8.0.0

Security

• Support social-auth-core's SAML browser return page and its security headers,
  allowing callbacks to use the initiating browser's SameSite=Lax session for
  AuthnRequest correlation in service-provider-initiated flows.

Breaking

• Drop Python 3.10 support; Python 3.11 or later is required.
• Require social-auth-core 7.x.
• Remove DjangoStrategy.get_session_id() and DjangoStrategy.restore_session().
  Custom strategies and backends using these methods must migrate to
  browser-bound callback correlation.
• Make get_session_timeout() options keyword-only. Pass
  enable_session_expiration and max_session_length by name in custom callers.

Fixed

• Preserve Django response types through strategies, backends, authentication
  actions, and decorated partial pipeline steps.
• Improve type annotations for social authentication managers, lazy dictionaries,
  template rendering, session timeouts, and bundled icon storage.