-------------
Released July 23, 2021
Features
++++++++
- (:issue:`474`) Add public API and CLI command to change a user's password.
- (:issue:`140`) Add type hints. Please note that many of the packages that flask-security
depends on aren't typed yet - so there are likely errors in some of the types.
- (:issue:`466`) Add first-class support for using username for signing in.
Fixes
+++++
- (:issue:`483`) 4.0 doesn't accept 3.4 authentication tokens. (kuba-lilz)
- (:issue:`490`) Flask-Mail sender name can be a tuple. (hrishikeshrt)
- (:issue:`486`) Possible open redirect vulnerability.
- (:pr:`478`) Improve/update German translation. (sr-verde)
- (:issue:`488`) Improve handling of Babel packages.
- (:pr:`496`) Documentation improvements, distribution extras, fix single message
override.
- (:issue:`497`) Improve cookie handling and default ``samesite`` to ``Strict``.
Backwards Compatibility Concerns
+++++++++++++++++++++++++++++++++
- (:pr:`488`) In 4.0.0, with the addition of Flask-Babel support, Flask-Security enforced that
if it could import either Flask-Babel or Flask-BabelEx, that those modules had
been initialized as proper Flask extensions. Prior to 4.0.0, just Flask-BabelEx
was supported - and that didn't require any explicit initialization. Flask-Babel
DOES require explicit initialization. However for some applications that don't
completely control their environment (such as system pre-installed versions of
python) this caused applications that didn't even want translation services to
fail on startup. With this release, Flask-Security still attempts to import
one or the other package - however if those modules are NOT initialized,
Flask-Security will simply ignore them and no translations will occur.
- (:issue:`497`) The CSRF_COOKIE and TWO_FACTOR_VALIDITY cookie had their defaults
changed to set ``samesite=Strict``. This follows the Flask-Security goal of
making things more secure out-of-the-box.
- (:issue:`140`) Type hinting. For the most part this of course has no runtime effects.
However, this required a fairly major overhaul of how Flask-Security is initialized in
order to provide valid types for the many constructor attributes. There are no known
compatability concerns - however initialization used to convert all arguments into kwargs
then add those as attributes and merge with application constants. That no longer happens
and it is possible that some corner cases don't behave precisely as they did before.