> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/pennersr/django-allauth/llms.txt
> Use this file to discover all available pages before exploring further.

# Changelog

> Version history and release notes for django-allauth

## Latest Version: 65.14.3 (2026-02-13)

<Note>
  💙 **Is django-allauth's authentication the entrance to your business?** Please consider supporting its continued development by becoming a sponsor at [https://allauth.org/sponsors/](https://allauth.org/sponsors/). Your support helps keep this project thriving!
</Note>

### Fixes

* Version 65.14.2 was not compatible with Python 3.8/3.9 due to use of an unsupported typing construct, fixed.

## 65.14.2 (2026-02-13)

<Warning>
  **Security Notice**: Rate limiting and IP address detection

  As Django applications cannot reliably determine client IP addresses out of the box, you must override `get_client_ip()` to match your deployment architecture. If you omitted to do so, the default implementation trusted `X-Forwarded-For`, which can be spoofed to bypass rate limits. Now, `X-Forwarded-For` is distrusted by default. You must either:

  * Configure `ALLAUTH_TRUSTED_PROXY_COUNT`
  * Rely on `ALLAUTH_TRUSTED_CLIENT_IP_HEADER`
  * Override `get_client_ip()`

  Thanks to Ayato Shitomi for reporting.
</Warning>

## 65.14.1 (2026-02-07)

### Fixes

* When using `ACCOUNT_CHANGE_EMAIL = True`, if the user initiating the change email process had no verified email address, `user.email` would still reflect the old email address while the verification process was pending.

<Warning>
  **Security Notice**: SAML RelayState vulnerability

  When IdP initiated SSO was enabled (it is by default disabled), any URL found in the SAML `RelayState` parameter would be used to redirect to, potentially redirecting the authenticated user to a wrong site. Thanks to Ayato Shitomi and Funabiki Keisuke for reporting.
</Warning>

## 65.14.0 (2026-01-17)

### Notable Changes

* **Steam**: The provider now supports initiating headless logins per redirect
* **Shopify**: If `email_verified` is present in the user payload, it will be used to mark the email address retrieved as verified accordingly
* **IdP**: Added support for JWT based access tokens (see `IDP_OIDC_ACCESS_TOKEN_FORMAT`)
* **IdP**: Added support for pointing to a custom userinfo endpoint (see `IDP_OIDC_USERINFO_ENDPOINT`)
* **OpenID Connect**: You can now configure the field to be used as the account ID by setting `"uid_field"` in the relevant `SocialApp.settings`
* **Headless**: The JWT algorithm is now configurable, supporting HS256

### Fixes

* IdP: Access tokens without a user attached (client credentials) were no longer recognized in DRF/Ninja endpoints
* `requests` sessions are now disposed of after use to avoid resource leaks

## 65.13.1 (2025-11-20)

### Notable Changes

* Django 6.0 is now officially supported

### Fixes

* Internal imports related to headless token strategies were causing (harmless) deprecation warnings, fixed

## Version History

For the complete version history, please visit the [ChangeLog.rst](https://codeberg.org/allauth/django-allauth/src/branch/main/ChangeLog.rst) file in the source repository.

## How to Read This Changelog

Each release includes:

* **Notable Changes**: New features and enhancements
* **Fixes**: Bug fixes and issue resolutions
* **Security Notices**: Critical security updates (marked with warning boxes)
* **Breaking Changes**: Changes that may require code updates (see [Breaking Changes](/migration/breaking-changes))

<Tip>
  Subscribe to release notifications on [GitHub](https://github.com/pennersr/django-allauth) to stay updated with the latest changes.
</Tip>

## Release Frequency

Django Allauth follows semantic versioning and releases updates regularly:

* **Major versions**: Breaking changes and significant new features
* **Minor versions**: New features and enhancements
* **Patch versions**: Bug fixes and security updates

## Next Steps

<CardGroup cols={2}>
  <Card title="Upgrade Guide" icon="arrow-up" href="/migration/upgrade-guide">
    Learn how to upgrade to the latest version
  </Card>

  <Card title="Breaking Changes" icon="triangle-exclamation" href="/migration/breaking-changes">
    Review breaking changes between versions
  </Card>
</CardGroup>