CVS commit: pkgsrc/www/py-django-allauth

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Sun Sep 13 07:04:39 UTC 2026

Modified Files:
        pkgsrc/www/py-django-allauth: Makefile distinfo

Log Message:
py-django-allauth: updated to 65.19.3

65.19.3

Fixes

- Account: The email address data migrations (``0006`` and ``0008``) did not
  honor the database selected using ``migrate --database``, potentially querying
  or updating the default database instead. Fixed.

- MFA: Fixed various race conditions involving TOTP and recovery codes.

Security notice

- Headless: When ``HEADLESS_JWT_STATEFUL_VALIDATION_ENABLED`` is on, JWT
  access tokens are now rejected after the password changes outside of the
  allauth password-change flow (for example via ``set_password()`` in a
  shell). Stateful validation now uses the same session auth hash check that
  refresh tokens already used.

- A known flaw in the built-in rate limiting was that the configured limits
  could be exceeded under a high volume of concurrent requests. This was
  documented as an acceptably small margin of error. However, as Kaya Emre Arikan
  (kemrec) demonstrated, the limits could be substantially exceeded under a
  sufficiently high volume of concurrent requests. This is now fixed by
  serializing rate limit updates.


To generate a diff of this commit:
cvs rdiff -u -r1.27 -r1.28 pkgsrc/www/py-django-allauth/Makefile
cvs rdiff -u -r1.22 -r1.23 pkgsrc/www/py-django-allauth/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/py-django-allauth/Makefile
diff -u pkgsrc/www/py-django-allauth/Makefile:1.27 pkgsrc/www/py-django-allauth/Makefile:1.28
--- pkgsrc/www/py-django-allauth/Makefile:1.27  Sun Sep 13 06:51:15 2026
+++ pkgsrc/www/py-django-allauth/Makefile       Sun Sep 13 07:04:39 2026
@@ -1,8 +1,7 @@
-# $NetBSD: Makefile,v 1.27 2026/09/13 06:51:15 wiz Exp $
+# $NetBSD: Makefile,v 1.28 2026/09/13 07:04:39 adam Exp $
 
-DISTNAME=      django_allauth-65.19.2
+DISTNAME=      django_allauth-65.19.3
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME:S/_/-/}
-PKGREVISION=   2
 CATEGORIES=    www python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=d/django-allauth/}
 
@@ -12,7 +11,7 @@ COMMENT=      Authentication, registration, a
 LICENSE=       mit
 
 TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools>=78:../../devel/py-setuptools
-TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools_scm>=0:../../devel/py-setuptools_scm
+TOOL_DEPENDS+= ${PYPKGPREFIX}-setuptools_scm>=8:../../devel/py-setuptools_scm
 DEPENDS+=      ${PYPKGPREFIX}-asgiref>=3.8.1:../../www/py-asgiref
 DEPENDS+=      ${PYPKGPREFIX}-django>=4.2.16:../../www/py-django
 # openid

Index: pkgsrc/www/py-django-allauth/distinfo
diff -u pkgsrc/www/py-django-allauth/distinfo:1.22 pkgsrc/www/py-django-allauth/distinfo:1.23
--- pkgsrc/www/py-django-allauth/distinfo:1.22  Thu Sep  3 09:19:26 2026
+++ pkgsrc/www/py-django-allauth/distinfo       Sun Sep 13 07:04:39 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.22 2026/09/03 09:19:26 adam Exp $
+$NetBSD: distinfo,v 1.23 2026/09/13 07:04:39 adam Exp $
 
-BLAKE2s (django_allauth-65.19.2.tar.gz) = 28d8866b4ec6f0342c18ace50c695ff178adccdb39fb978b76529f5a61e2bc35
-SHA512 (django_allauth-65.19.2.tar.gz) = 56bf5a6bd71db084c3b20ef43b77fb391dc91916d21415445f7cae315ad4c3ec3743b03ffac1a680f6af917037fcb885e34bfca25bcc106ae9d38b73cec13f68
-Size (django_allauth-65.19.2.tar.gz) = 2287928 bytes
+BLAKE2s (django_allauth-65.19.3.tar.gz) = a6904805ba925c27a9759d0e67f4943aa3a6bbad33a4eb1ae606bc5e4f5696e9
+SHA512 (django_allauth-65.19.3.tar.gz) = 01cf55427f0fe001c388f5afe2dc1ef385a70a17c607663cba0063ace1e12791ed8e0e555509ec533dbf5514b87a0212b66843c90ae20b0321c72613dfedc2f4
+Size (django_allauth-65.19.3.tar.gz) = 2291175 bytes