fix CVE-2024-33663 and bring in updates for social-auth-app-django (#6634)

requirements/requirements.in

@@ -56,8 +56,8 @@ python-ldap
 pyyaml>=6.0.1
 pyzstd  # otel collector log file compression library
 receptorctl
-social-auth-core[openidconnect]==4.4.2  # see UPGRADE BLOCKERs
-social-auth-app-django==5.4.0  # see UPGRADE BLOCKERs
+social-auth-core == 4.5.4 # hard pinned due to resolver picking CVE version when uncapped
+social-auth-app-django==5.4.2  # see UPGRADE BLOCKERs
 sqlparse>=0.4.4   # Required by django https://github.com/ansible/awx/security/dependabot/96
 redis[hiredis]
 requests

requirements/requirements.txt

@@ -174,8 +174,6 @@ djangorestframework-yaml==2.0.0
     # via -r /awx_devel/requirements/requirements.in
 docutils==0.20.1
     # via python-daemon
-ecdsa==0.18.0
-    # via python-jose
 enum-compat==0.0.3
     # via asn1
 filelock==3.13.1
@@ -372,7 +370,6 @@ ptyprocess==0.7.0
 pyasn1==0.5.1
     # via
     #   pyasn1-modules
-    #   python-jose
     #   python-ldap
     #   rsa
     #   service-identity
@@ -416,8 +413,6 @@ python-dateutil==2.8.2
     #   receptorctl
 python-dsv-sdk==1.0.4
     # via -r /awx_devel/requirements/requirements.in
-python-jose==3.3.0
-    # via social-auth-core
 python-ldap==3.4.4
     # via
     #   -r /awx_devel/requirements/requirements.in
@@ -478,9 +473,7 @@ rpds-py==0.18.0
     #   jsonschema
     #   referencing
 rsa==4.9
-    # via
-    #   google-auth
-    #   python-jose
+    # via google-auth
 s3transfer==0.10.0
     # via boto3
 semantic-version==2.10.0
@@ -496,7 +489,6 @@ six==1.16.0
     #   automat
     #   azure-core
     #   django-pglocks
-    #   ecdsa
     #   isodate
     #   kubernetes
     #   msrestazure
@@ -509,9 +501,9 @@ slack-sdk==3.27.0
     # via -r /awx_devel/requirements/requirements.in
 smmap==5.0.1
     # via gitdb
-social-auth-app-django==5.4.0
+social-auth-app-django==5.4.2
     # via -r /awx_devel/requirements/requirements.in
-social-auth-core[openidconnect]==4.4.2
+social-auth-core==4.5.4
     # via
     #   -r /awx_devel/requirements/requirements.in
     #   social-auth-app-django