New passwords are stored as {BLF-CRYPT} with cost 12, which Dovecot 2.4
verifies. Existing {SSHA512} hashes are still checked and replaced at the
next login. Unknown users are checked against a dummy hash, so the
response time does not reveal whether an email exists.
bcrypt only uses 72 bytes and bcrypt 5 raises for longer passwords, so
validate_password limits passwords to 72 bytes when creating a user,
changing a password and in the CLI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Only the direct dependencies were pinned. Werkzeug, Jinja2, MarkupSafe,
itsdangerous and the other transitive packages were resolved at build
time, so builds of the same commit could differ, and pip did not verify
the downloaded files. There was also no vulnerability scan.
- requirements.in / requirements-dev.in list the direct dependencies.
requirements.txt / requirements-dev.txt are lockfiles generated by
pip-compile with exact versions and hashes for every package. The dev
lockfile is constrained by the production one.
- Makefile targets: lock-deps, update-deps, sync-deps and audit
(pip-audit against requirements.txt).
- The locked production versions match the previously installed ones.
The first audit found no known vulnerabilities.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
finnandClaude Opus 5.5