2.3.5

• allow social-auth-app-django 6.x and 7.x (social-auth-core 5 and 6), which carry the fixes for CVE-2026-57175 through CVE-2026-57179; the 2.x pin kept every install on the unpatched social-auth-core 4.x. Resolving to the patched releases requires Django 5.2 and Python 3.10; older Django keeps social-auth-app-django 5.4.x #924
• fix reloading djoser settings (for example with override_settings) mutating the default values of dict-valued settings #921
• remove the unused djet extra; it only ever installed a test helper djoser does not use, and pip install djoser[djet] now warns instead of installing it #919
• declare Django 6.0 and 6.1 support; the test suite runs on Django 6.1 in CI #925