[binGhzal]

Summary

Upgrade django-allauth[socialaccount] from 65.15.0 to 65.22.1 and lock OAuthLib at 4.0.1. The previous allauth pin requires OAuthLib below 4, so updating the lock alone cannot pick up OAuthLib's published security fixes. The resolver changed only those two dependency versions.

Screenshots

• No UI change (nothing visible is different, so no screenshots needed)

Platforms

Surface	Changed?	Evidence level	Notes
Web	Shared authentication dependencies	3	Targeted backend authentication tests passed.
iOS	Shared authentication dependencies	4	Server tests passed. The native app was not run.
Android	Shared authentication dependencies	4	Server tests passed. The native app was not run.

AI Assistance

Codex with GPT-6 assisted with the dependency resolution, diff review, and local test runs. Validation used Floppy's locked Python environment and Django test runner with a fresh disposable database.

How It Was Tested

• uv lock --check --offline passed.
• uv sync --locked --no-default-groups --group test succeeded.
• FLOPPY_TEST_DB_TEMPLATE=0 scripts/test.sh integrations.tests.test_oauth_views integrations.tests.test_oauth_device_flow config.tests.test_login_required --parallel 1 passed all 85 tests with a synthetic application secret.
• Reviewed the lockfile semantically and ran git diff --check.

Public API & Documentation Handoff

• Not applicable (no API or vocabulary changes)

Human Review & Quality Assurance

• Code review completed
• Visual or manual QA verified (no UI changes)

Database & Migration Safety (Only if modifying models)

• Not applicable (no database changes)

Related Issues

OAuthLib release notes · django-allauth changelog

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-15T15:13:58.452089Z	84d783f	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 76a55af6cc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Remove obsolete OAuthLib audit suppressions

With OAuthLib now locked at the fixed 4.0.1 release, the condition documented by the existing waivers is gone: scripts/audit_dependencies.sh:14-19 explicitly says to remove its two --ignore-vuln exceptions once allauth permits OAuthLib 4, while .trivyignore.yaml:6-15 still describes 3.3.1 as installed and fixed by 4.0.0. Leaving those entries means a later lockfile regression to the vulnerable release would remain invisible to pip-audit indefinitely (and to the container scan until the waiver expires), undermining the security purpose of this update; remove the stale suppressions with the version bump.

Useful? React with 👍 / 👎.