[dependabot]

Bumps django from 5.2.17 to 6.1.2.

Commits

• 2212534 [6.1.x] Bumped version for 6.1.2 release.
• 75d401a [6.1.x] Refs CVE-2026-15830 -- Fixed WKB geometry collection limit bypasses.
• cce6c57 [6.1.x] Fixed CVE-2026-87975 -- Prevented forging actions in model formsets w...
• 4e77ef1 [6.1.x] Fixed CVE-2026-87890 -- Blocked bytes in spatial lookups.
• de56dee [6.1.x] Fixed CVE-2026-84429 -- Simplified parse_header_parameters by leverag...
• 7e878b0 [6.1.x] Fixed CVE-2026-77050 -- Prevented memory exhaustion in get_supported_...
• d8cf296 [6.1.x] Fixed #37322 -- Avoided transforms on spatial fields with srid=None.
• 71084d6 [6.1.x] Fixed #37377 -- Fixed JSONField __in crash/wrong result for Value() p...
• e34d776 [6.1.x] Fixed #37386 -- Observed delete_confirmation_max_display=0 for inlines.
• 25872ef [6.1.x] Fixed #37361 -- Fixed permission renames for chained RenameModel oper...
• Additional commits viewable in compare view

[Maffooch]

Adversarial review: chore(deps): bump django from 5.2.17 to 6.1.2

Verdict: request-changes
Reviewed at: 0eee88f Profile: dependency-bump
Repo rules followed: origin/dev .claude/skills/review-pr/SKILL.md and .claude/skills/defectdojo-dev/SKILL.md, plus the generic review-pr skill

Attempts to break it

1. Required CI on the head SHA. Build Docker Images (django, alpine, linux/amd64) failed in run 38779704628 with ResolutionImpossible, so Unit Tests Complete (required) is red and no test job ran (test-rest-framework, test-user-interface, test-k8s, test-performance all SKIPPED). Base is green: merge-group runs 38977320550 and 38974364031 on dev succeeded. Blocker.
2. Reproduced the resolver failure locally with uv pip compile --python-version 3.14 on the Django-family pins. origin/dev resolves. The PR head fails with: django-prometheus==2.5.0 requires django>=5.1,<6.1, and you require django==6.1.2. Blocker.
3. Is there a django-prometheus release that allows 6.1? PyPI shows 2.5.0 is the latest, and its requires_dist is still Django!=5.0.*,<6.1,>=4.2. No upgrade path exists today. django-prometheus is wired into INSTALLED_APPS, middleware and the DB engine wrapper (dojo/settings/settings.dist.py:1139-1146) and dojo/urls.py:277, so it cannot just be dropped. Blocker (upstream).
4. Removed the django-prometheus pin and re-ran the full requirements.txt resolve for linux/py3.14. It resolves to django==6.1.2, so prometheus is the only hard install blocker. Several other pins resolve but do not advertise Django 6.x support in their PyPI classifiers: django-auditlog 3.2.1 (latest 3.4.1, classifiers stop at 5.2), django_celery_results 2.6.0, django-extensions 4.1, django-crum 0.7.9, django-single-session 0.2.0, plus django-imagekit, django-watson and django-ratelimit with no classifiers. Runtime risk, untested. No break proven; follow-up risk.
5. Hands-on import under 6.1.2: built a venv with the resolved set plus django-prometheus==2.5.0 --no-deps, ran manage.py check and manage.py makemigrations --check --dry-run. Both pass ("No changes detected"); DEFAULT_AUTO_FIELD is pinned to AutoField at dojo/settings/settings.dist.py:478, so the 6.0 default change causes no drift. Django 6.1 emits RemovedInDjango2028Warning for every EMAIL_* setting (migrate to MAILERS). No break.
6. Call sites of APIs removed in 6.0: grepped for format_html without args, ArrayAgg/StringAgg ordering=, CheckConstraint(check=, assertQuerysetEqual, get_joining_columns, positional save() flags. No hits. FORMS_URLFIELD_ASSUME_HTTPS = True at dojo/settings/settings.dist.py:2308 is now an inert removed setting (6.0 defaults to https anyway). No break; nit.
7. Diff scope and security direction. The diff is one line, requirements.txt:24, as claimed. The CVEs listed in the PR body (CVE-2026-77050, -84429, -87890, -87975) are also fixed in Django 5.2.18 (release notes docs/releases/5.2.18.txt, published 2026-10-06), so the security fixes do not require the major bump. No break.

Blocking

• requirements.txt:23-24 Django==6.1.2 is unsatisfiable with django-prometheus==2.5.0 (<6.1), the latest release. The Docker build fails and required Unit Tests Complete is red because of this PR.

Nice to have

• Take the CVE fixes now via Django 5.2.18 (separate PR), and close or hold this one until django-prometheus ships a release that allows 6.1.
• When the major bump is retried: remove FORMS_URLFIELD_ASSUME_HTTPS and its warning filter (dojo/settings/settings.dist.py:2302-2308), plan the EMAIL_* to MAILERS migration, and confirm 6.x support for django-auditlog, django_celery_results, django-extensions, django-crum and django-single-session.
• Consider a Dependabot ignore for Django major versions until the plugin set catches up, so this PR does not keep reopening.

Verified hands-on

• Resolver failure reproduced locally (uv, py3.14) on the PR head; base resolves.
• manage.py check and makemigrations --check --dry-run under Django 6.1.2 (prometheus forced with --no-deps).

Checked only statically

• PyPI metadata for every Django-family pin; grep for 6.0-removed APIs.

Still needs verification

• Full unit suite, REST framework tests, spectacular --fail-on-warn and UI tests under Django 6.x. CI never ran them and I did not run them, since the image cannot be built from this requirements.txt.