daddy/modbison
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Pin bcrypt<4.1 to fix passlib 1.7.4 compatibility

Browse Source 
passlib 1.7.4 (last release, unmaintained since ~2020) detects its bcrypt
backend via bcrypt.__about__.__version__, which bcrypt>=4.1 removed. Every
hash_password/verify_password call was raising 'password cannot be longer
than 72 bytes' -- a misleading downstream symptom of the real
AttributeError: module 'bcrypt' has no attribute '__about__'.

Without this pin, pip install -r requirements.txt silently grabs whatever
the latest bcrypt is and breaks register/login outright -- confirmed this
broke 3 separate pieces of work this session (manual register curl tests,
and now a real Godot smoke test) purely from environment drift, not from
any actual code bug. Verified the fix works from a genuinely clean venv +
pip install, not just patching the already-installed shared venv.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
claude-checkpoint-tooling
2026-08-19 21:06:41 +00:00
parent f64ffd6422
commit 87575eec43
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/requirements.txt
+8
View File
@@ -9,6 +9,14 @@ pydantic==2.10.3
pydantic-settings==2.7.0
python-jose[cryptography]==3.3.0
passlib[bcrypt]==1.7.4
# passlib 1.7.4 (last release, unmaintained since ~2020) detects its bcrypt
# backend via bcrypt.__about__.__version__, which bcrypt>=4.1 removed --
# hashing/verifying a password then raises "password cannot be longer than
# 72 bytes" (a misleading downstream symptom of the real AttributeError:
# module 'bcrypt' has no attribute '__about__') on every call. Without this
# pin, `pip install -r requirements.txt` silently grabs whatever the latest
# bcrypt is and breaks register/login outright. Pin below 4.1 explicitly.
bcrypt==4.0.1
python-multipart==0.0.20
email-validator==2.2.0
httpx==0.28.1