7.2.0

Added

• Support Python 3.15 and Django 6.1.

Changed

• Consolidate the Django threat model around integration security boundaries,
  linking deployment and configuration guidance to the
  project documentation.
• Resolve sign-in labels through the strategy-aware backend get_title()
  method when available, including Hosted Weblate and custom Weblate issuers.

Fixed

• Require launch bridge redirect targets and application launch Referer headers to
  match allowed hosts exactly, including explicit ports.
• Preserve request and provider dictionaries resembling model references when
  resuming partial pipelines. New saved values distinguish model references
  from ordinary data while retaining support for existing partials. Deploy
  all workers together; older versions cannot read the new encoded values.
• Treat authenticated launch-bridge redirect targets as literal URLs, fixing
  errors for relative targets and unintended resolution as URL pattern names.
• Validate provider session expiry before logging in so invalid expiry data
  cannot leave an authenticated session after an error redirect or bypass
  SOCIAL_AUTH_MAX_SESSION_LENGTH.
• Do not count associations for association-only backends, which cannot log a
  user in, as a remaining login method when disconnecting.
• Repair historical Twitch OpenID Connect identifier labels in a new migration,
  restoring login for accounts affected by the 7.1.0 backfill. Historical
  SOCIAL_AUTH_OLD_ID_KEYS overrides take precedence over backend detection;
  review any user accounts orphaned by earlier failed logins separately.
• Treat association ID 0 as a specific ID when disconnecting, preventing
  accidental removal of all associations for the backend.
• Handle reused Discourse callbacks and missing nonces through the configured
  authentication error page or redirect instead of returning HTTP 500.

Security

• Atomically claim OAuth2 transaction state through the existing Nonce model,
  preventing simultaneous callbacks from consuming the same state. Expired
  claims are removed by clearsocial, which now applies its --age retention
  limit to all stored nonces using an indexed timestamp.
• Retain original exception tracebacks in server logs when authentication 5xx
  failures are handled through an error redirect.
• Prevent passwordless users from disconnecting their last association backed
  by a configured authentication backend when only stale provider rows remain.
• Reject authentication callbacks when their authenticated cookie session
  belongs to a different user than the restored flow session, preventing a
  provider identity from being associated with the wrong local account.
• Require CSRF-protected POST requests for e-mail and username login forms
  submitted to social:complete, preventing cross-site requests from starting
  an association flow for the signed-in user.
• Document the integration's security boundaries, assumptions, downstream
  responsibilities, and triage dispositions in the
  threat model.