[dependabot]

Bumps social-auth-core from 5.2.0 to 6.2.0.

Release notes

Sourced from social-auth-core's releases.

6.2.0

Added

• Add a Weblate OpenID Connect backend with Hosted Weblate defaults, configurable issuer, PKCE, official branding, and optional legal-version storage.
• Add a strategy-aware backend get_title() method for sign-in labels.

Security

• Bind OpenID Connect nonces to the initiating browser session and OAuth2 state, rejecting authorization codes from other login attempts. In-progress OIDC logins must restart after upgrading.
• OpenID callbacks now require a transaction value signed into the return URL and stored in the initiating session. This prevents a callback from another browser from linking an account while a login at the same provider is pending. In-progress OpenID logins must restart after upgrading; unsolicited assertions are no longer accepted.
• Reject EVE Online sign-ins when a character's owner hash changes, preventing transferred characters from authenticating as the previous local user. The old association must be removed before the new owner can sign in.
• Enforce SOCIAL_AUTH_SLACK_TEAM against the workspace ID returned by Slack before login. Configurations using a workspace name or Enterprise organization ID must change to a workspace ID.
• Scope Mailchimp sign-in identities to both the account and the authorizing login, preventing different Mailchimp users on one account from sharing a local user. Account-keyed associations migrate only when their stored login identifier matches; rows without that evidence require authenticated linking or account recovery. Mailchimp now rejects configured ID_KEY values other than mailchimp_identity; remove any old user_id override before upgrading.
• Google One Tap now requires a configured client ID before validating ID tokens. Deployments without one must set SOCIAL_AUTH_GOOGLE_ONETAP_KEY to keep One Tap sign-in working.
• Reject Telegram callback fields containing a line feed before checking their signature, preventing one signed identity from authenticating as another UID.
• Discourse callbacks now require the session that started login, preventing login CSRF and unauthorized account linking. In-progress logins from before this upgrade, or those that lose their session, must restart.
• OAuth2 authorization starts now use distinct, session-bound, expiring states that are claimed once before token exchange, with PKCE verifiers kept per transaction. In-progress OAuth2 logins from before this upgrade must restart; custom storage implementations must provide atomic NonceMixin.consume(). New abandoned session transactions are pruned on a subsequent authorization start.
• Prevent request-provided next values from resolving configuration settings into post-login redirects, which could disclose URL-like setting values.
• Odnoklassniki iframe logins now confirm that the signed launch's user ID belongs to the presented provider session, preventing account substitution by moving digits between undelimited signature fields.
• Reject unverified historical-identifier matches when ID_KEY is configured, preventing an account with a matching username from claiming a pre-6.0 association created under a stable identifier. Existing same-identifier

... (truncated)

Changelog

Sourced from social-auth-core's changelog.

6.2.0 - 2026-10-20

Added

• Add a Weblate OpenID Connect backend with Hosted Weblate defaults, configurable issuer, PKCE, official branding, and optional legal-version storage.
• Add a strategy-aware backend get_title() method for sign-in labels.

Security

• Bind OpenID Connect nonces to the initiating browser session and OAuth2 state, rejecting authorization codes from other login attempts. In-progress OIDC logins must restart after upgrading.
• OpenID callbacks now require a transaction value signed into the return URL and stored in the initiating session. This prevents a callback from another browser from linking an account while a login at the same provider is pending. In-progress OpenID logins must restart after upgrading; unsolicited assertions are no longer accepted.
• Reject EVE Online sign-ins when a character's owner hash changes, preventing transferred characters from authenticating as the previous local user. The old association must be removed before the new owner can sign in.
• Enforce SOCIAL_AUTH_SLACK_TEAM against the workspace ID returned by Slack before login. Configurations using a workspace name or Enterprise organization ID must change to a workspace ID.
• Scope Mailchimp sign-in identities to both the account and the authorizing login, preventing different Mailchimp users on one account from sharing a local user. Account-keyed associations migrate only when their stored login identifier matches; rows without that evidence require authenticated linking or account recovery. Mailchimp now rejects configured ID_KEY values other than mailchimp_identity; remove any old user_id override before upgrading.
• Google One Tap now requires a configured client ID before validating ID tokens. Deployments without one must set SOCIAL_AUTH_GOOGLE_ONETAP_KEY to keep One Tap sign-in working.
• Reject Telegram callback fields containing a line feed before checking their signature, preventing one signed identity from authenticating as another UID.
• Discourse callbacks now require the session that started login, preventing login CSRF and unauthorized account linking. In-progress logins from before this upgrade, or those that lose their session, must restart.
• OAuth2 authorization starts now use distinct, session-bound, expiring states that are claimed once before token exchange, with PKCE verifiers kept per transaction. In-progress OAuth2 logins from before this upgrade must restart; custom storage implementations must provide atomic NonceMixin.consume(). New abandoned session transactions are pruned on a subsequent authorization start.
• Prevent request-provided next values from resolving configuration settings into post-login redirects, which could disclose URL-like setting values.
• Odnoklassniki iframe logins now confirm that the signed launch's user ID belongs to the presented provider session, preventing account substitution by moving digits between undelimited signature fields.
• Reject unverified historical-identifier matches when ID_KEY is configured, preventing an account with a matching username from claiming a pre-6.0

... (truncated)

Commits

• 04bb456 chore: release 6.2.0
• eaef362 docs(security): consolidate core threat model
• c2f2ae4 fix(oidc): bind nonce to initiating session
• 93ca3b7 fix(openid): bind callbacks to initiating transactions
• a45a32e chore(deps): update ghcr.io/astral-sh/uv docker tag to v0.13.3
• 13439b9 chore(deps): update dependency astral-sh/uv to v0.13.3
• 96a2f1a fix(eveonline): reject transferred character sign-ins
• b528b1a fix(slack): enforce configured workspace on callback
• 1a456d2 fix(mailchimp): scope sign-in identities to account and login
• 3a256c2 fix(telegram): reject line feeds in signed callback fields
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.