django-allauth 65.20.0 released

Posted by Raymond Penners on 2026-10-16

Note worthy changes

A recent login no longer counts for views that require reauthentication. Users must now explicitly reauthenticate.
OpenID Connect providers can now override values from the server's discovery document using openid_configuration_overrides.
Account: Visiting signup now cancels pending login flows.

Headless: Cached JWT signing configuration to avoid repeatedly parsing RSA keys.
MFA: Non-ASCII authentication codes no longer cause a server error.
IdP: Fixed authorization code exchanges using client_secret_basic not returning an ID token.
Account: The password reset-by-code timeout now restarts after the code is confirmed, allowing time to choose a new password.
Account: On Python 3.15, every 404 response no longer emits a deprecation warning for os.path.commonprefix().

Account: Cancelling a multi-stage login did not discard authentication records already collected. When another account was subsequently logged in using the same session, records from both accounts were mingled. Aborted login flows now discard their authentication records.
Authorization state is now bound to the provider that initiated the flow, preventing it from being used at another provider's callback.

Dropped support for Python 3.10.
Custom provider implementations using the SocialLogin.stash_state() or SocialLogin.unstash_state() methods must switch to Provider.stash_redirect_state() and Provider.unstash_redirect_state(), respectively. The SocialLogin methods have been removed.