search

jrobichaud / django-structlog

Structured Logging for Django
https://django-structlog.readthedocs.io/en/latest/
MIT License
434 stars 34 forks source link

chore(deps): bump django-allauth from 0.63.3 to 0.63.6 in /requirements #588

Closed dependabot[bot] closed 2 months ago

dependabot[bot] commented 2 months ago

Bumps django-allauth from 0.63.3 to 0.63.6.

Changelog

Sourced from django-allauth's changelog.

0.63.6 (2024-07-12)

Security notice

  • When the Facebook provider was configured to use the js_sdk method the login page could become vulnerable to an XSS attack.

0.63.5 (2024-07-11)

Fixes

  • The security fix in 0.63.4 that altered the __str__() of SocialToken caused issues within the Amazon Cognito, Atlassian, JupyterHub, LemonLDAP, Nextcloud and OpenID Connect providers. Fixed.

0.63.4 (2024-07-10)

Security notice

  • The __str__() method of the SocialToken model returned the access token. As a consequence, logging or printing tokens otherwise would expose the access token. Now, the method no longer returns the token. If you want to log/print tokens, you will now have to explicitly log the token field of the SocialToken instance.

  • Enumeration prevention: the behavior on the outside of an actual signup versus a signup where the user already existed was not fully identical, fixed.

Commits
  • 8fead34 fix(facebook): Use json_script to encode settings
  • 11fa4e8 fix(socialaccount): Drop use of SocialToken.str
  • a41085c chore: Release 0.63.4
  • a671ca6 fix(account): Prevent enumeration vs messages
  • 663c7df fix(socialaccount): Don't return access token in str
  • aa33e2f chore: Opening 0.63.4-dev
  • See full diff in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)