chore(deps): update dependency social-auth-app-django to v5.6.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
social-auth-app-django (changelog)	5.4.3 → 5.6.0

---

Python Social Auth - Django has unsafe account association

CVE-2025-61783 / GHSA-wv4w-6qv2-qqfg

More information

Details

Impact

Upon authentication, the user could be associated by e-mail even if the associate_by_email pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses.

Patches

• https://github.com/python-social-auth/social-app-django/pull/803

Workarounds

Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg
• https://github.com/python-social-auth/social-app-django/issues/220
• https://github.com/python-social-auth/social-app-django/issues/231
• https://github.com/python-social-auth/social-app-django/issues/634
• https://github.com/python-social-auth/social-app-django/pull/803
• https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c
• https://nvd.nist.gov/vuln/detail/CVE-2025-61783
• https://github.com/advisories/GHSA-wv4w-6qv2-qqfg

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Python Social Auth - Django has unsafe account association

CVE-2025-61783 / GHSA-wv4w-6qv2-qqfg

More information

Details

Impact

Upon authentication, the user could be associated by e-mail even if the associate_by_email pipeline was not included. This could lead to account compromise when a third-party authentication service does not validate provided e-mail addresses or doesn't require unique e-mail addresses.

Patches

• https://github.com/python-social-auth/social-app-django/pull/803

Workarounds

Review the authentication service policy on e-mail addresses; many will not allow exploiting this vulnerability.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/python-social-auth/social-app-django/security/advisories/GHSA-wv4w-6qv2-qqfg
• https://nvd.nist.gov/vuln/detail/CVE-2025-61783
• https://github.com/python-social-auth/social-app-django/issues/220
• https://github.com/python-social-auth/social-app-django/issues/231
• https://github.com/python-social-auth/social-app-django/issues/634
• https://github.com/python-social-auth/social-app-django/pull/803
• https://github.com/python-social-auth/social-app-django/commit/10c80e2ebabeccd4e9c84ad0e16e1db74148ed4c
• https://github.com/python-social-auth/social-app-django

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

python-social-auth/social-app-django (social-auth-app-django)

v5.6.0

Compare Source

Changed

• Fixed possibly unsafe account association (CVE-2025-61783)
• Storage now filters for active users, you might need to customize SOCIAL_AUTH_ACTIVE_USERS_FILTER if your custom model does not have the is_active field

Added

• Django 6.0 and Python 3.14 compatibility
• Type annotations
• LoginRequiredMiddleware compatibility
• RAISE_EXCEPTIONS and LOGIN_ERROR_URL can be configured per backend

v5.5.1

Compare Source

Changed

• Fixed authentication with OpenID based services

v5.5.0

Compare Source

Changed

• Dropped support for older Django versions.
• Added non-empty constraind on uid.
• Added support for session restore with stricter SameSite cookie policy.

---

Configuration

📅 Schedule: (in timezone US/Eastern)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Anas12091101]

Closing in favor of #3897

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (>=5.4.0,<6). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.