Flip back to Flask-Mail as the default mailer. (#1117)

Flask-Mail is again supported and part of Pallets-Eco.
Flask-Mailman is still supported as before.

Author: jwag956

CHANGES.rst

@@ -8,6 +8,8 @@ Version 5.7.0
 
 Released XXX
 
+This release is a set of small backward incompatible changes. Please read these notes carefully.
+
 Fixes
 +++++
 - (:issue:`1109`) Fix broken link in docs and improve docstrings/typing for util classes.
@@ -17,12 +19,18 @@ Docs and Chores
 - (:pr:`1106`) Drop support for Python 3.9. This removes the dependency on importlib_resources,
    updates pypy to 3.10, and uses 3.12 as base python for tests/tox.
 - (:pr:`1112`) Flip :py:data:`SECURITY_USE_REGISTER_V2` default to ``True``.
+- (:pr:`xx`) Flip default mail package back to Flask-Mail (from Flask-Mailman).
 
 Backwards Compatibility Concerns
 +++++++++++++++++++++++++++++++++
 As mentioned above - the default RegisterForm is now the new RegisterFormV2 - Please read :ref:`register_form_migration`.
 Flask-Security will emit a DeprecationWarning if the :py:data:`SECURITY_USE_REGISTER_V2` is set to False.
 
+In 5.0 we changed the default mailer package to Flask-Mailman since Flask-Mail was no longer supported.
+Flask-Mail is again supported and is part of Pallets-Eco. Both packages are still supported based on which one
+an application initializes. The only backwards compatibility concern is that if you use the setup extras 'common',
+it will install Flask-Mail rather than Flask-Mailman.
+
 Version 5.6.2
 -------------
 

README.rst

@@ -55,7 +55,7 @@ maintenance of related projects. If you are interested in helping maintain
 this project, please reach out on `the Pallets Discord server <https://discord.gg/pallets>`.
 
 Goals
-+++++
+-----
 
 * Use `OWASP <https://github.com/OWASP/ASVS>`_ to guide best practice and default configurations.
 * Be more opinionated and 'batteries' included by reducing reliance on abandoned projects and
@@ -73,7 +73,7 @@ Goals
 
 
 Contributing
-++++++++++++
+------------
 Issues and pull requests are welcome. Other maintainers are also welcome.
 Please consult these `contributing`_ guidelines.
 

docs/index.rst

@@ -32,7 +32,7 @@ Many of these features are made possible by integrating various Flask extensions
 and libraries. They include:
 
 * `Flask-Login <https://flask-login.readthedocs.org/en/latest/>`_
-* `Flask-Mailman <https://pypi.org/project/Flask-Mailman/>`_
+* `Flask-Mail <https://pypi.org/project/Flask-Mail/>`_
 * `Flask-Principal <https://pypi.org/project/Flask-Principal/>`_
 * `Flask-WTF <https://pypi.org/project/Flask-WTF/>`_
 * `itsdangerous <https://pypi.org/project/itsdangerous/>`_

docs/installation.rst

@@ -28,7 +28,7 @@ Supported extras are:
 
 * ``babel`` - Translation services. It will install babel and Flask-Babel.
 * ``fsqla`` - Use flask-sqlalchemy and sqlalchemy as your storage interface.
-* ``common`` - Install Flask-Mailman, argon2 (the default password hash), and bleach.
+* ``common`` - Install Flask-Mail, argon2 (the default password hash), bcrypt (old commonly used password hash) and bleach.
 * ``mfa`` - Install packages used for multi-factor (two-factor, unified signin, WebAuthn):
   cryptography, qrcode, phonenumberslite (note that for SMS you still need
   to pick an SMS provider and install appropriate packages), and webauthn.

docs/quickstart.rst

@@ -7,7 +7,7 @@ There are some complete (but simple) examples available in the *examples* direct
 .. note::
     The below quickstarts are just that - they don't enable most of the features (such as registration, reset, etc.).
     They basically create a single user, and you can login as that user... that's it.
-    As you add more features, additional packages (e.g. Flask-Mailman, Flask-Babel, qrcode) might be required
+    As you add more features, additional packages (e.g. Flask-Mail, Flask-Babel, qrcode) might be required
     and will need to be added to your requirements.txt (or equivalent) file.
     Flask-Security does some configuration validation and will output error messages to the console
     for some missing packages.
@@ -561,15 +561,15 @@ Mail Configuration
 
 Flask-Security integrates with an outgoing mail service via the ``mail_util_cls`` which
 is part of initial configuration. The default class :class:`flask_security.MailUtil` utilizes the
-`Flask-Mailman <https://pypi.org/project/flask-mailman/>`_ package. Be sure to add flask_mailman to
-your requirements.txt. The older and no longer maintained package `Flask-Mail <https://pypi.org/project/Flask-Mail/>`_
-is also (still) supported.
+`Flask-Mail <https://pypi.org/project/flask-mail/>`_ package. Be sure to add flask_mail to
+your requirements.txt. The Django inspired package `Flask-Mailman <https://pypi.org/project/Flask-Mailman/>`_
+is also supported.
 
