Passlib dependency

[david-froot]

This package depends on passlib which is out of date (last updated in Oct 2020) and depends on crypt which is removed in Python 3.13. Suggest replacing with bcrypt.

[jwag956]

This fork: https://pypi.org/project/libpass/ looks promising. I am going to let that settle a bit before converting over.

[jwag956]

I am looking into this.

First - libpass seems to work just fine and I am hoping it will get the effort needed to get it all cleaned up.

passlib still works for 3.13 - while it does attempt to import crypt - it has fallbacks if that import fails. Now - the fallback for safe_crypt() when there isn't 'crypt' is to return a Null hash - which seems bad - but the few places that call this all have higher level fallbacks. More importantly - it seems to be only called in:

• des_crypt
• md5_crypt
• sha1_crypt
• sha2_crypt
• brcypt - but ONLY in the case no external bcrypt library is installed

So I think that for most if not all Flask-Security applications - this shouldn't be an issue.

I don't want to set libpass as a dependency yet since it is new fork - lets see how it gets maintained.

[jrast]

Note that there is also this fork: https://github.com/frankie567/pwdlib

pwdlib decided to break some backward compatibility, so it might not be a replacement for passlib