Bump flask-security-too from 4.0.1 to 4.1.0

[dependabot]

Bumps flask-security-too from 4.0.1 to 4.1.0.

Release notes

Sourced from flask-security-too's releases.

4.1.0 Release

A feature release with (hopefully) no backwards compatibility issues. See CHANGES for a complete list:

1. Add typing
2. Add first-class support for username
3. Add a public API and CLI for changing a user's password.

Changelog

Sourced from flask-security-too's changelog.

Version 4.1.0

Released July 23, 2021

Features ++++++++

• (:issue:474) Add public API and CLI command to change a user's password.
• (:issue:140) Add type hints. Please note that many of the packages that flask-security depends on aren't typed yet - so there are likely errors in some of the types.
• (:issue:466) Add first-class support for using username for signing in.

Fixes +++++

• (:issue:483) 4.0 doesn't accept 3.4 authentication tokens. (kuba-lilz)
• (:issue:490) Flask-Mail sender name can be a tuple. (hrishikeshrt)
• (:issue:486) Possible open redirect vulnerability.
• (:pr:478) Improve/update German translation. (sr-verde)
• (:issue:488) Improve handling of Babel packages.
• (:pr:496) Documentation improvements, distribution extras, fix single message override.
• (:issue:497) Improve cookie handling and default samesite to Strict.

Backwards Compatibility Concerns +++++++++++++++++++++++++++++++++

• (:pr:488) In 4.0.0, with the addition of Flask-Babel support, Flask-Security enforced that if it could import either Flask-Babel or Flask-BabelEx, that those modules had been initialized as proper Flask extensions. Prior to 4.0.0, just Flask-BabelEx was supported - and that didn't require any explicit initialization. Flask-Babel DOES require explicit initialization. However for some applications that don't completely control their environment (such as system pre-installed versions of python) this caused applications that didn't even want translation services to fail on startup. With this release, Flask-Security still attempts to import one or the other package - however if those modules are NOT initialized, Flask-Security will simply ignore them and no translations will occur.
• (:issue:497) The CSRF_COOKIE and TWO_FACTOR_VALIDITY cookie had their defaults changed to set samesite=Strict. This follows the Flask-Security goal of making things more secure out-of-the-box.
• (:issue:140) Type hinting. For the most part this of course has no runtime effects. However, this required a fairly major overhaul of how Flask-Security is initialized in order to provide valid types for the many constructor attributes. There are no known compatability concerns - however initialization used to convert all arguments into kwargs then add those as attributes and merge with application constants. That no longer happens and it is possible that some corner cases don't behave precisely as they did before.

Commits

• f69e3f4 Update messages. Ready for release (#505)
• df47746 Add username support. (#504)
• efe98c8 Typing Part 3. (#502)
• 852d81e Small fixes typos in the documentation (#501)
• e52eb16 Typing part 2. (#500)
• 3d58da1 Typing part 1 (#499)
• 90da546 Cookie improvements. (#498)
• 46e7179 Small improvements - documentation, installation, etc. (#496)
• 4d6a914 Do not raise a TypeError exception if phone.data is None (#495)
• e60e089 Revamp how babel packages are imported and used. (#494)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.