Fix: handle allauth groups location breaking change (#11471)

.devcontainer/Dockerfile

@@ -8,14 +8,17 @@ ARG DEBIAN_FRONTEND=noninteractive
 ARG TARGETARCH
 
 # Can be workflow provided, defaults set for manual building
-ARG JBIG2ENC_VERSION=0.29
+ARG JBIG2ENC_VERSION=0.30
 
 # Set Python environment variables
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     # Ignore warning from Whitenoise
     PYTHONWARNINGS="ignore:::django.http.response:517" \
-    PNGX_CONTAINERIZED=1
+    PNGX_CONTAINERIZED=1 \
+    # https://docs.astral.sh/uv/reference/settings/#link-mode
+    UV_LINK_MODE=copy \
+    UV_CACHE_DIR=/cache/uv/
 
 #
 # Begin installation and configuration
@@ -81,7 +84,7 @@ RUN set -eux \
     && apt-get update \
     && apt-get install --yes --quiet ${PYTHON_PACKAGES}
 
-COPY --from=ghcr.io/astral-sh/uv:0.7.8 /uv /bin/uv
+COPY --from=ghcr.io/astral-sh/uv:0.9.10 /uv /bin/uv
 
 
 RUN set -eux \
@@ -103,6 +106,7 @@ COPY [ \
 
 RUN set -eux \
   && echo "Configuring ImageMagick" \
+    && mkdir -p /etc/ImageMagick-6 \
     && mv paperless-policy.xml /etc/ImageMagick-6/policy.xml
 
 
@@ -118,7 +122,7 @@ ARG BUILD_PACKAGES="\
   pkg-config"
 
 # hadolint ignore=DL3042
-RUN --mount=type=cache,target=/root/.cache/uv,id=pip-cache \
+RUN --mount=type=cache,target=/cache/uv/,id=uv-cache \
   set -eux \
   && echo "Installing build system packages" \
     && apt-get update \

src/paperless/signals.py

@@ -38,10 +38,19 @@ def handle_social_account_updated(sender, request, sociallogin, **kwargs):
     """
     from django.contrib.auth.models import Group
 
-    social_account_groups = sociallogin.account.extra_data.get(
+    extra_data = sociallogin.account.extra_data or {}
+    social_account_groups = extra_data.get(
         "groups",
         [],
-    )  # None if not found
+    )  # pre-allauth 65.11.0 structure
+
+    if not social_account_groups:
+        # allauth 65.11.0+ nests claims under `userinfo`/`id_token`
+        social_account_groups = (
+            extra_data.get("userinfo", {}).get("groups")
+            or extra_data.get("id_token", {}).get("groups")
+            or []
+        )
     if settings.SOCIAL_ACCOUNT_SYNC_GROUPS and social_account_groups is not None:
         groups = Group.objects.filter(name__in=social_account_groups)
         logger.debug(

src/paperless/tests/test_signals.py

@@ -192,6 +192,68 @@ class TestSyncSocialLoginGroups(TestCase):
         )
         self.assertEqual(list(user.groups.all()), [])
 
+    @override_settings(SOCIAL_ACCOUNT_SYNC_GROUPS=True)
+    def test_userinfo_groups(self):
+        """
+        GIVEN:
+            - Enabled group syncing, and `groups` nested under `userinfo`
+        WHEN:
+            - The social login is updated via signal after login
+        THEN:
+            - The user's groups are updated using `userinfo.groups`
+        """
+        group = Group.objects.create(name="group1")
+        user = User.objects.create_user(username="testuser")
+        sociallogin = Mock(
+            user=user,
+            account=Mock(
+                extra_data={
+                    "userinfo": {
+                        "groups": ["group1"],
+                    },
+                },
+            ),
+        )
+
+        handle_social_account_updated(
+            sender=None,
+            request=HttpRequest(),
+            sociallogin=sociallogin,
+        )
+
+        self.assertEqual(list(user.groups.all()), [group])
+
+    @override_settings(SOCIAL_ACCOUNT_SYNC_GROUPS=True)
+    def test_id_token_groups_fallback(self):
+        """
+        GIVEN:
+            - Enabled group syncing, and `groups` only under `id_token`
+        WHEN:
+            - The social login is updated via signal after login
+        THEN:
+            - The user's groups are updated using `id_token.groups`
+        """
+        group = Group.objects.create(name="group1")
+        user = User.objects.create_user(username="testuser")
+        sociallogin = Mock(
+            user=user,
+            account=Mock(
+                extra_data={
+                    "id_token": {
+                        "groups": ["group1"],
+                    },
+                },
+            ),
+        )
+
+        handle_social_account_updated(
+            sender=None,
+            request=HttpRequest(),
+            sociallogin=sociallogin,
+        )
+
+        self.assertEqual(list(user.groups.all()), [group])
+
 
 class TestUserGroupDeletionCleanup(TestCase):
     """

uv.lock

@@ -4062,11 +4062,11 @@ wheels = [
 
 [[package]]
 name = "types-python-dateutil"
-version = "2.9.0.20251115"
+version = "2.9.0.20250822"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6a/36/06d01fb52c0d57e9ad0c237654990920fa41195e4b3d640830dabf9eeb2f/types_python_dateutil-2.9.0.20251115.tar.gz", hash = "sha256:8a47f2c3920f52a994056b8786309b43143faa5a64d4cbb2722d6addabdf1a58", size = 16363, upload-time = "2025-11-15T03:00:13.717Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0c/0a/775f8551665992204c756be326f3575abba58c4a3a52eef9909ef4536428/types_python_dateutil-2.9.0.20250822.tar.gz", hash = "sha256:84c92c34bd8e68b117bff742bc00b692a1e8531262d4507b33afcc9f7716cd53", size = 16084, upload-time = "2025-08-22T03:02:00.613Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/43/0b/56961d3ba517ed0df9b3a27bfda6514f3d01b28d499d1bce9068cfe4edd1/types_python_dateutil-2.9.0.20251115-py3-none-any.whl", hash = "sha256:9cf9c1c582019753b8639a081deefd7e044b9fa36bd8217f565c6c4e36ee0624", size = 18251, upload-time = "2025-11-15T03:00:12.317Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/d9/a29dfa84363e88b053bf85a8b7f212a04f0d7343a4d24933baa45c06e08b/types_python_dateutil-2.9.0.20250822-py3-none-any.whl", hash = "sha256:849d52b737e10a6dc6621d2bd7940ec7c65fcb69e6aa2882acf4e56b2b508ddc", size = 17892, upload-time = "2025-08-22T03:01:59.436Z" },
 ]
 
 [[package]]