Skip to content
This repository has been archived by the owner on Feb 12, 2022. It is now read-only.

Bump django-allauth from 0.45.0 to 0.47.0 #518

Closed
wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 10, 2021

Bumps django-allauth from 0.45.0 to 0.47.0.

Changelog

Sourced from django-allauth's changelog.

0.47.0 (2021-12-09)


Note worthy changes

  • New providers: Gumroad.

Backwards incompatible changes

  • Added a new setting SOCIALACCOUNT_LOGIN_ON_GET that controls whether or not the endpoints for initiating a social login (for example, "/accounts/google/login/") require a POST request to initiate the handshake. As requiring a POST is more secure, the default of this new setting is False.

Security notice

Automatically signing in users into their account and connecting additional third party accounts via a simple redirect ("/accounts/facebook/login/") can lead to unexpected results and become a security issue especially when the redirect is triggered from a malicious web site. For example, if an attacker prepares a malicious website that (ab)uses the Facebook password recovery mechanism to first sign into his/her own Facebook account, followed by a redirect to connect a new social account, you may end up with the attacker's Facebook account added to the account of the victim. To mitigate this, SOCIALACCOUNT_LOGIN_ON_GET is introduced.

0.46.0 (2021-11-15)


Note worthy changes

  • New providers: Gitea, MediaWiki.

  • New translations: Georgian, Mongolian.

  • Django 3.2 compatibility.

Commits
  • ae93b9f chore: Release 0.47.0
  • af35133 chore: Prepping release
  • f02dcfa chore(ci): Include Django 4.0
  • 2b6c66e chore(i18n): Updated Slovak translation
  • 4f9efa9 feat(socialaccount): SOCIALACCOUNT_LOGIN_ON_GET
  • 9c3ed19 refactor(socialaccount/providers): Split up base.py
  • 556bd22 chore: Fix formatting
  • de5ec4f chore(README): More cross-selling
  • 3d85478 fix(accounts): Attribute error for custom email field
  • 341c460 chore(account/settings): Default to settings.LOGOUT_REDIRECT_URL
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Dec 10, 2021
@dependabot dependabot bot force-pushed the dependabot/pip/django-allauth-0.47.0 branch from a4c2596 to d91bce0 Compare January 18, 2022 12:58
Bumps [django-allauth](https://github.com/pennersr/django-allauth) from 0.45.0 to 0.47.0.
- [Release notes](https://github.com/pennersr/django-allauth/releases)
- [Changelog](https://github.com/pennersr/django-allauth/blob/master/ChangeLog.rst)
- [Commits](pennersr/django-allauth@0.45.0...0.47.0)

---
updated-dependencies:
- dependency-name: django-allauth
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/pip/django-allauth-0.47.0 branch from d91bce0 to 79b54eb Compare January 18, 2022 12:58
@dependabot @github
Copy link
Contributor Author

dependabot bot commented on behalf of github Feb 4, 2022

Superseded by #533.

@dependabot dependabot bot closed this Feb 4, 2022
@dependabot dependabot bot deleted the dependabot/pip/django-allauth-0.47.0 branch February 4, 2022 04:12
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants