Bump social-auth-core from 4.5.4 to 4.5.6

[dependabot]

Bumps social-auth-core from 4.5.4 to 4.5.6.

Release notes

Sourced from social-auth-core's releases.

Release 4.5.6

What's Changed

• fix: revert API changes from #986 by @​nijel in python-social-auth/social-core#1020
• chore: release 4.5.6 by @​nijel in python-social-auth/social-core#1021
• fix: corrected backeds nonce interface by @​nijel in python-social-auth/social-core#1022

Full Changelog: python-social-auth/social-core@4.5.5...4.5.6

Release 4.5.5

What's Changed

• Fix defusedxml requirement by @​bj00rn in python-social-auth/social-core#912
• build(deps-dev): bump pre-commit from 3.7.0 to 3.7.1 by @​dependabot in python-social-auth/social-core#913
• Fix ORCID login when no family name was given by @​nikoder in python-social-auth/social-core#914
• Fix python-social-auth/social-core#918 by @​Fleapse in python-social-auth/social-core#921
• Allow per-backend user pipeline settings by @​dehnert in python-social-auth/social-core#677
• Use timezone-aware datetime objects by @​Tenzer in python-social-auth/social-core#926
• build(deps-dev): bump pre-commit from 3.7.1 to 3.8.0 by @​dependabot in python-social-auth/social-core#928
• Fix access token expiration and refresh token handling in GitHub backend by @​gmargaritis in python-social-auth/social-core#933
• Add AzureADOauth2 backend using the v2.0 API. by @​mateuszmandera in python-social-auth/social-core#931
• Allow overriding emails to be fully lowercase by @​selten in python-social-auth/social-core#943
• 944 fix params in auth url by @​gersona in python-social-auth/social-core#945
• Add passing tests for linkedin OAuth updates by @​offbyone in python-social-auth/social-core#950
• chore: use ruff for linting and code formatting by @​nijel in python-social-auth/social-core#952
• Modify the dummy tests to be timezone-safe by @​nijel in python-social-auth/social-core#953
• Switch to pyproject.toml for project metadata by @​offbyone in python-social-auth/social-core#951
• feat: modernize release process by @​nijel in python-social-auth/social-core#954
• chore: drop support for Python 3.8 by @​nijel in python-social-auth/social-core#955
• Add support for Python 3.13 by @​nijel in python-social-auth/social-core#956
• chore: remove not needed else statement by @​nijel in python-social-auth/social-core#958
• chore: use startswith with tuple by @​nijel in python-social-auth/social-core#959
• chore: remove not needed else after return by @​nijel in python-social-auth/social-core#960
• fix: remove outdated Python 2 code by @​nijel in python-social-auth/social-core#961
• chore: use next() instead of getting first element from list by @​nijel in python-social-auth/social-core#962
• chore: avoid using join on string literals by @​nijel in python-social-auth/social-core#963
• chore: remove legacy code for no longer supported Python versions by @​nijel in python-social-auth/social-core#964
• chore: use dict literals by @​nijel in python-social-auth/social-core#965
• fix: add explicit return None by @​nijel in python-social-auth/social-core#966
• chore: use unpacking instead of manual concatenation by @​nijel in python-social-auth/social-core#967
• chore: remove not needed params from exception class by @​nijel in python-social-auth/social-core#968
• chore: use f-strings instead of format() by @​nijel in python-social-auth/social-core#969
• chore: use values when only dict values are needed by @​nijel in python-social-auth/social-core#970
• chore: avoid import as when not renaming by @​nijel in python-social-auth/social-core#971
• chore: use literals and comprehensions more effectively by @​nijel in python-social-auth/social-core#972
• chore: simplify return statements by @​nijel in python-social-auth/social-core#973
• chore: bring back isort ordering by @​nijel in python-social-auth/social-core#974
• chore: remove not needed pass statements by @​nijel in python-social-auth/social-core#975
• chore: merge nested with statements by @​nijel in python-social-auth/social-core#976
• feat(ci): extend ruff rulesets by @​nijel in python-social-auth/social-core#977
• chore: apply assorted ruff fixes by @​nijel in python-social-auth/social-core#978

... (truncated)

Changelog

Sourced from social-auth-core's changelog.

4.5.6 - 2025-02-13

Changed

• Reverted unintended change in OpenId storage API.

4.5.5 - 2025-02-13

Added

• Allow per-backend user pipeline settings.
• Add AzureADOauth2 backend using the v2.0 API.
• Google One Tap implementation.

Changed

• Handle case where user has not registered a family-name with ORCID
• Fix access token expiration and refresh token handling in GitHub backend
• Allow overriding emails to always be fully lowercase with SOCIAL_AUTH_FORCE_EMAIL_LOWERCASE.
• Dropped tokens alias for access_token on UserMixin which has been deprecated for 10 years now.
• LinkedIn OAuth API updates.
• Modernize release process.
• Code cleanups.
• Initial type annotations.

Commits

• b2d50a9 fix: corrected backeds nonce interface
• d60d968 chore: release 4.5.6
• 0bd5ead fix: revert API changes from #986
• f665a79 chore: define workflow permissions
• a53bf90 chore: Version bump 4.5.5
• d9657bc chore: exclude license-files metadata
• 0b850d2 chore: remove debugging
• f096007 chore: build release on tag
• 49951d4 fix: stop using reusable workflow for publishing
• 5d14d41 chore: debug publishing
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The requirements.txt file is updated to use social-auth-core version 4.5.6 instead of 4.5.4, with potential security implications that should be reviewed in the release notes.

Expand for full summary

The pull request updates the social-auth-core library version from 4.5.4 to 4.5.6 in requirements.txt. Security considerations include: potential security patches in the version upgrade, recommended review of release notes for specific security improvements related to the authentication library.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

View PR in the DryRun Dashboard.

[Maffooch]

@dependabot rebase

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.