Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package python-social-auth-core for
openSUSE:Factory checked in at 2026-10-20 12:40:48
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/python-social-auth-core (Old)
and /work/SRC/openSUSE:Factory/.python-social-auth-core.new.3698736 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-social-auth-core"
Tue Oct 20 12:40:48 2026 rev:35 rq:1386271 version:5.2.0
Changes:
--------
---
/work/SRC/openSUSE:Factory/python-social-auth-core/python-social-auth-core.changes
2026-09-07 11:33:12.832165683 +0200
+++
/work/SRC/openSUSE:Factory/.python-social-auth-core.new.3698736/python-social-auth-core.changes
2026-10-20 12:42:09.073104303 +0200
@@ -1,0 +2,82 @@
+Mon Oct 19 12:12:08 UTC 2026 - Daniel Garcia <[email protected]>
+
+- Update to 5.2.0:
+ ### Added
+ - Added a CESID AAI OpenID Connect backend.
+ - Added an optional `user` argument to `do_auth()` and a
+ `BaseAuth.prepare_auth()` hook for backend-specific authentication
+ initiation.
+ ### Security
+ - Twilio Connect is now association-only: starting and completing a
+ connection requires the same authenticated local user. Twilio
+ callback data can no longer create or authenticate users.
+ - Facebook App authentication now binds access-token and
+ signed-request callbacks to the browser session, preventing login
+ CSRF and unauthorized account linking. Custom Facebook App
+ templates must preserve the query string in
+ `FACEBOOK_COMPLETE_URI` when submitting the callback.
+ - Weixin app authentication now validates OAuth state before
+ exchanging codes, preventing login CSRF and unauthorized account
+ linking.
+ - Last.fm authentication now binds callbacks to the browser session
+ that initiated the login, preventing login CSRF and unauthorized
+ account linking.
+ - GitHub App authentication now validates OAuth state before
+ exchanging codes. Stateless installation callbacks restart a
+ state-protected OAuth flow, preventing forged installation
+ parameters from enabling login CSRF.
+ - VK OpenAPI authentication now uses the signed session's user ID
+ instead of trusting the ID supplied in callback data.
+ ### Changed
+ - Updated development dependencies and CI actions.
+ - Allowed newer Google Auth versions for the Google One Tap backend.
+
+- 5.1.1:
+ ### Security
+ - VK app authentication now fetches user profiles directly from VK
+ and verifies that the profile ID matches the signed viewer ID,
+ preventing forged callback data from overriding the authenticated
+ identity and profile.
+ ### Added
+ - Added `AuthReauthenticationRequired`, a subclass of
+ `AuthTokenError`, for OpenID Connect token refreshes that require
+ the user to sign in again.
+ ### Changed
+ - Updated development dependencies and CI actions.
+ - Allowed newer Google Auth versions for the Google One Tap backend.
+ ### Fixed
+ - Authentication backends now consistently honor configurable user
+ ID keys.
+ - Auth0 now requests the required `openid`, `profile`, and `email`
+ scopes and raises `AuthTokenError` when the token response lacks
+ an ID token.
+ - OpenID Connect now validates required ID token claims consistently
+ and handles legacy token refresh identity context more reliably.
+ - SAML parsing, decryption, and validation failures now consistently
+ raise authentication exceptions, as do unknown or invalid identity
+ provider names.
+ - SAML responses without RelayState now include the resolved
+ identity provider name when only one provider is configured.
+ ### Removed
+ - Discontinued OAuth backends: EchoSign, ExactTarget, Pocket,
+ Runkeeper, Skyrock, and Withings.
+
+- 5.1.0:
+ ### Added
+ - Added a Helmholtz AAI OpenID Connect backend.
+ - Native applications can allow private-use redirect URI schemes
+ with the `ALLOWED_REDIRECT_SCHEMES` setting.
+ ### Security
+ - OpenID Connect backends now validate ID tokens returned during
+ token refresh and reject changes to the authenticated identity.
+ ### Changed
+ - Updated development dependencies and CI actions.
+ ### Fixed
+ - Updated the Coinbase backend to use current OAuth endpoints,
+ scopes, API versioning, and token revocation parameters.
+ - HTTP 403 responses from authentication providers now raise
+ `AuthForbidden`.
+ - JWT verification failures are now consistently wrapped in
+ social-core authentication exceptions.
+
+-------------------------------------------------------------------
Old:
----
social-core-5.0.2.tar.gz
New:
----
social-core-5.2.0.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ python-social-auth-core.spec ++++++
--- /var/tmp/diff_new_pack.6LkDH4/_old 2026-10-20 12:42:09.863137367 +0200
+++ /var/tmp/diff_new_pack.6LkDH4/_new 2026-10-20 12:42:09.864137409 +0200
@@ -20,7 +20,7 @@
%define modname social-core
%{?sle15_python_module_pythons}
Name: python-social-auth-core
-Version: 5.0.2
+Version: 5.2.0
Release: 0
Summary: Python Social Auth Core
License: BSD-3-Clause
++++++ social-core-5.0.2.tar.gz -> social-core-5.2.0.tar.gz ++++++
++++ 8240 lines of diff (skipped)
