chore(deps): bump social-auth-core from 4.8.7 to 4.9.1

[dependabot]

Bumps social-auth-core from 4.8.7 to 4.9.1.

Release notes

Sourced from social-auth-core's releases.

4.9.1

Changed

• GitHub backend now handles scoped email fetching deterministically.

Fixed

• OpenID Connect missing token handling.
• Microsoft refresh token and expiry handling.
• Partial pipeline handling for Django QueryDict values.

4.9.0

This release might contain breaking changes. Review the removed backends and stricter OAuth, OpenID Connect, and Azure AD validation before upgrading.

Added

• OpenID Connect claim names for email, first name, last name, and full name can now be configured.
• GitHub backend now stores fetched emails in pipeline data.

Changed

• Azure AD backends now use OpenID configuration and JWKS for token validation.
• Built-in provider URLs now consistently use HTTPS.
• AUTH_EXTRA_ARGUMENTS values are no longer overridden by request data unless the key is listed in AUTH_EXTRA_ARGUMENTS_OVERRIDE_ALLOWLIST.
• Requests now fall back to a default timeout when no timeout is configured.
• Improved the publishing workflow.

Removed

• Removed obsolete Rdio, Shimmering, and ThisIsMyJam backends.
• Removed legacy OAuth1 backends for Douban and Mendeley.

Security

• Apple ID backend now validates the ID token issuer.
• Azure AD backends now validate ID token signatures, issuer, audience, tenant, and policy claims. Tokens accepted by earlier versions might now be rejected.
• OpenID Connect backends now reject UserInfo responses whose sub does not match the validated ID token subject.

Changelog

Sourced from social-auth-core's changelog.

4.9.1 - 2026-04-30

Changed

• GitHub backend now handles scoped email fetching deterministically.

Fixed

• OpenID Connect missing token handling.
• Microsoft refresh token and expiry handling.
• Partial pipeline handling for Django QueryDict values.

4.9.0 - 2026-04-29

This release might contain breaking changes. Review the removed backends and stricter OAuth, OpenID Connect, and Azure AD validation before upgrading.

Added

• OpenID Connect claim names for email, first name, last name, and full name can now be configured.
• GitHub backend now stores fetched emails in pipeline data.

Changed

• Azure AD backends now use OpenID configuration and JWKS for token validation.
• Built-in provider URLs now consistently use HTTPS.
• AUTH_EXTRA_ARGUMENTS values are no longer overridden by request data unless the key is listed in AUTH_EXTRA_ARGUMENTS_OVERRIDE_ALLOWLIST.
• Requests now fall back to a default timeout when no timeout is configured.
• Improved the publishing workflow.

Removed

• Removed obsolete Rdio, Shimmering, and ThisIsMyJam backends.
• Removed legacy OAuth1 backends for Douban and Mendeley.

Security

• Apple ID backend now validates the ID token issuer.
• Azure AD backends now validate ID token signatures, issuer, audience, tenant, and policy claims. Tokens accepted by earlier versions might now be rejected.
• OpenID Connect backends now reject UserInfo responses whose sub does not match the validated ID token subject.

Commits

• 94457d9 chore: release 4.9.1
• 134a325 fix(oidc): validate that tokens are present before using
• 82ca62b fix(microsoft): properly use refresh tokens and expiry
• 905e21f feat(github): improve GitHub mails handling (#1711)
• a492858 fix(utils): better handle mutli value dict
• ec9da89 feat(github): fetch user emails always with email scope
• a42a7a9 chore: release 4.9.0
• 704c977 chore(deps): update actions/download-artifact action to v8 (#1708)
• c0821c7 feat(ci): improve publishing workflow
• 653fab9 chore: fix typo (#1706)
• Additional commits viewable in compare view

[mtesauro]

Looks like this won't be straightforward:

#11 17.42 INFO: pip is looking at multiple versions of social-auth-app-django to determine which version is compatible with other requirements. This could take a while.
#11 17.43 ERROR: Cannot install -r ./requirements.txt (line 44) and social-auth-core==4.9.1 because these package versions have conflicting dependencies.
#11 17.43 
#11 17.43 The conflict is caused by:
#11 17.43     The user requested social-auth-core==4.9.1
#11 17.43     social-auth-app-django 5.8.0 depends on social-auth-core~=4.8.3
#11 17.43 
#11 17.43 Additionally, some packages in these conflicts have no matching distributions available for your environment:
#11 17.43     social-auth-core
#11 17.43 

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

Approved