search

acidjunk / pricelist-backend

Pricelist backend
GNU General Public License v3.0
0 stars 0 forks source link

Bump flask-security-too from 3.3.2 to 4.1.0 in /requirements #23

Closed dependabot[bot] closed 2 years ago

dependabot[bot] commented 2 years ago

Bumps flask-security-too from 3.3.2 to 4.1.0.

Release notes

Sourced from flask-security-too's releases.

4.1.0 Release

A feature release with (hopefully) no backwards compatibility issues. See CHANGES for a complete list:

  1. Add typing
  2. Add first-class support for username
  3. Add a public API and CLI for changing a user's password.

4.0.1 Release

A very small release - mostly documentation fixes - thanks to all the early adopters!

4.0.0 Release

4.0.0, as a major release, is a non-backwards compatible release of Flask-Security. Please read the release/change notes carefully.

Release 4.0.0rc1

4.0.0, as a major release, is a non-backwards compatible release of Flask-Security. Please read the release/change notes carefully.

Fix CSRF Vulnerability

The /login and /change endpoints allowed a GET request to return the users authentication token. That's not good. Now, as prior to 3.3.0, only successful POSTs can return the token.

Release 3.4.4

Fix 3 regressions and a couple other bugs.

Release 3.4.3

Fix a regression in two-factor.

Backport some documentation fixes.

3.4.2 - Move repo to github organization

The flask-security repo was moved to a github organization - Flask-Middleware.

3.4.1 Bug-Fix Release

See CHANGES for details. Lots of small bug fixes in the new unified sign in feature. Fixed a regression in the alternative ID feature.

WTForms 2.3.0 just came out - that required a small change.

3.4.0 Feature Release

3.4.0 introduces a few major features:

  1. pluggable password validation, including a built-in version that does complexity checking and pwned checking.
  2. a unified sign in mechanism allowing for much more flexible ways for applications to enable authentication - including different forms of identity, and different ways to generate and accept password/pass codes.

Please see the CHANGES document for details.

3.3.3 Release

This fixes minor incompatibilities introduced with the latest Werkzeug and Flask-Login.

Changelog

Sourced from flask-security-too's changelog.

Version 4.1.0

Released July 23, 2021

Features ++++++++

  • (:issue:474) Add public API and CLI command to change a user's password.
  • (:issue:140) Add type hints. Please note that many of the packages that flask-security depends on aren't typed yet - so there are likely errors in some of the types.
  • (:issue:466) Add first-class support for using username for signing in.

Fixes +++++

  • (:issue:483) 4.0 doesn't accept 3.4 authentication tokens. (kuba-lilz)
  • (:issue:490) Flask-Mail sender name can be a tuple. (hrishikeshrt)
  • (:issue:486) Possible open redirect vulnerability.
  • (:pr:478) Improve/update German translation. (sr-verde)
  • (:issue:488) Improve handling of Babel packages.
  • (:pr:496) Documentation improvements, distribution extras, fix single message override.
  • (:issue:497) Improve cookie handling and default samesite to Strict.

Backwards Compatibility Concerns +++++++++++++++++++++++++++++++++

  • (:pr:488) In 4.0.0, with the addition of Flask-Babel support, Flask-Security enforced that if it could import either Flask-Babel or Flask-BabelEx, that those modules had been initialized as proper Flask extensions. Prior to 4.0.0, just Flask-BabelEx was supported - and that didn't require any explicit initialization. Flask-Babel DOES require explicit initialization. However for some applications that don't completely control their environment (such as system pre-installed versions of python) this caused applications that didn't even want translation services to fail on startup. With this release, Flask-Security still attempts to import one or the other package - however if those modules are NOT initialized, Flask-Security will simply ignore them and no translations will occur.
  • (:issue:497) The CSRF_COOKIE and TWO_FACTOR_VALIDITY cookie had their defaults changed to set samesite=Strict. This follows the Flask-Security goal of making things more secure out-of-the-box.
  • (:issue:140) Type hinting. For the most part this of course has no runtime effects. However, this required a fairly major overhaul of how Flask-Security is initialized in order to provide valid types for the many constructor attributes. There are no known compatability concerns - however initialization used to convert all arguments into kwargs then add those as attributes and merge with application constants. That no longer happens and it is possible that some corner cases don't behave precisely as they did before.

Version 4.0.1

Released April 2, 2021

... (truncated)

Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/acidjunk/pricelist-backend/network/alerts).
dependabot[bot] commented 2 years ago

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.