Update social-auth-core requirement from >=3.3.0 to >=5.1.0

[dependabot]

Updates the requirements on social-auth-core to permit the latest version.

Release notes

Sourced from social-auth-core's releases.

5.1.0

Added

• Added a Helmholtz AAI OpenID Connect backend.
• Native applications can allow private-use redirect URI schemes with the ALLOWED_REDIRECT_SCHEMES setting.

Security

• OpenID Connect backends now validate ID tokens returned during token refresh and reject changes to the authenticated identity.

Changed

• Updated development dependencies and CI actions.

Fixed

• Updated the Coinbase backend to use current OAuth endpoints, scopes, API versioning, and token revocation parameters.
• HTTP 403 responses from authentication providers now raise AuthForbidden.
• JWT verification failures are now consistently wrapped in social-core authentication exceptions.

Changelog

Sourced from social-auth-core's changelog.

5.1.0 - 2026-08-06

Added

• Added a Helmholtz AAI OpenID Connect backend.
• Native applications can allow private-use redirect URI schemes with the ALLOWED_REDIRECT_SCHEMES setting.

Security

• OpenID Connect backends now validate ID tokens returned during token refresh and reject changes to the authenticated identity.

Changed

• Updated development dependencies and CI actions.

Fixed

• Updated the Coinbase backend to use current OAuth endpoints, scopes, API versioning, and token revocation parameters.
• HTTP 403 responses from authentication providers now raise AuthForbidden.
• JWT verification failures are now consistently wrapped in social-core authentication exceptions.

5.0.2 - 2026-06-26

Security

• LINE backend now validates callback state before exchanging authorization codes, preventing login CSRF.
• Shopify backend now sends and validates OAuth state, preventing login CSRF.

Changed

• Updated development dependencies and CI actions.

Fixed

• Updated the Google OAuth documentation link.

5.0.1 - 2026-06-24

Security

• Externally resumable partial request links now require confirmation even in the browser session that created the partial, preventing validation links from being consumed by a plain GET.

5.0.0 - 2026-06-23

... (truncated)

Commits

• 8a79067 chore: release 5.1.0
• b62cd4b fix(coinbase): preserve default email access
• d3fc348 fix(coinbase): modernize OAuth integration
• ad115ad fix(deps): update dependency ty to v0.0.69 (#1900)
• 956ffc4 fix(oidc): preserve Ping validation on refresh
• d56fe6d fix(oidc): validate ID tokens on refresh
• e85e73d fix(deps): update dependency ty to v0.0.68 (#1897)
• 830f385 fix(deps): update dependency ty to v0.0.67 (#1896)
• 2f97405 chore(deps): update dependency astral-sh/uv to v0.12.2 (#1895)
• 52e1501 chore(deps): update github/codeql-action digest to 5595cca (#1894)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)