[deps] Update django-allauth requirement from ~=0.54.0 to ~=64.1.0 #403

dependabot · 2024-08-19T18:46:35Z

Updates the requirements on django-allauth to permit the latest version.

Changelog

Sourced from django-allauth's changelog.

64.1.0 (2024-08-15)

Note worthy changes

Headless: When trying to login while a user is already logged in, you now get a 409.

Limited the maximum allowed time for a login to go through the various login stages. This limits, for example, the time span that the 2FA stage remains available. See settings.ACCOUNT_LOGIN_TIMEOUT.

Security notice

Headless: When a user was not fully logged in, for example, because (s)he was in the process of completing the 2FA process, calling logout would not wipe the session containing the partially logged in user.

64.0.0 (2024-07-31)

Note worthy changes

The 0.x.y version numbers really did not do justice to the state of the project, and we are way past the point where a version 1.0 would be applicable. Additionally, 64 is a nice round number. Therefore, the version numbering is changed from 0.x.y to x.y.z. We will use a loose form of semantic versioning. However, please be aware that feature releases may occasionally include minor documented backwards incompatibilities. Always read the release notes before upgrading.

Added support for WebAuthn based security keys and passkey login. Note that this is currently disabled by default.

Headless: The TOTP URI is now available in the MFA activation response.

Headless: When trying to sign up while a user is already logged in, you now get a 409.

Headless: You can now alter the user data payload by overriding the newly introduced serialize_user() adapter method.

Headless: The token strategy now allows for exposing refresh tokens and any other information you may need (such as e.g. expires_in).

... (truncated)

Commits

d6e07b2 feat: Django 5.1
b7eaefd chore: Release 64.1.0
4b13c66 feat(mfa): AuthenticateView to use form class from setting
bd3ae52 chore(i18n): Sync translations
63bc165 feat(account): Login timeout
4303cbe fix(headless): Logout should remove partial login
20d1334 chore(mfa): add tags to submit button
c970b33 tests(socialaccount): Test storing tokens vs email authentication
907ffe6 chore(i18n): korean translations
ef8743c fix(socialaccount): OAuth 1.0 vs storing tokens without app instance
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Blockers

[chores] Added CSS for djang-allauth forms submit button openwisp-utils#407

nemesifier

@pandafy can you add an OR run tests without the parallel flag to the test line? I am still not sure why some times errors are shown correctly even in parallel mode and some times not.

Updates the requirements on [django-allauth](https://github.com/pennersr/django-allauth) to permit the latest version. - [Changelog](https://github.com/pennersr/django-allauth/blob/main/ChangeLog.rst) - [Commits](pennersr/django-allauth@0.54.0...64.1.0) --- updated-dependencies: - dependency-name: django-allauth dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

django-allauth>0.63.6 dropped support for Django 3.2

coveralls · 2024-08-20T19:25:22Z

coverage: 97.787% (+0.003%) from 97.784%
when pulling b103de7 on dependabot/pip/django-allauth-approx-eq-64.1.0
into d4d90b6 on master.

pandafy · 2024-08-20T20:18:37Z

openwisp_users/tests/test_api/test_api.py

-        data = {'email': '[email protected]', 'primary': True}
-        with self.assertNumQueries(7):
+        data = {'email': '[email protected]'}
+        expected_queries = 7 if django.VERSION < (4, 0) else 9


The extra queries are added because of validation of constraints.

pandafy · 2024-08-20T20:20:14Z

requirements.txt

@@ -1,6 +1,6 @@
 django-organizations~=2.4.1
 django-extensions~=3.2.3
-django-allauth~=0.54.0
+django-allauth~=0.63.6


>=64 drops support for Django 3.2

pandafy · 2024-08-21T10:53:44Z

tests/openwisp2/settings.py

@@ -67,6 +67,7 @@
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
+    'allauth.account.middleware.AccountMiddleware',


We will need to port this change to ansible-openwisp2 after merging this PR.

pandafy · 2024-08-21T13:11:04Z

@nemesifier there are two UI changes in the new version of django-allauth:

The new version adds help text to the new password field in password change/reset form. The help text shows requirements from the password validators.

It also adds password reset URL in help text for password field in the login form.

Shall we hide this URL? Or, shall we remove the button?

nemesifier

@nemesifier there are two UI changes in the new version of django-allauth:

The new version adds help text to the new password field in password change/reset form. The help text shows requirements from the password validators.

I would adjust text size and spacing here: the text size could be consistent with the rest of the page and there shouldn't be as much space below.

