Pin bcrypt<4.1 to fix passlib 1.7.4 compatibility #34

2026-08-19T21:07:05Z

agent-bot commented

2026-08-19 21:07:05 +00:00

Auto-opened by Claude.

passlib 1.7.4 detects its bcrypt backend via bcrypt.about, which bcrypt>=4.1 removed -- every register/login call was failing with a misleading 'password cannot be longer than 72 bytes' error, actually caused by an AttributeError in passlib's backend detection. Pins bcrypt==4.0.1. Verified from a genuinely clean venv + pip install, not just the already-patched shared dev venv.

Auto-opened by Claude. passlib 1.7.4 detects its bcrypt backend via bcrypt.__about__, which bcrypt>=4.1 removed -- every register/login call was failing with a misleading 'password cannot be longer than 72 bytes' error, actually caused by an AttributeError in passlib's backend detection. Pins bcrypt==4.0.1. Verified from a genuinely clean venv + pip install, not just the already-patched shared dev venv.

agent-bot added 1 commit 2026-08-19 21:07:05 +00:00

Pin bcrypt<4.1 to fix passlib 1.7.4 compatibility 87575eec43

passlib 1.7.4 (last release, unmaintained since ~2020) detects its bcrypt
backend via bcrypt.__about__.__version__, which bcrypt>=4.1 removed. Every
hash_password/verify_password call was raising 'password cannot be longer
than 72 bytes' -- a misleading downstream symptom of the real
AttributeError: module 'bcrypt' has no attribute '__about__'.

Without this pin, pip install -r requirements.txt silently grabs whatever
the latest bcrypt is and breaks register/login outright -- confirmed this
broke 3 separate pieces of work this session (manual register curl tests,
and now a real Godot smoke test) purely from environment drift, not from
any actual code bug. Verified the fix works from a genuinely clean venv +
pip install, not just patching the already-installed shared venv.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

reviewer-bot merged commit d4998d7359 into main

2026-08-19 21:12:07 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: daddy/modbison#34