 The following code illustrates a basic setup, which could be added to
 the basic application code in the previous section::
 
     # At top of file
-    from flask_mailman import Mail
+    from flask_mail import Mail
 
     # After 'Create app'
     app.config['MAIL_SERVER'] = 'smtp.example.com'
@@ -579,9 +579,9 @@ the basic application code in the previous section::
     app.config['MAIL_PASSWORD'] = 'password'
     mail = Mail(app)
 
-To learn more about the various Flask-Mailman settings to configure it to
+To learn more about the various Flask-Mail settings to configure it to
 work with your particular email server configuration, please see the
-`Flask-Mailman documentation <https://waynerv.github.io/flask-mailman/>`_.
+`Flask-Mail documentation <https://flask-mail.readthedocs.io/en/latest/>`_.
 
 .. _proxy-configuration:
 

docs/two_factor_configurations.rst

@@ -38,7 +38,7 @@ possible using SQLAlchemy:
     from flask_sqlalchemy import SQLAlchemy
     from flask_security import Security, SQLAlchemyUserDatastore, \
         UserMixin, RoleMixin, auth_required
-    from flask_mailman import Mail
+    from flask_mail import Mail
 
     # Create app
     app = Flask(__name__)

flask_security/mail_util.py

@@ -4,10 +4,10 @@
 
 Utility class providing methods for validating, normalizing and sending emails.
 
-:copyright: (c) 2020-2024 by J. Christopher Wagner (jwag).
+:copyright: (c) 2020-2025 by J. Christopher Wagner (jwag).
 :license: MIT, see LICENSE for more details.
 
-While this default implementation uses Flask-Mailman - we want to make sure that
+While this default implementation uses Flask-Mail - we want to make sure that
 Flask-Mailman isn't REQUIRED (if this implementation isn't used).
 """
 
@@ -79,7 +79,7 @@ def send_mail(
         so we cast to str() here to force localization.
         """
 
-        if current_app.extensions.get("mailman", None):
+        if current_app.extensions.get("mailman", None):  # pragma: no cover
             from flask_mailman import EmailMultiAlternatives, Mail
 
             # Flask-Mailman doesn't appear to take a tuple - a bug has been filed
@@ -104,7 +104,7 @@ def send_mail(
                     msg.attach_alternative(html, "text/html")
                 msg.send()
 
-        elif current_app.extensions.get("mail", None):  # pragma: no cover
+        elif current_app.extensions.get("mail", None):
             from flask_mail import Message
 
             # In Flask-Mail, sender can be a two element tuple -- (name, address)

mypy.ini

@@ -25,7 +25,7 @@ ignore_errors = True
 
 [mypy-quart.*]
 ignore_missing_imports = True
-[mypy-flask_mail.*]
+[mypy-flask_mailman.*]
 ignore_missing_imports = True
 [mypy-twilio.*]
 ignore_missing_imports = True

pyproject-too.toml

@@ -50,15 +50,15 @@ dependencies = [
 [project.optional-dependencies]
 babel = ["babel>=2.12.1", "flask_babel>=4.0.0"]
 fsqla = ["flask_sqlalchemy>=3.1.0", "sqlalchemy>=2.0.18", "sqlalchemy-utils>=0.41.1"]
-common = ["argon2_cffi>=21.3.0", "bcrypt>=4.0.1", "flask_mailman>=0.3.0", "bleach>=6.0.0"]
+common = ["argon2_cffi>=21.3.0", "bcrypt>=4.0.1", "flask_mail>=0.10.0", "bleach>=6.0.0"]
 mfa = ["cryptography>=40.0.2", "qrcode>=7.4.2", "phonenumberslite>=8.13.11", "webauthn>=2.0.0"]
 low = [
     # Lowest supported versions
     "Flask==3.0.0",
     "Flask-SQLAlchemy==3.1.0",
     "Flask-SQLAlchemy-Lite==0.1.0;python_version>='3.10'",
     "Flask-Babel==4.0.0",
-    "Flask-Mailman==0.3.0",
+    "Flask-Mail==0.10.0",
     "Flask-Login==0.6.3",
     "Flask-WTF==1.1.2",
     "peewee==3.17.9",

pyproject.toml

@@ -50,15 +50,15 @@ dependencies = [
 [project.optional-dependencies]
 babel = ["babel>=2.12.1", "flask_babel>=4.0.0"]
 fsqla = ["flask_sqlalchemy>=3.1.0", "sqlalchemy>=2.0.18", "sqlalchemy-utils>=0.41.1"]
-common = ["argon2_cffi>=21.3.0", "bcrypt>=4.0.1", "flask_mailman>=0.3.0", "bleach>=6.0.0"]
+common = ["argon2_cffi>=21.3.0", "bcrypt>=4.0.1", "flask_mail>=0.10.0", "bleach>=6.0.0"]
 mfa = ["cryptography>=40.0.2", "qrcode>=7.4.2", "phonenumberslite>=8.13.11", "webauthn>=2.0.0"]
 low = [
     # Lowest supported versions
     "Flask==3.0.0",
     "Flask-SQLAlchemy==3.1.0",
     "Flask-SQLAlchemy-Lite==0.1.0;python_version>='3.10'",
     "Flask-Babel==4.0.0",
-    "Flask-Mailman==0.3.0",
+    "Flask-Mail==0.10.0",
     "Flask-Login==0.6.3",
     "Flask-WTF==1.1.2",
     "peewee==3.17.9",