Hello,
[ Reason ]
django-allauth has seen three CVEs reported, of which two I was able to
find in the version released in stable.
I cherry-picked the commits from upstream and built a new version
[ Impact ]
These CVEs are not major, if you believe these changes should not hit
stable it is fine with me.
[ Tests ]
Build and autopkgtest tests do cover the changed code
[ Risks ]
Changes are rather trivial.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
* d/p/0004: fix(saml): prevent open redirect with IdP initiated SSO
(Closes: CVE-2026-27982, #1130044)
This change merely verifies that an url complies with the checks
done with is_safe_url, as defined in the DefaultAdapter in
allauth/account/adapter.py
* d/p/0005: fix(socialaccount): use ``sub`` in Okta/NetIQ
(Closes: CVE-2025-65431; #1123085)
This change moves from a mutable field to a non-mutable one
for the identifier used for the third party account in NetIQ and
Okta, which means that as soon as the user would change their
preferred_username, it would induce the creation of another account
upon relogin.