) \[Daniel Vaz Gaspar] - chore: Bump click to 8.0.1 ([#​1665](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1665)) \[Hugh A. Miles II] - feat(cli): Add import/export of roles with permissions ([#​1662](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1662)) \[krsnik93] ### [`v3.3.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-331) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.3.0...v3.3.1) - fix: Handle integrity fails if groups map to same roles ([#​1605](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1605)) \[Fred Thomsen] - refactor: OAuth - redirect direct to provider if just one provider exists ([#​1618](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1618)) \[hyunjong.lee] - feat: Allow using custom Swagger template for SwaggerView. ([#​1639](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1639)) \[Cristòfol Torrens] - chore: Remove polyfill shims for browsers no longer supported ([#​1606](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1606)) \[Ryan Hamilton] - docs: Missing `self` reference for my_custom ([#​1651](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1651)) \[Marek Šuppa] - fix: add warning text to roles when AUTH_ROLES_SYNC_AT_LOGIN ([#​1642](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1642)) \[Daniel Vaz Gaspar] ### [`v3.3.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-330) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.2.3...v3.3.0) - fix: auth balance ([#​1634](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1634)) \[Daniel Gaspar] - feat: Support for conditional menu item rendering ([#​1631](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1631)) \[Ben Reinhart] - docs: fix number of languages in i18n.rst ([#​1630](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1630)) \[Aleksandr Gordienko] - feat: Add support for before_request hooks ([#​1629](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1629)) \[Ben Reinhart] - docs: Typos and small changes in docs/templates.rst ([#​1625](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1625)) \[Federico Padua] ### [`v3.2.3`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-323) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.2.2...v3.2.3) - fix: improve performance for get role permissions ([#​1624](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1624)) \[Daniel Gaspar] - feat: get user permissions API ([#​1620](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1620)) \[Daniel Gaspar] - fix: Ignore LDAP search referrals ([#​1602](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1602)) \[Fred Thomsen] - fix: relax AzureAD mandatory fields ([#​1608](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1608)) \[hyunjong.lee] ### [`v3.2.2`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-322) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.2.1...v3.2.2) - docs: fix, errors in BaseModelView docstring ([#​1591](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1591)) \[Xiaodong DENG] - fix: load user info for okta ([#​1589](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1589)) \[QP Hou] ### [`v3.2.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-321) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.2.0...v3.2.1) - docs: improve contributing run single test ([#​1579](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1579)) \[Daniel Vaz Gaspar] - fix: sqlalchemy 1.4.0 breaking changes ([#​1586](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1586)) \[Daniel Vaz Gaspar] ### [`v3.2.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-320) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/3.1.1...v3.2.0) - fix: issue 1469 error in filters ([#​1541](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1541)) \[Duy Nguyen Hoang] - fix: showing excluded routes in server log ([#​1565](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1565)) \[runoutnow] - refactor: AUTH_LDAP/AUTH_OAUTH + implement role mapping ([#​1374](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1374)) \[Mathew Wicks] - fix(api): OpenAPI spec of nested components without auto generated names ([#​1547](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1547)) \[Daniel Vaz Gaspar] - fix(mvc): action confirmation on single show view ([#​1539](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1539)) \[Daniel Vaz Gaspar] - docs: improve docs around LDAP auth ([#​1526](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1526)) \[Daniel Vaz Gaspar] - ci: tests for python 3.8 and 3.9 ([#​1525](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1525)) \[Daniel Vaz Gaspar] - docs: fix, swagger path in readme ([#​1518](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1518)) \[Felix Rilling] - fix: oauth [#​1511](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1511) ([#​1522](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1522)) \[Daniel Vaz Gaspar] - fix: github actions ([#​1523](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1523)) \[Daniel Vaz Gaspar] - fix: changelog ([#​1507](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1507)) \[Daniel Vaz Gaspar] ### [`v3.1.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-311) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.1.0...3.1.1) - fix: MVC order by related column use alias ([#​1504](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1504)) \[Daniel Vaz Gaspar] - fix: remove unnecessary CSS class/styling from dropdowns ([#​1503](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1503)) \[Ryan Hamilton] - deps: constraint pre 1 packages following semver ([#​1502](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1502)) \[Daniel Vaz Gaspar] - fix: MVC order by on relation ([#​1500](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1500)) \[Daniel Vaz Gaspar] - docs: add github actions badge ([#​1501](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1501)) \[Daniel Vaz Gaspar] - fix: remove unnecessary classes from dropdowns ([#​1491](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1491)) \[Ryan Hamilton] - ci: migrate from travis to github actions ([#​1497](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1497)) \[Daniel Vaz Gaspar] - fix: lint ([#​1498](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1498)) \[Daniel Vaz Gaspar] - fix: Improve UX by moving drop-down caret within clickable target ([#​1492](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1492)) \[Ryan Hamilton] - style: use a clearer visual representation for "delete" actions ([#​1495](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1495)) \[Ryan Hamilton] - fix: "actions" on ModelViews with composite primary keys ([#​1493](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1493)) \[Ash Berlin-Taylor] - docs: migrate examples/quickhowto3 to version 3.x.x ([#​1488](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1488)) \[luizduma] - fix: REST API inner joins eager loading ([#​1486](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1486)) \[Daniel Vaz Gaspar] ### [`v3.1.