finnandClaude Opus 5.5
5eea5da396
New passwords are stored as {BLF-CRYPT} with cost 12, which Dovecot 2.4
verifies. Existing {SSHA512} hashes are still checked and replaced at the
next login. Unknown users are checked against a dummy hash, so the
response time does not reveal whether an email exists.
bcrypt only uses 72 bytes and bcrypt 5 raises for longer passwords, so
validate_password limits passwords to 72 bytes when creating a user,
changing a password and in the CLI.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
7 lines
190 B
Plaintext
7 lines
190 B
Plaintext
# Direct dependencies of MAX. Pinned versions with hashes are in requirements.txt,
|
|
# generated by `make lock-deps` (see README).
|
|
bcrypt>=5,<6
|
|
Flask>=3.1,<4
|
|
gunicorn>=26,<27
|
|
psycopg2>=2.9,<3
|