Bump social-auth-core from 4.9.1 to 5.0.0

[dependabot]

Bumps social-auth-core from 4.9.1 to 5.0.0.

Release notes

Sourced from social-auth-core's releases.

5.0.0

Security

• LoginRadius backend now validates callback state to prevent login CSRF.
• Odnoklassniki app backend now ignores untrusted callback API hosts and validates returned user details.
• Partial pipeline resume now requires session ownership or explicit external resume confirmation to prevent login CSRF.
• SAML responses are now validated against the original AuthnRequest when possible.
• Twilio backend now preserves HTTPS callback URLs and validates callback state to prevent login CSRF.

Fixed

• Auth0 OpenID Connect configuration now uses the correct base URLs.
• Authentication now handles invalid email addresses without crashing.
• Vend OAuth user IDs are now scoped by shop.
• VK app authentication now requires an auth key.

Removed

• Discontinued OAuth backends: AppsFuel, Beats Music, ChangeTip, Clef, Edmodo, 500px (five_hundred_px), legacy Google App Engine bundled Users (gae), Jawbone, Moves, Mozilla Persona, Readability Parser API, and Wunderlist.
• Discontinued Google+ Sign-In backend (google-plus / GooglePlusAuth).

Changelog

Sourced from social-auth-core's changelog.

5.0.0 - 2026-06-23

Security

• LoginRadius backend now validates callback state to prevent login CSRF.
• Odnoklassniki app backend now ignores untrusted callback API hosts and validates returned user details.
• Partial pipeline resume now requires session ownership or explicit external resume confirmation to prevent login CSRF.
• SAML responses are now validated against the original AuthnRequest when possible.
• Twilio backend now preserves HTTPS callback URLs and validates callback state to prevent login CSRF.

Fixed

• Auth0 OpenID Connect configuration now uses the correct base URLs.
• Authentication now handles invalid email addresses without crashing.
• Vend OAuth user IDs are now scoped by shop.
• VK app authentication now requires an auth key.

Removed

• Discontinued OAuth backends: AppsFuel, Beats Music, ChangeTip, Clef, Edmodo, 500px (five_hundred_px), legacy Google App Engine bundled Users (gae), Jawbone, Moves, Mozilla Persona, Readability Parser API, and Wunderlist.
• Discontinued Google+ Sign-In backend (google-plus / GooglePlusAuth).

Commits

• 29dffe6 chore: release 5.0.0
• 2fdbca2 fix(twilio): validate connect callback state
• 0418782 fix!: bind partial pipeline resumes to sessions
• 6fcde2c chore: remove discontinued Google+ Sign-In backend
• f318835 fix(deps): update dependency ty to v0.0.52 (#1814)
• 1bb49c6 fix(deps): update dependency coverage to v7.14.3 (#1813)
• d81bf03 chore(tests): clarify test annotations and expectations (#1812)
• 52471d3 chore(tests): clarify type annotations (#1810)
• 4d33282 fix(backends): LoginRadius backend now validates callback state
• 1bfacdd fix(backends): VKAppOAuth2 now requires auth_key
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #75.