# Passlib 1.7

Warning

Passlib 1.8 will drop support for Python 2.x, 3.3, and 3.4; and will require Python >= 3.5. The 1.7 series will be the last to support Python 2.7. (See :issue:`119` for rationale).

System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 9); backlink

Unknown interpreted text role “issue”.

## 1.7.4 (2020-10-08)

Small followup to 1.7.3 release.

### Bugfixes

- Fixed some Python 2.6 errors from last release (:issue:`128`)

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 21); backlink

  Unknown interpreted text role “issue”.

### Other Changes

- `passlib.ext.django` – updated tests to pass for Django 1.8 - 3.1 (:issue:`98`); along with some internal refactoring of the test classes.

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 26); backlink

  Unknown interpreted text role “issue”.

- `CryptContext` will now throw `UnknownHashError` when it can’t identify a hash provided to methods such as `CryptContext.verify()`. Previously it would throw a generic `ValueError`.

### Deprecations

- `passlib.ext.django`: This extension will require Django 2.2 or newer as of Passlib 1.8.

## 1.7.3 (2020-10-06)

This release rolls up assorted bug & compatibility fixes since 1.7.2.

### Administrative Changes

Note

Passlib has moved to Heptapod!

Due to BitBucket deprecating Mercurial support, Passlib’s public repository and issue tracker has been relocated. It’s now located at https://foss.heptapod.net/python-libs/passlib, and is powered by Heptapod.

Hosting for this and other open-source projects graciously provided by the people at Octobus and CleverCloud!

The mailing list and documentation urls remain the same.

### New Features

- `ldap_salted_sha512`: LDAP “salted hash” support added for SHA-256 and SHA-512 (:issue:`124`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 70); backlink

  Unknown interpreted text role “issue”.

### Bugfixes

- `bcrypt`: Under python 3, OS native backend wasn’t being detected on BSD platforms. This was due to a few internal issues in feature-detection code, which have been fixed.

- `passlib.utils.safe_crypt()`: Support `crypt.crypt()` unexpectedly returning bytes under Python 3 (:issue:`113`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 80); backlink

  Unknown interpreted text role “issue”.

- `passlib.utils.safe_crypt()`: Support `crypt.crypt()` throwing `OSError`, which can happen as of Python 3.9 (:issue:`115`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 83); backlink

  Unknown interpreted text role “issue”.

- `passlib.ext.django`: fixed lru_cache import (django 3 compatibility)

- `passlib.tests`: fixed bug where `HandlerCase.test_82_crypt_support()` wasn’t being run on systems lacking support for the hasher being tested. This test now runs regardless of system support.

### Deprecations

- Support for Python 2.x, 3.3, and 3.4 is deprecated; and will be dropped in Passlib 1.8.

### Other Changes

- `bcrypt_sha256`: Internal algorithm has been changed to use HMAC-SHA256 instead of plain SHA256. This should strengthen the hash against brute-force attempts which bypass the intermediary hash by using known-sha256-digest lookup tables (:issue:`114`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 102); backlink

  Unknown interpreted text role “issue”.

- `bcrypt`: OS native backend (“os_crypt”) now raises the new `PasswordValueError` if password is provided as non-UTF8 bytes under python 3 (These can’t be passed through, due to limitation in stdlib’s `crypt.crypt()`). Prior to this release, it confusingly raised `MissingBackendError` instead.

  Also improved legacy bcrypt format workarounds, to support a few more UTF8 edge cases than before.

- Modified some internals to help run on FIPS systems (:issue:`116`):

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 115); backlink

  Unknown interpreted text role “issue”.

  In particular, when MD5 hash is not available, `hex_md5` will now return a dummy hasher which throws an error if used; rather than throwing an uncaught `ValueError` when an application attempts to import it. (Similar behavior added for the other unsalted digest hashes).

  Also, `lookup_hash()`’s `required=False` kwd was modified to report unsupported hashes via the `HashInfo.supported` attribute; rather than letting ValueErrors through uncaught.

  This should allow CryptContext instances to be created on FIPS systems without having a load-time error (though they will still receive an error if an attempt is made to actually use a FIPS-disabled hash).

- Internal errors calling stdlib’s `crypt.crypt()`, or third party libraries, will now raise the new `InternalBackendError` (a RuntimeError); where previously it would raise an `AssertionError`.

