# What changed in flask-appbuilder

> 8 changes in flask-appbuilder 5 from its official release notes, upgrade guides and advisories: 1 breaking, 2 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-25. HTML: https://unstale.sh/pypi/flask-appbuilder/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## flask-appbuilder 5

### Breaking changes

- API login provider validation is enforced when AUTH_TYPE has no API provider. (5.2.2) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.2.2)

### Security

- Users created without a password are assigned an unusable password. (5.3.0) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.3.0)
- Special characters in usernames are escaped when used in LDAP search filters. (5.2.2) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.2.2)

### New APIs and options

- Adds dynamic group/role mapping for LDAP, OAuth and SAML. (5.3.0) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.3.0)

### Behavior and default changes

- A warning is issued when Azure OAuth JWT signature verification is disabled. (5.2.2) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.2.2)
- UUID generation switches from uuid1 to uuid4 for better randomness. (5.2.2) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.2.2)

### Fixes and other changes

- Authentication and authorization redirects are now distinguished. (5.2.3) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.2.3)
- The OAuth email whitelist regex is anchored to the end of the string. (5.2.2) — [release notes](https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v5.2.2)