Bump social-auth-core from 4.8.6 to 4.9.1

[dependabot]

Bumps social-auth-core from 4.8.6 to 4.9.1.

Release notes

Sourced from social-auth-core's releases.

4.9.1

Changed

• GitHub backend now handles scoped email fetching deterministically.

Fixed

• OpenID Connect missing token handling.
• Microsoft refresh token and expiry handling.
• Partial pipeline handling for Django QueryDict values.

4.9.0

This release might contain breaking changes. Review the removed backends and stricter OAuth, OpenID Connect, and Azure AD validation before upgrading.

Added

• OpenID Connect claim names for email, first name, last name, and full name can now be configured.
• GitHub backend now stores fetched emails in pipeline data.

Changed

• Azure AD backends now use OpenID configuration and JWKS for token validation.
• Built-in provider URLs now consistently use HTTPS.
• AUTH_EXTRA_ARGUMENTS values are no longer overridden by request data unless the key is listed in AUTH_EXTRA_ARGUMENTS_OVERRIDE_ALLOWLIST.
• Requests now fall back to a default timeout when no timeout is configured.
• Improved the publishing workflow.

Removed

• Removed obsolete Rdio, Shimmering, and ThisIsMyJam backends.
• Removed legacy OAuth1 backends for Douban and Mendeley.

Security

• Apple ID backend now validates the ID token issuer.
• Azure AD backends now validate ID token signatures, issuer, audience, tenant, and policy claims. Tokens accepted by earlier versions might now be rejected.
• OpenID Connect backends now reject UserInfo responses whose sub does not match the validated ID token subject.

4.8.7

Added

• OpenID Connect backends can now opt in to PKCE support

Changed

... (truncated)

Changelog

Sourced from social-auth-core's changelog.

4.9.1 - 2026-04-30

Changed

• GitHub backend now handles scoped email fetching deterministically.

Fixed

• OpenID Connect missing token handling.
• Microsoft refresh token and expiry handling.
• Partial pipeline handling for Django QueryDict values.

4.9.0 - 2026-04-29

This release might contain breaking changes. Review the removed backends and stricter OAuth, OpenID Connect, and Azure AD validation before upgrading.

Added

• OpenID Connect claim names for email, first name, last name, and full name can now be configured.
• GitHub backend now stores fetched emails in pipeline data.

Changed

• Azure AD backends now use OpenID configuration and JWKS for token validation.
• Built-in provider URLs now consistently use HTTPS.
• AUTH_EXTRA_ARGUMENTS values are no longer overridden by request data unless the key is listed in AUTH_EXTRA_ARGUMENTS_OVERRIDE_ALLOWLIST.
• Requests now fall back to a default timeout when no timeout is configured.
• Improved the publishing workflow.

Removed

• Removed obsolete Rdio, Shimmering, and ThisIsMyJam backends.
• Removed legacy OAuth1 backends for Douban and Mendeley.

Security

• Apple ID backend now validates the ID token issuer.
• Azure AD backends now validate ID token signatures, issuer, audience, tenant, and policy claims. Tokens accepted by earlier versions might now be rejected.
• OpenID Connect backends now reject UserInfo responses whose sub does not match the validated ID token subject.

4.8.7 - 2026-04-23

Added

• OpenID Connect backends can now opt in to PKCE support

... (truncated)

Commits

• 94457d9 chore: release 4.9.1
• 134a325 fix(oidc): validate that tokens are present before using
• 82ca62b fix(microsoft): properly use refresh tokens and expiry
• 905e21f feat(github): improve GitHub mails handling (#1711)
• a492858 fix(utils): better handle mutli value dict
• ec9da89 feat(github): fetch user emails always with email scope
• a42a7a9 chore: release 4.9.0
• 704c977 chore(deps): update actions/download-artifact action to v8 (#1708)
• c0821c7 feat(ci): improve publishing workflow
• 653fab9 chore: fix typo (#1706)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)