chore(deps): bump the major-updates group across 1 directory with 6 updates

[dependabot]

Bumps the major-updates group with 6 updates in the / directory:

Package	From	To
django	5.2.16	5.2.17
django-health-check	3.20.8	4.5.1
django-filter	25.2	26.1
django-grappelli	4.0.3	5.0.0
gunicorn	23.0.0	26.2.0
django-debug-toolbar	5.2.0	7.1.1

Updates django from 5.2.16 to 5.2.17

Commits

• e802ada [5.2.x] Bumped version for 5.2.17 release.
• b9adb81 [5.2.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
• ba80833 [5.2.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
• c72a5db [5.2.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
• 115ffd0 [5.2.x] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial l...
• ec5ced4 [5.2.x] Fixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs.
• 02369b5 [5.2.x] Allowed the full Python test matrix to run on GitHub Actions.
• 686072f [5.2.x] Added stub release notes and release date for 5.2.17.
• cd5ad8c [5.2.x] Bumped minimum setuptools version to 83.
• 3e389b7 [5.2.x] Closed temporary files in GDALRasterTests.
• Additional commits viewable in compare view

Updates django-health-check from 3.20.8 to 4.5.1

Release notes

Sourced from django-health-check's releases.

4.5.1

What's Changed

• Document that the health_check URL pattern requires a name by @​codingjoe in codingjoe/django-health-check#764
• Rewrite documentation in simplified English by @​codingjoe in codingjoe/django-health-check#765
• Fix CI by managing integration services with testcontainers by @​codingjoe in codingjoe/django-health-check#766

Full Changelog: codingjoe/django-health-check@4.5.0...4.5.1

4.5.0

What's Changed

• Fix #758 -- Support Django 6.1 MAILERS setting in Mail health check by @​codingjoe in codingjoe/django-health-check#759

Full Changelog: codingjoe/django-health-check@4.4.4...4.5.0

4.4.4

What's Changed

• Fix #743 -- Add redis label to JSON views by @​codingjoe in codingjoe/django-health-check#753

Full Changelog: codingjoe/django-health-check@4.4.3...4.4.4

4.4.3

What's Changed

• Fix #742 -- Remove blank lines in OpenMetrics output by @​pfcodes in codingjoe/django-health-check#741

New Contributors

• @​pfcodes made their first contribution in codingjoe/django-health-check#741

Full Changelog: codingjoe/django-health-check@4.4.2...4.4.3

4.4.2

What's Changed

• Add sponsors to readme

Full Changelog: codingjoe/django-health-check@4.4.1...4.4.2

4.4.1

What's Changed

• Update deprecated redis_url test case by @​M-Hassan-Raza in codingjoe/django-health-check#726
• Add atlassian extra depnency test group by @​codingjoe in codingjoe/django-health-check#732
• Fix Atlassian incident checks by @​M-Hassan-Raza in codingjoe/django-health-check#731

... (truncated)

Commits

• 0de6650 Fix CI by managing integration services with testcontainers (#766)
• 3408809 Rewrite documentation in Simplified English (#765)
• 8d0e3dc Fix #760 -- Document that the health_check URL pattern requires a name
• 918881b [pre-commit.ci] pre-commit autoupdate
• fa6f5c0 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 34839b7 [pre-commit.ci] pre-commit autoupdate
• 2181b6f Fix #758 -- Support Django 6.1 MAILERS setting in Mail health check (#759)
• b71b988 [pre-commit.ci] pre-commit autoupdate
• 1e09a5a Fix #743 -- Add redis label to JSON views
• bbe3826 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates django-filter from 25.2 to 26.1

Changelog

Sourced from django-filter's changelog.

Version 26.1 (2026-07-11)

• Added testing for Django 6.1.

  DRF integration will require the upcoming DRF v3.18. See encode/django-rest-framework#9978

• Added testing against Python 3.14.

Commits

• 52c3c0f Set date and bump version for 26.1 release.
• 6a3222a Add testing for Python 3.14.
• aa3bd8e Added testing against Django 6.1
• ec717ea Correct Language header in Greek locale file (el) (#1751)
• 31b297c Bump the github-actions group with 2 updates (#1733)
• 590c0a3 Fix version range for Django 6.0 (#1731)
• 6204bc4 Added release date for v25.2.
• See full diff in compare view

Updates django-grappelli from 4.0.3 to 5.0.0

Changelog

Sourced from django-grappelli's changelog.

5.0.0 (April 29th, 2026)

• Compatibility with Django 6.x

4.0.5 (not yet released)

4.0.4 (April 28th, 2026)

• Improved: raised margins within radiolists
• Improved: layout for multiple inputs in related widget
• Improved: layout for related widget display in change list

Commits

• 98c98e7 docs for upcoming release (5.0.0)
• fa9fdbd fix with dashboard modules
• fd0552f Merge branch 'master' into stable/5.0.x
• be75293 docs for upcoming release (4.0.4)
• dec6e41 apply label styles to legends in grp-rows, #1077
• 0208cce hide datetime inline labels, #1077
• 84d070b improving layout for related widget display in change list, related to #1072
• 9e52129 improving layout for multiple inputs in related widget, #1072
• 6622c4b improving layout for related widget display in change list, related to #1072
• 1edb009 improving layout for multiple inputs in related widget, #1072
• Additional commits viewable in compare view

Updates gunicorn from 23.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates django-debug-toolbar from 5.2.0 to 7.1.1

Release notes

Sourced from django-debug-toolbar's releases.