- Various Python 3.9 compatibility fixes (including `NotImplemented`-related warning, :issue:`125`)

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 135); backlink

  Unknown interpreted text role “issue”.

## 1.7.2 (2019-11-22)

This release rolls up assorted bug & compatibility fixes since 1.7.1.

### New Features

- `argon2`: Now supports Argon2 “ID” and “D” hashes (assuming new enough backend library). Now defaults to “ID” hashes instead of “I” hashes, but this can be overridden via `type` keyword. (:issue:`101`)

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 148); backlink

  Unknown interpreted text role “issue”.

- `scrypt`: Now uses python 3.6 stdlib’s `hashlib.scrypt()` as backend, if present (:issue:`86`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 154); backlink

  Unknown interpreted text role “issue”.

### Bugfixes

- Python 3.8 compatibility fixes

- `passlib.apache.HtpasswdFile`: Now generates bcrypt hashes using the `"$2y$"` prefix, which should work properly with Apache 2.4’s `htpasswd` tool. Previous releases used the functionally equivalent `"$2b$"` prefix, which `htpasswd` was unable to read (:issue:`95`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 162); backlink

  Unknown interpreted text role “issue”.

- `passlib.totp`: The `TOTP.to_uri()` method now prepends the issuer to URI label, (per the KeyURI spec). This should fix some compatibility issues with older TOTP clients (:issue:`92`)

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 169); backlink

  Unknown interpreted text role “issue”.

- Fixed error in `argon2.parsehash()` (:issue:`97`)

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 175); backlink

  Unknown interpreted text role “issue”.

- unittests: `crypt()` unittests now account for linux systems running libxcrypt (such as recent Fedora releases)

### Deprecations

Warning

Due to lack of `pip` and `venv` support, Passlib is no longer fully tested on Python 2.6 & 3.3. There are no known issues, and bugfixes against these versions will still be accepted for the Passlib 1.7.x series. However, Passlib 1.8 will drop support for Python 2.x, 3.3, & 3.4, and require Python >= 3.5.

- Support for Python 2.x, 3.3, and 3.4 is deprecated; and will be dropped in Passlib 1.8. (2020-10-06: Updated to include all of Python 2.x, 3.3, and 3.4; when 1.7.2 was released, only Python 2.6 and 3.3 support was deprecated)

- `bcrypt`: `py-bcrypt` and `bcryptor` backends are deprecated, and support will be removed in Passlib 1.8. Please switch to the `bcrypt` backend.

### Other Changes

- setup.py: now honors `$SOURCE_DATE_EPOCH` to help with reproducible builds

- `argon2`: Now throws helpful error if “argon2” package is actually an incompatible or supported version of argon2_cffi (:issue:`99`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 208); backlink

  Unknown interpreted text role “issue”.

- documentation: Various updates & corrections. building the documentation now requires Sphinx 1.6 or newer.

## 1.7.1 (2017-1-30)

This release rolls up assorted bug & compatibility fixes since 1.7.0.

### Bugfixes

- `cisco_asa` and `cisco_pix`: Fixed a number of issues which under certain conditions caused prior releases to generate hashes that were unverifiable on Cisco systems.

- `PasswordHash.hash()` will now warn if passed any settings keywords. This usage was deprecated in 1.7.0, but warning wasn’t properly enabled. See Customizing the Configuration for the preferred way to pass settings.

- setup.py: Don’t append timestamp when run from an sdist. This should fix some downstream build issues.

- `passlib.tests.test_totp`: Test suite now traps additional errors that `datetime.utcfromtimestamp()` may throw under python 3, which should fix some test failures on architectures with rarer ILP sizes. It also works around Python 3.6 bug 29100.

### Deprecations

- `CryptContext`: The `harden_verify` flag has been turned into a NOOP and deprecated. It will be removed in passlib 1.8 along with the already-deprecated `min_verify_time` (:issue:`83`).

  System Message: ERROR/3 (/build/python-passlib-EzVFOb/python-passlib-1.9.3/docs/history/1.7.rst, line 245); backlink

  Unknown interpreted text role “issue”.

### Other Changes

- `passlib.tests.utils`: General truncation policy details were hammered out, and additional hasher tests were added to enforce them.

- documentation: Various updates & corrections.