It also adds password reset URL in help text for password field in the login form. Shall we hide this URL? Or, shall we remove the button?

I think we can hide it since it's redundant with the button below.

nemesifier

LGTM. Please remember to send a PR to pin openwisp-utils.

pandafy · 2024-08-21T18:08:35Z

I have made it consistent with the password change page of the Django admin.

Left window: Password change page of allauth.accounts in local environment
Right window: Password change page of Django admin in demo.openwisp.io

pandafy · 2024-08-21T18:10:42Z

The "Forgot password" URL is hidden in the login form now

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 19, 2024

dependabot bot mentioned this pull request Aug 19, 2024

[deps] Update django-allauth requirement from ~=0.54.0 to ~=64.0.0 #397

Closed

nemesifier reviewed Aug 20, 2024

View reviewed changes

pandafy force-pushed the dependabot/pip/django-allauth-approx-eq-64.1.0 branch from a759675 to a8f5e98 Compare August 20, 2024 18:28

dependabot bot and others added 2 commits August 21, 2024 00:44

[ci] Run test without parallel when test suite fails

6f21a1d

pandafy force-pushed the dependabot/pip/django-allauth-approx-eq-64.1.0 branch from 7ab5aaf to c748586 Compare August 20, 2024 19:15

pandafy added 2 commits August 21, 2024 00:48

[tests] Fixed tests

2574dc3

[deps] Bumped django-allauth~=0.63.6

9cfdf85

django-allauth>0.63.6 dropped support for Django 3.2

pandafy force-pushed the dependabot/pip/django-allauth-approx-eq-64.1.0 branch from c748586 to 9cfdf85 Compare August 20, 2024 19:20

pandafy reviewed Aug 20, 2024

View reviewed changes

pandafy reviewed Aug 21, 2024

View reviewed changes

pandafy mentioned this pull request Aug 21, 2024

[chores] Added allauth.account.middleware.AccountMiddleware openwisp/ansible-openwisp2#487

Merged

5 tasks

[chores] Fixed allauth template heirarchy

291839d

nemesifier reviewed Aug 21, 2024

View reviewed changes

nemesifier mentioned this pull request Aug 21, 2024

[feature] Device mechanism to define default settings openwisp/openwisp-utils#408

Open

nemesifier previously approved these changes Aug 21, 2024

View reviewed changes

[req-changes] Fixed CSS

b103de7

pandafy dismissed nemesifier’s stale review via b103de7 August 21, 2024 18:09

nemesifier approved these changes Aug 23, 2024

View reviewed changes

nemesifier merged commit 17a6f00 into master Aug 23, 2024
15 checks passed

nemesifier deleted the dependabot/pip/django-allauth-approx-eq-64.1.0 branch August 23, 2024 14:30

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[deps] Update django-allauth requirement from ~=0.54.0 to ~=64.1.0 #403

[deps] Update django-allauth requirement from ~=0.54.0 to ~=64.1.0 #403

dependabot bot commented on behalf of github Aug 19, 2024 •

edited by pandafy

Loading

nemesifier left a comment

coveralls commented Aug 20, 2024 •

edited

Loading

pandafy Aug 20, 2024

pandafy Aug 20, 2024 •

edited

Loading

pandafy Aug 21, 2024

pandafy commented Aug 21, 2024

nemesifier left a comment

nemesifier left a comment

pandafy commented Aug 21, 2024

pandafy commented Aug 21, 2024

[deps] Update django-allauth requirement from ~=0.54.0 to ~=64.1.0 #403

[deps] Update django-allauth requirement from ~=0.54.0 to ~=64.1.0 #403

Conversation

dependabot bot commented on behalf of github Aug 19, 2024 • edited by pandafy Loading

Note worthy changes

Security notice

Note worthy changes

nemesifier left a comment

Choose a reason for hiding this comment

coveralls commented Aug 20, 2024 • edited Loading

pandafy Aug 20, 2024

Choose a reason for hiding this comment

pandafy Aug 20, 2024 • edited Loading

Choose a reason for hiding this comment

pandafy Aug 21, 2024

Choose a reason for hiding this comment

pandafy commented Aug 21, 2024

nemesifier left a comment

Choose a reason for hiding this comment

nemesifier left a comment

Choose a reason for hiding this comment

pandafy commented Aug 21, 2024

pandafy commented Aug 21, 2024

dependabot bot commented on behalf of github Aug 19, 2024 •

edited by pandafy

Loading

coveralls commented Aug 20, 2024 •

edited

Loading

pandafy Aug 20, 2024 •

edited

Loading