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-310) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.0.1...v3.1.0) - Fix, sanitize the uploaded filename ([#​1482](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1482)) - Fix, add missing font file format for glyphicons ([#​1483](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1483)) - Docs, Remove incorrect possessive. `list's => lists`. ([#​1476](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1476)) - Fix, select2 readonly not working ([#​1467](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1467)) - Fix, improve type annotations on SQLAlchemy ([#​1458](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1458)) - New, Support for OpenShift OAuth ([#​1454](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1454)) - Fix, remove unnecessary strict option from schemas ([#​1466](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1466)) - Fix, check if locale exists before loading it ([#​1460](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1460)) - Fix, Update SQLAlchemy query for count_users ([#​1445](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1445)) - Docs, Contributing ([#​1440](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1440)) - Docs, improve, help contributions ([#​1438](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1438)) ### [`v3.0.1`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-301) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v3.0.0...v3.0.1) - Fix, google charts ([#​1431](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1431)) - Fix, del permission assertion on roles ([#​1434](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1434)) ### [`v3.0.0`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-300) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v2.3.4...v3.0.0) - Fix, swagger test ([#​1423](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1423)) - Fix, change openapi tags and swagger access URL (breaking) ([#​1422](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1422)) - Fix, replace deprecated flask-oauthlib with authlib ([#​1411](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1411)) - Refactor, interface query on m-m joins and select specific columns ([#​1398](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1398)) - Fix, docs on has_view_access ([#​1419](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1419)) - New, Examples/react api ([#​1071](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1071)) - Fix, action confirmation disabling ([#​1408](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1408)) - New, add API descriptions and examples to OpenAPI spec ([#​1396](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1396)) - New, Dynamic user registration role ([#​1410](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1410)) - Fix, typos and improved bit of the German translation ([#​1406](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1406)) - New, Added Dutch language to docs ([#​1393](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1393)) - New, Added Dutch translation ([#​1387](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1387)) - Fix, load options and limits for many to many truncating results ([#​1389](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1389)) - Fix, SQLAlchemyAutoSchema needs marshmallow-sqlalchemy>=0.22.0 ([#​1392](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1392)) - New, \[api] support marshmallow 3 ([#​1334](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1334)) - Fix, hardcoded url on oauth ([#​1331](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1331)) - Fix, \[examples] Update models.py ([#​1380](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1380)) - Fix: add a panel body to panel_begin/panel_end macros ([#​1377](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1377)) - Fix, name column resizing in ab_view_menu table [#​1367](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1367) ([#​1368](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1368)) - Fix, typos in the documentation ([#​1375](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1375)) ### [`v2.3.4`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-234) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v2.3.3...v2.3.4) - Fix, \[api] SQL selects and many to many joins ([#​1361](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1361)) - Fix, \[frontend] Revert "Bump jQuery to 3.5 ([#​1351](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1351))" ([#​1363](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1363)) ### [`v2.3.3`](https://redirect.github.com/dpgaspar/flask-appbuilder/blob/HEAD/CHANGELOG.rst#Improvements-and-Bug-fixes-on-233) [Compare Source](https://redirect.github.com/dpgaspar/flask-appbuilder/compare/v2.3.2...v2.3.3) - New, \[cli] Fix, reset-password cli option ([#​1347](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1347)) - New, Bump jQuery to 3.5 ([#​1351](https://redirect.github.com/dpgaspar/flask-appbuilder/issues/1351)) - New, \[menu] fix, add translation lookup in menu.get_data ([#​1352](https://redirect.githu

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

This PR was generated by Mend Renovate. View the repository job log.