[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
social-auth-core (changelog)	==6.2.0 → ==7.0.0

---

Release Notes

python-social-auth/social-core (social-auth-core)

v7.0.0

Compare Source

Security

• Bind SAML responses to the initiating browser's pending AuthnRequest instead
  of restoring a session selected through RelayState. A same-origin return page
  supports SameSite=Lax cookies across framework integrations. IdP-initiated
  login is now disabled by default and requires explicit opt-in. In-progress
  SAML logins must restart after upgrading.
• Bind OpenID assertions to the initiating browser session instead of restoring
  a session selected by the assertion's signed return URL. In-progress OpenID
  logins must restart after upgrading.

Added

• Add a BaseAuth.get_provider_error() hook for classifying provider errors in
  callbacks and HTTP responses.
• Add a Casdoor OpenID Connect backend for self-hosted Casdoor servers, with
  PKCE enabled by default.

Changed

• BaseAuth.authenticate() now runs the pipeline on the backend passed in the
  backend keyword argument through its new run_authentication() method.
  This preserves the original backend's state when a framework such as Django
  calls authenticate() on a separate backend instance. Passing a strategy
  different from the supplied backend's strategy now raises
  AuthConfigurationError; create the backend with the intended strategy.
• Assigning BaseAuth.strategy is deprecated and emits a DeprecationWarning.
  Type checkers now treat it as read-only. Create the backend with the intended
  strategy instead.
• Make backends and strategies generic in their framework response type,
  preserving that type through authentication actions and decorated partial
  pipeline steps, including steps returning HTML responses.

Fixed

• Bitbucket's rejection of a revoked refresh token (400 invalid_request) or
  of a deactivated user's refresh token (401 User is inactive) now raises
  AuthCredentialError with reauthentication_required instead of
  AuthProviderError or AuthCanceled.
• Classify OAuth invalid_request failures as AuthConfigurationError.
• Log configuration guidance when Azure AD returns AADSTS9002325, explaining
  that server-side callbacks must use the Web platform in the app registration.

Removed

• Drop support for Python 3.10. Python 3.11 or newer is now required.
• Remove BaseStrategy.get_session_id(), BaseStrategy.restore_session(), and
  BaseStrategy.SESSION_SAVE_KEY. Custom strategies and backends using them
  must migrate to browser-bound callback correlation.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[read-the-docs-community]

Documentation build overview

📚 Python Social Auth | 🛠️ Build #35764864 | 📁 Comparing 865f3a9 against latest (98813cd)

  🔍 Preview build  

13 files changed · ± 13 modified

± Modified

• genindex.html
• api/index.html
• _modules/social_core/exceptions.html
• _modules/social_core/storage.html
• _modules/social_core/strategy.html
• _modules/social_core/utils.html
• _modules/social_core/backends/base.html
• _modules/social_core/backends/oauth.html
• _modules/social_core/backends/open_id.html
• _modules/social_core/backends/open_id_connect.html
• and 3 more...