I'm trying to create a web app with flask and most tutorials I can find recommend using flask-login, however the last release was around two and a half years ago and the last commit was nine months ago. The only statement I could find is this issue where the maintainer says it's still maintained but there has only been one new commit since then. Is it still safe to use, if not, what alternatives are there?

top 9 comments

sorted by: hot top controversial new old

[–] jatone@lemmy.dbzer0.com 7 points 1 week ago (1 children)

why would a mature library have frequent commits?

[–] SatansDaughter@piefed.blahaj.zone 1 points 1 week ago

Weil I wasn't sure wether or not it was actually mature enough to not be updated anymore, that's why I asked, but from the other replies, it seems it's safe

[–] dgdft@lemmy.world 4 points 1 week ago (1 children)

Yeah, it’s just mature software.

There’s not much to depth to flask login; it’s a small convenience layer. You can roll your own user management with werkzeug’s password_hash and cookies if you want.

[–] SatansDaughter@piefed.blahaj.zone 1 points 1 week ago

Ok, I figured it was probably fine but I wanted confirmation

[–] thoughtfuldragon@lemmy.blahaj.zone 4 points 1 week ago* (last edited 1 week ago) (1 children)

You may want to look at https://flask-security.readthedocs.io/en/stable/ It's layered on top of flask-login and has had commits in the past week.

[–] SatansDaughter@piefed.blahaj.zone 1 points 1 week ago

That's good to know, if other packages use it, it's probably safe

[–] hendrik@palaver.p3x.de 2 points 1 week ago* (last edited 1 week ago) (1 children)

I think Quart is the more modern (async) Flask successor. Or people use FastAPI, ... That's where active development happens. The Flask ecosystem is more stable, mature I guess? There's plenty old plugins without recent updates. But most I had a look at were written in a very clean way, and they're probably perfectly fine. Unless they're niche or you find some discussion about security-related stuff in the bugtracker.

[–] SatansDaughter@piefed.blahaj.zone 3 points 1 week ago (1 children)

Quart looks interesting but I'll probably stick with flask for now. I figured flask-login was probably fine but I wanted confirmation

[–] hendrik@palaver.p3x.de 1 points 1 week ago

Solid choice. I like Flask's design. They have good documentation as well. And PieFed (and probably lots of other projects) also rely on flask-login and all these extensions.