django-allauth 65.19.3 released

Posted by Raymond Penners on 2026-09-11

Fixes

Account: The email address data migrations (0006 and 0008) did not honor the database selected using migrate --database, potentially querying or updating the default database instead. Fixed.
MFA: Fixed various race conditions involving TOTP and recovery codes.

Headless: When HEADLESS_JWT_STATEFUL_VALIDATION_ENABLED is on, JWT access tokens are now rejected after the password changes outside of the allauth password-change flow (for example via set_password() in a shell). Stateful validation now uses the same session auth hash check that refresh tokens already used.
A known flaw in the built-in rate limiting was that the configured limits could be exceeded under a high volume of concurrent requests. This was documented as an acceptably small margin of error. However, as Kaya Emre Arikan (kemrec) demonstrated, the limits could be substantially exceeded under a sufficiently high volume of concurrent requests. This is now fixed by serializing rate limit updates.