chore: re-add the bcrypt dependency

[nhoening]

Description

We add bcrypt back to our dependencies (for a while or forever) as old logging in to accounts with older passwords seems to require it.

Flask-Security requires to explicitly install the library used for hashing. The project changed their default hashing algorithm from bcrypt to argon in v5.5.0 (which we use since a long time, I went back to 0.26). We did switch to installing argon explicitly (and not bcrypt anymore). Maybe we did not consider enough that the older passwords were hashed with a different algorithm than newer passwords.

But until now, there was also no issue. This is something we are not able to easily reproduce locally.

Apparently, bcrypt is needed when older passwords that were encrypted with it need to be used/reset. Requesting a new auth token works, but logging in does not (the user did the former regularly, but not the latter). Maybe we had a version live with bcrypt and argon, and that would do a re-hash successfully, and only few users never logged in during that time? Just a theory.

Also, there was a weird error in the logs: "ERROR: Exception in /requestAuthToken endpoint: password cannot be longer than 72 bytes, truncate manually if necessary" This is misleading, as the message is not about the actual password as it appears, see the discussion in pyca/bcrypt#1082. It seem to be a problem with the new bcrypt version 5. It seems version 4.3.0 is safer for now.

One hoster of FlexMeasures saw the problem, and installing bcrypt helped.

Closes https://github.com/SeitaBV/flexmeasures-cloudinfra/issues/283

• re-add dependency, set bcrypt to the version reported to work well.
• Added changelog item in documentation/changelog.rst

[read-the-docs-community]

Documentation build overview

📚 flexmeasures | 🛠️ Build #31831583 | 📁 Comparing d2b3255 against latest (547a77b)

🔍 Preview build

Show files changed (2 files in total): 📝 2 modified | ➕ 0 added | ➖ 0 deleted

File	Status
changelog.html	📝 modified
api/v3_0.html	📝 modified

[Flix6x]

Okay. Obviously I'll have to take care when backporting this for v0.31.2, which doesn't use uv, but it seems relativity straightforward.

[nhoening]

Ah indeed, I forgot.