django-allauth 65.19.6 released
Posted by Raymond Penners on 2026-09-30
Security notice
- The minimum OAuthLib version for the socialaccount and idp-oidc extras is now 4.0.0, incorporating upstream security fixes for GHSA-hj66-6f7g-4r5v and GHSA-xpv3-w29h-x7cv.
- The Bitbucket and Pinterest providers used mutable usernames as the identifier for third-party accounts. If a username changed and was then claimed by another user, that user could log in to the original owner's account. The providers now use stable identifiers instead. Thanks to Sanjeev Kumar for reporting.
Backwards incompatible changes
- Bitbucket and Pinterest: Existing SocialAccount records will no longer be linked due to the switch to stable identifiers. You will need to manually handle this situation by populating SocialAccount.uid based on account_id (Bitbucket) or id (Pinterest) located in SocialAccount.extra_data.
Next: django-allauth 65.19.7 released Previous: django-allauth 65.19.5 released