Bump social-auth-core from 4.9.1 to 5.0.0 in /requirements

[dependabot]

Bumps social-auth-core from 4.9.1 to 5.0.0.

Release notes

Sourced from social-auth-core's releases.

5.0.0

Security

• LoginRadius backend now validates callback state to prevent login CSRF.
• Odnoklassniki app backend now ignores untrusted callback API hosts and validates returned user details.
• Partial pipeline resume now requires session ownership or explicit external resume confirmation to prevent login CSRF.
• SAML responses are now validated against the original AuthnRequest when possible.
• Twilio backend now preserves HTTPS callback URLs and validates callback state to prevent login CSRF.

Fixed

• Auth0 OpenID Connect configuration now uses the correct base URLs.
• Authentication now handles invalid email addresses without crashing.
• Vend OAuth user IDs are now scoped by shop.
• VK app authentication now requires an auth key.

Removed

• Discontinued OAuth backends: AppsFuel, Beats Music, ChangeTip, Clef, Edmodo, 500px (five_hundred_px), legacy Google App Engine bundled Users (gae), Jawbone, Moves, Mozilla Persona, Readability Parser API, and Wunderlist.
• Discontinued Google+ Sign-In backend (google-plus / GooglePlusAuth).

Changelog

Sourced from social-auth-core's changelog.

5.0.0 - 2026-06-23

Security

• LoginRadius backend now validates callback state to prevent login CSRF.
• Odnoklassniki app backend now ignores untrusted callback API hosts and validates returned user details.
• Partial pipeline resume now requires session ownership or explicit external resume confirmation to prevent login CSRF.
• SAML responses are now validated against the original AuthnRequest when possible.
• Twilio backend now preserves HTTPS callback URLs and validates callback state to prevent login CSRF.

Fixed

• Auth0 OpenID Connect configuration now uses the correct base URLs.
• Authentication now handles invalid email addresses without crashing.
• Vend OAuth user IDs are now scoped by shop.
• VK app authentication now requires an auth key.

Removed

• Discontinued OAuth backends: AppsFuel, Beats Music, ChangeTip, Clef, Edmodo, 500px (five_hundred_px), legacy Google App Engine bundled Users (gae), Jawbone, Moves, Mozilla Persona, Readability Parser API, and Wunderlist.
• Discontinued Google+ Sign-In backend (google-plus / GooglePlusAuth).

Commits

• 29dffe6 chore: release 5.0.0
• 2fdbca2 fix(twilio): validate connect callback state
• 0418782 fix!: bind partial pipeline resumes to sessions
• 6fcde2c chore: remove discontinued Google+ Sign-In backend
• f318835 fix(deps): update dependency ty to v0.0.52 (#1814)
• 1bb49c6 fix(deps): update dependency coverage to v7.14.3 (#1813)
• d81bf03 chore(tests): clarify test annotations and expectations (#1812)
• 52471d3 chore(tests): clarify type annotations (#1810)
• 4d33282 fix(backends): LoginRadius backend now validates callback state
• 1bfacdd fix(backends): VKAppOAuth2 now requires auth_key
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.