7.1.1

Changelog

• Serialize TaskResult in the Tasks panel to accommodate the storage mechanism.
• Removed whitespace on Task panel’s kwargs column.

What's Changed

• Serialize the TaskResult class for Tasks panel. by @​tim-schilling in django-commons/django-debug-toolbar#2444

Full Changelog: django-commons/django-debug-toolbar@7.1.0...7.1.1

7.1.0

Changelog

• Added a Tasks panel that shows tasks queued during the request via Django’s built-in tasks framework (django.tasks, Django 6.0+). On older versions of Django, the panel explains that upgrading is required.
• Fixed the Django version check in the SQL panel test suite for Django’s boolean parameter handling.
• Fixed show_toolbar_with_docker on Docker runtimes such as OrbStack that can resolve host.docker.internal to an address outside the container network.
• Restored the select and explain buttons for queries that run without parameters.
• Fixed the error shown when panel content fails to load, which could not find the toolbar window inside the shadow root.
• Stopped the history panel buttons from submitting their form when clicked before the panel script has loaded, which navigated away from the page.
• Added support for Django 6.1.

What's Changed

• Fix the Django version check in the SQL panel by @​matthiask in django-commons/django-debug-toolbar#2403
• fix some small issues in docs/installation.rst by @​leggewie in django-commons/django-debug-toolbar#2409
• Silence the MiddlewareMixin deprecation warning explicitly by @​matthiask in django-commons/django-debug-toolbar#2416
• Add Tasks panel showing tasks queued during the request by @​onxxdatas in django-commons/django-debug-toolbar#2407
• Fix integration tests by @​novucs in django-commons/django-debug-toolbar#2434
• Add support for Django 6.1 by @​ulgens in django-commons/django-debug-toolbar#2435
• Fix show_toolbar_with_docker on runtimes with unrelated host address by @​Sanjays2402 in django-commons/django-debug-toolbar#2422
• Improve selenium tests reliability in CI by @​tim-schilling in django-commons/django-debug-toolbar#2438

New Contributors

• @​leggewie made their first contribution in django-commons/django-debug-toolbar#2409
• @​onxxdatas made their first contribution in django-commons/django-debug-toolbar#2407
• @​novucs made their first contribution in django-commons/django-debug-toolbar#2434
• @​Sanjays2402 made their first contribution in django-commons/django-debug-toolbar#2422

Full Changelog: django-commons/django-debug-toolbar@7.0.0...7.1.0

7.0.0

This release features a change to use the shadow DOM. If a project is customizing the Django Debug Toolbar theme via variables a change will be required.

Changelog

... (truncated)

Changelog

Sourced from django-debug-toolbar's changelog.

7.1.1 (2026-08-14)

• Serialize TaskResult in the Tasks panel to accommodate the storage mechanism.
• Removed whitespace on Task panel's kwargs column.

7.1.0 (2026-08-10)

• Added a Tasks panel that shows tasks queued during the request via Django's built-in tasks framework (django.tasks, Django 6.0+). On older versions of Django, the panel explains that upgrading is required.
• Fixed the Django version check in the SQL panel test suite for Django's boolean parameter handling.
• Fixed show_toolbar_with_docker on Docker runtimes such as OrbStack that can resolve host.docker.internal to an address outside the container network.
• Restored the select and explain buttons for queries that run without parameters.
• Fixed the error shown when panel content fails to load, which could not find the toolbar window inside the shadow root.
• Stopped the history panel buttons from submitting their form when clicked before the panel script has loaded, which navigated away from the page.
• Added support for Django 6.1.

7.0.0 (2026-06-17)

• Prevent check from failing when ROOT_URLCONF is not defined.
• Prevent toolbar storage from failing when serialized panel data contains mapping keys that are not JSON-compatible.
• Prevent debounce race conditions in the history panel for rapid fetch requests.
• Added a note to the prerequisites section of the installation docs about requiring an up-to-date browser.
• Dropped support for Django 4.2 and Django 5.1 .
• Updated to render the toolbar in a shadow DOM for better isolation from the rest of the page. This can be disabled with the setting USE_SHADOW_DOM.
• Note that custom themes overriding CSS variables on :root must move those overrides to #djDebug, and custom panels that rely on external styles or DOM lookups reaching into the toolbar will need updates to work with the shadow DOM.
• Added graceful degradation for SQL queries that exceed sqlparse's token limits. When SQLParseError is raised, the SQL panel now automatically disables grouping and retries formatting, preventing crashes with large queries.
• Upgraded the JavaScript code to use modern ECMAScript features using esupgrade.

... (truncated)

Commits

• f307de1 Version 7.1.1
• 73951a4 Bump the github-actions group with 3 updates (#2439)
• 678b687 [pre-commit.ci] pre-commit autoupdate (#2442)
• 7627683 Serialize the TaskResult class for Tasks panel. (#2444)
• a2d4260 Version 7.1.0
• d89606a Improve selenium tests reliability in CI (#2438)
• e367e1b Fix show_toolbar_with_docker on runtimes with unrelated host address (#2422)
• 49f4ef3 [pre-commit.ci] pre-commit autoupdate
• 3d3d010 Add support for Django 6.1
• f571734 Stop the history panel buttons from submitting their forms
• Additional commits viewable in compare view