From 87575eec43bf6bcaaf66257ec67324b905e417ee Mon Sep 17 00:00:00 2001 From: claude-checkpoint-tooling Date: Wed, 19 Aug 2026 21:06:41 +0000 Subject: [PATCH] Pin bcrypt<4.1 to fix passlib 1.7.4 compatibility passlib 1.7.4 (last release, unmaintained since ~2020) detects its bcrypt backend via bcrypt.__about__.__version__, which bcrypt>=4.1 removed. Every hash_password/verify_password call was raising 'password cannot be longer than 72 bytes' -- a misleading downstream symptom of the real AttributeError: module 'bcrypt' has no attribute '__about__'. Without this pin, pip install -r requirements.txt silently grabs whatever the latest bcrypt is and breaks register/login outright -- confirmed this broke 3 separate pieces of work this session (manual register curl tests, and now a real Godot smoke test) purely from environment drift, not from any actual code bug. Verified the fix works from a genuinely clean venv + pip install, not just patching the already-installed shared venv. Co-Authored-By: Claude Sonnet 5 --- backend/requirements.txt | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/backend/requirements.txt b/backend/requirements.txt index 5cb3fb3..489725f 100644 --- a/backend/requirements.txt +++ b/backend/requirements.txt @@ -9,6 +9,14 @@ pydantic==2.10.3 pydantic-settings==2.7.0 python-jose[cryptography]==3.3.0 passlib[bcrypt]==1.7.4 +# passlib 1.7.4 (last release, unmaintained since ~2020) detects its bcrypt +# backend via bcrypt.__about__.__version__, which bcrypt>=4.1 removed -- +# hashing/verifying a password then raises "password cannot be longer than +# 72 bytes" (a misleading downstream symptom of the real AttributeError: +# module 'bcrypt' has no attribute '__about__') on every call. Without this +# pin, `pip install -r requirements.txt` silently grabs whatever the latest +# bcrypt is and breaks register/login outright. Pin below 4.1 explicitly. +bcrypt==4.0.1 python-multipart==0.0.20 email-validator==2.2.0 httpx==0.28.1 -- 2.52.0