django-forms-workflows 0.77.2__tar.gz → 0.77.4__tar.gz

{django_forms_workflows-0.77.2 → django_forms_workflows-0.77.4}/CHANGELOG.md

@@ -7,6 +7,28 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Security
+- **`social-auth-core` 4.8.3 → 5.1.1 in `poetry.lock`.** Closes five Dependabot
+  advisories against the locked version: GHSA-vqg6-3fw6-j9jg (session fixation),
+  GHSA-3c93-f73f-qc9h (VK App backend accepted unsigned callback data),
+  GHSA-x7qq-23vw-7pfg (login CSRF in the LoginRadius backend),
+  GHSA-fp7w-m676-w7gc (account takeover via identity binding in the Vend backend)
+  and GHSA-vq6g-g6c7-5f2j (improper authentication). `social-auth-app-django`
+  moves 5.7.0 → 6.0.1 (5.x pins `social-auth-core ~=4.8`) and `requests`
+  2.33.0 → 2.34.2 (required by `social-auth-core` 5.x).
+- **`sso` / `all` extras now require `social-auth-app-django >= 6.0` and
+  `social-auth-core >= 5.1.1`**, so `pip install django-forms-workflows[sso]`
+  can no longer resolve to a vulnerable release. `social-auth-app-django` 6.x
+  requires Django 5.2+, which matches the documented minimum; the core package
+  itself still allows Django 5.1.
+
+### Fixed
+- **CI test job on `main` has failed since 59ae737.** `tests/settings.py` lists
+  `tests.ldap_lookup_test_app` in `INSTALLED_APPS`, but the app package was
+  never committed, so every CI run died with
+  `ModuleNotFoundError: No module named 'tests.ldap_lookup_test_app'`. The
+  package is now in the repo.
+
 ## [0.77.0] - 2026-08-17
 
 Some entries below are marked *(shipped in 0.76.x)* — they describe changes that

{django_forms_workflows-0.77.2 → django_forms_workflows-0.77.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: django-forms-workflows
-Version: 0.77.2
+Version: 0.77.4
 Summary: Enterprise-grade, database-driven form builder with approval workflows and external data integration
 License: LGPL-3.0-only
 License-File: LICENSE
@@ -15,6 +15,7 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
 Provides-Extra: all
 Provides-Extra: dev
 Provides-Extra: docs
@@ -55,7 +56,8 @@ Requires-Dist: python3-saml (>=1.16) ; extra == "sso" or extra == "saml" or extr
 Requires-Dist: requests (>=2.31)
 Requires-Dist: ruff (>=0.4) ; extra == "dev"
 Requires-Dist: segno (>=1.6) ; extra == "qr" or extra == "all"
-Requires-Dist: social-auth-app-django (>=5.4) ; extra == "sso" or extra == "all"
+Requires-Dist: social-auth-app-django (>=6.0) ; extra == "sso" or extra == "all"
+Requires-Dist: social-auth-core (>=5.1.1) ; extra == "sso" or extra == "all"
 Requires-Dist: sphinx (>=7.0) ; extra == "docs"
 Requires-Dist: sphinx-autodoc-typehints (>=1.25) ; extra == "docs"
 Requires-Dist: sphinx-rtd-theme (>=2.0) ; extra == "docs"

{django_forms_workflows-0.77.2 → django_forms_workflows-0.77.4}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-forms-workflows"
-version = "0.77.2"
+version = "0.77.4"
 description = "Enterprise-grade, database-driven form builder with approval workflows and external data integration"
 license = "LGPL-3.0-only"
 readme = "README.md"
@@ -34,7 +34,8 @@ python-decouple = ">=3.8"
 requests = ">=2.31"
 
 # Optional SSO dependencies
-social-auth-app-django = { version = ">=5.4", optional = true }
+social-auth-app-django = { version = ">=6.0", optional = true }
+social-auth-core = { version = ">=5.1.1", optional = true }
 python3-saml = { version = ">=1.16", optional = true }
 
 # Optional LDAP dependencies (already supported)
@@ -80,7 +81,7 @@ ruff = { version = ">=0.4", optional = true }
 
 [tool.poetry.extras]
 ldap = ["django-auth-ldap", "python-ldap"]
-sso = ["social-auth-app-django", "python3-saml"]
+sso = ["social-auth-app-django", "social-auth-core", "python3-saml"]
 saml = ["python3-saml"]
 mssql = ["mssql-django", "pyodbc"]
 postgresql = ["psycopg2-binary"]
@@ -94,7 +95,7 @@ picklists = ["django-countries", "django-localflavor"]
 docs = ["sphinx", "sphinx-rtd-theme", "sphinx-autodoc-typehints"]
 all = [
   "django-auth-ldap", "python-ldap",
-  "social-auth-app-django", "python3-saml",
+  "social-auth-app-django", "social-auth-core", "python3-saml",
   "mssql-django", "pyodbc",
   "psycopg2-binary", "mysqlclient",
   "google-auth", "google-api-python-client",