python-social-auth/social-app-django 7.2.0 on GitHub

Consolidate the Django threat model around integration security boundaries,
linking deployment and configuration guidance to the
project documentation.
Resolve sign-in labels through the strategy-aware backend get_title()
method when available, including Hosted Weblate and custom Weblate issuers.

Require launch bridge redirect targets and application launch Referer headers to
match allowed hosts exactly, including explicit ports.
Preserve request and provider dictionaries resembling model references when
resuming partial pipelines. New saved values distinguish model references
from ordinary data while retaining support for existing partials. Deploy
all workers together; older versions cannot read the new encoded values.
Treat authenticated launch-bridge redirect targets as literal URLs, fixing
errors for relative targets and unintended resolution as URL pattern names.
Validate provider session expiry before logging in so invalid expiry data
cannot leave an authenticated session after an error redirect or bypass
SOCIAL_AUTH_MAX_SESSION_LENGTH.
Do not count associations for association-only backends, which cannot log a
user in, as a remaining login method when disconnecting.
Repair historical Twitch OpenID Connect identifier labels in a new migration,
restoring login for accounts affected by the 7.1.0 backfill. Historical
SOCIAL_AUTH_OLD_ID_KEYS overrides take precedence over backend detection;
review any user accounts orphaned by earlier failed logins separately.
Treat association ID 0 as a specific ID when disconnecting, preventing
accidental removal of all associations for the backend.
Handle reused Discourse callbacks and missing nonces through the configured
authentication error page or redirect instead of returning HTTP 500.

Atomically claim OAuth2 transaction state through the existing Nonce model,
preventing simultaneous callbacks from consuming the same state. Expired
claims are removed by clearsocial, which now applies its --age retention
limit to all stored nonces using an indexed timestamp.
Retain original exception tracebacks in server logs when authentication 5xx
failures are handled through an error redirect.
Prevent passwordless users from disconnecting their last association backed
by a configured authentication backend when only stale provider rows remain.
Reject authentication callbacks when their authenticated cookie session
belongs to a different user than the restored flow session, preventing a
provider identity from being associated with the wrong local account.
Require CSRF-protected POST requests for e-mail and username login forms
submitted to social:complete, preventing cross-site requests from starting
an association flow for the signed-in user.
Document the integration's security boundaries, assumptions, downstream
responsibilities, and triage dispositions in the
threat model.