(:issue:474) Add public API and CLI command to change a user's password.
(:issue:140) Add type hints. Please note that many of the packages that flask-security
depends on aren't typed yet - so there are likely errors in some of the types.
(:issue:466) Add first-class support for using username for signing in.
(:pr:488) In 4.0.0, with the addition of Flask-Babel support, Flask-Security enforced that
if it could import either Flask-Babel or Flask-BabelEx, that those modules had
been initialized as proper Flask extensions. Prior to 4.0.0, just Flask-BabelEx
was supported - and that didn't require any explicit initialization. Flask-Babel
DOES require explicit initialization. However for some applications that don't
completely control their environment (such as system pre-installed versions of
python) this caused applications that didn't even want translation services to
fail on startup. With this release, Flask-Security still attempts to import
one or the other package - however if those modules are NOT initialized,
Flask-Security will simply ignore them and no translations will occur.
(:issue:497) The CSRF_COOKIE and TWO_FACTOR_VALIDITY cookie had their defaults
changed to set samesite=Strict. This follows the Flask-Security goal of
making things more secure out-of-the-box.
(:issue:140) Type hinting. For the most part this of course has no runtime effects.
However, this required a fairly major overhaul of how Flask-Security is initialized in
order to provide valid types for the many constructor attributes. There are no known
compatability concerns - however initialization used to convert all arguments into kwargs
then add those as attributes and merge with application constants. That no longer happens
and it is possible that some corner cases don't behave precisely as they did before.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/louking/loutilities/network/alerts).
Bumps flask-security-too from 3.4.5 to 4.1.0.
Release notes
Sourced from flask-security-too's releases.
Changelog
Sourced from flask-security-too's changelog.
... (truncated)
Commits
f69e3f4Update messages. Ready for release (#505)df47746Add username support. (#504)efe98c8Typing Part 3. (#502)852d81eSmall fixes typos in the documentation (#501)e52eb16Typing part 2. (#500)3d58da1Typing part 1 (#499)90da546Cookie improvements. (#498)46e7179Small improvements - documentation, installation, etc. (#496)4d6a914Do not raise a TypeError exception if phone.data is None (#495)e60e089Revamp how babel packages are imported and used. (#494)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/louking/loutilities/network/alerts).