Relock Django 6.1.2, django-allauth 65.20.0, oauthlib 4; audit text (#986 #987 #990) #997

Merged

tiagoagueda merged 4 commits from sec2-e1-relock into main

2026-10-18 17:19:26 +00:00

tiagoagueda commented

2026-10-17 14:58:15 +00:00

Owner

What and why

#986 Django 6.1.1 -> 6.1.2 (four security fixes, among them a quadratic parse_header_parameters reachable by an unauthenticated request; pip-audit did not know them yet).
#987 django-allauth 65.19.5 -> 65.20.0 (65.19.6/.7/.20.0 security fixes) and oauthlib 3.3.1 -> 4.0.0. The --ignore-vuln CVE-2026-49265 of #323 is gone from ci.yml and IGNORED in tests/test_security_audit.py is empty (the guard stays: an ignore in ci.yml without an entry fails the build). Floors in pyproject.toml raised to django>=6.1.2, django-allauth>=65.20.
#990 SECURITY.md no longer promises automatic notice; it says the audit lags and the process gains a weekly and pre-release manual check of the direct dependencies' release notes against uv.lock. No scheduled reminder added: the only scheduled workflow is the monthly upgrade PR, which is the wrong cadence and not a natural place.

Behaviour change the user should know about

allauth 65.20.0: a recent sign-in no longer satisfies reauthentication. Before a destructive or sensitive step (delete account, backups, add an email address, set up/remove MFA or passkeys) the person must type the password (or use a second factor) again, even seconds after signing in; only a record marked reauthenticated counts. Postulo's own wrapper (accounts/reauth.py) is unaffected: for accounts with nothing to retype (SSO only) it still reads the newest record. Nothing in Postulo's code needed changing; tests that relied on a form sign-in now reauthenticate (tests/recently.py, tests/e2e/signing_in.py mark the record). Other allauth notes: Python 3.10 dropped (we need 3.12.4+), Bitbucket/Pinterest/Tumblr uid changes (Postulo uses none of those providers), SocialLogin.stash_state removed (unused). Django 6.1.2: header parsing may treat malformed values differently; no Postulo code touches it directly.

Tested

Whole unit suite green locally (no GeoNames data); pip-audit --strict over the exported lock: no known vulnerabilities, nothing ignored; ruff, makemigrations --check, messages extract --check clean. The new reauthenticate test step fails on 65.20 without the fix (the unit tests failed 40 ways before it).

CI browser job: please read it carefully. It exercises sign-in, MFA and passkeys, and the reauthentication change touches exactly those flows.

Closes #986, Closes #987, Closes #990

🤖 Generated with Claude Code

## What and why - **#986** Django 6.1.1 -> 6.1.2 (four security fixes, among them a quadratic `parse_header_parameters` reachable by an unauthenticated request; pip-audit did not know them yet). - **#987** django-allauth 65.19.5 -> 65.20.0 (65.19.6/.7/.20.0 security fixes) and oauthlib 3.3.1 -> 4.0.0. The `--ignore-vuln CVE-2026-49265` of #323 is gone from `ci.yml` and `IGNORED` in `tests/test_security_audit.py` is empty (the guard stays: an ignore in ci.yml without an entry fails the build). Floors in `pyproject.toml` raised to `django>=6.1.2`, `django-allauth>=65.20`. - **#990** SECURITY.md no longer promises automatic notice; it says the audit lags and the process gains a weekly and pre-release manual check of the direct dependencies' release notes against `uv.lock`. No scheduled reminder added: the only scheduled workflow is the monthly upgrade PR, which is the wrong cadence and not a natural place. ## Behaviour change the user should know about allauth 65.20.0: **a recent sign-in no longer satisfies reauthentication**. Before a destructive or sensitive step (delete account, backups, add an email address, set up/remove MFA or passkeys) the person must type the password (or use a second factor) again, even seconds after signing in; only a record marked `reauthenticated` counts. Postulo's own wrapper (`accounts/reauth.py`) is unaffected: for accounts with nothing to retype (SSO only) it still reads the newest record. Nothing in Postulo's code needed changing; tests that relied on a form sign-in now reauthenticate (`tests/recently.py`, `tests/e2e/signing_in.py` mark the record). Other allauth notes: Python 3.10 dropped (we need 3.12.4+), Bitbucket/Pinterest/Tumblr uid changes (Postulo uses none of those providers), `SocialLogin.stash_state` removed (unused). Django 6.1.2: header parsing may treat malformed values differently; no Postulo code touches it directly. ## Tested Whole unit suite green locally (no GeoNames data); `pip-audit --strict` over the exported lock: no known vulnerabilities, nothing ignored; ruff, makemigrations --check, messages extract --check clean. The new `reauthenticate` test step fails on 65.20 without the fix (the unit tests failed 40 ways before it). **CI browser job**: please read it carefully. It exercises sign-in, MFA and passkeys, and the reauthentication change touches exactly those flows. Closes #986, Closes #987, Closes #990 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 2 commits

2026-10-17 14:58:15 +00:00

SECURITY.md: the dependency audit lags, so check the advisories by hand 48e2fc133f

The text promised that a fresh disclosure in a library is noticed automatically. pip-audit
and OSV had nothing for Django 6.1.1 when 6.1.2 fixed four issues. The promise now says what
the audit is (a net), and the disclosure process gains a weekly and pre-release manual check
of the direct dependencies' release notes against uv.lock.

Closes #990

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Lock Django 6.1.2, django-allauth 65.20.0 and oauthlib 4; drop the ignored advisory

CI / Unit tests and coverage (Python 3.14) (pull_request) Successful in 14m14s

Details

CI / Checks: lint, migrations, catalogues, settings, built files (pull_request) Successful in 3m4s

Details

CI / Database tests on PostgreSQL (pull_request) Successful in 4m18s

Details

CI / Security audit (pull_request) Successful in 1m28s

Details

CI / Browser tests (Chromium) (pull_request) Failing after 34m40s

Details

58011d4945

Django 6.1.2 carries four security fixes (a quadratic parse_header_parameters reachable
without signing in, among them) that pip-audit did not yet report. django-allauth 65.19.6,
65.19.7 and 65.20.0 carry security fixes for the sign-in and MFA flows and require
oauthlib 4, which fixes CVE-2026-49265, so the --ignore-vuln of #323 in ci.yml and its entry
in tests/test_security_audit.py go. The floors in pyproject.toml are raised to the fixed
versions.

allauth 65.20.0 no longer lets a recent sign-in satisfy reauthentication: the person has to
type the password (or use a second factor) again, and the record has to carry
`reauthenticated`. The tests that stood on a form sign-in now reauthenticate on allauth's
page (tests/recently.py), and the helper that writes the record marks it. Postulo's own
sign-in-recently check for accounts with nothing to retype reads any record and is unchanged.

Closes #986
Closes #987

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>