chore(deps): bump the major-updates group across 1 directory with 6 updates

[dependabot]

Bumps the major-updates group with 6 updates in the / directory:

Package	From	To
django	5.2.16	5.2.17
django-health-check	3.20.8	4.5.1
django-filter	25.2	26.1
django-grappelli	4.0.3	5.0.0
gunicorn	23.0.0	26.2.0
django-debug-toolbar	5.2.0	8.0.0

Updates django from 5.2.16 to 5.2.17

Commits

• e802ada [5.2.x] Bumped version for 5.2.17 release.
• b9adb81 [5.2.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
• ba80833 [5.2.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
• c72a5db [5.2.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
• 115ffd0 [5.2.x] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial l...
• ec5ced4 [5.2.x] Fixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs.
• 02369b5 [5.2.x] Allowed the full Python test matrix to run on GitHub Actions.
• 686072f [5.2.x] Added stub release notes and release date for 5.2.17.
• cd5ad8c [5.2.x] Bumped minimum setuptools version to 83.
• 3e389b7 [5.2.x] Closed temporary files in GDALRasterTests.
• Additional commits viewable in compare view

Updates django-health-check from 3.20.8 to 4.5.1

Release notes

Sourced from django-health-check's releases.

4.5.1

What's Changed

• Document that the health_check URL pattern requires a name by @​codingjoe in codingjoe/django-health-check#764
• Rewrite documentation in simplified English by @​codingjoe in codingjoe/django-health-check#765
• Fix CI by managing integration services with testcontainers by @​codingjoe in codingjoe/django-health-check#766

Full Changelog: codingjoe/django-health-check@4.5.0...4.5.1

4.5.0

What's Changed

• Fix #758 -- Support Django 6.1 MAILERS setting in Mail health check by @​codingjoe in codingjoe/django-health-check#759

Full Changelog: codingjoe/django-health-check@4.4.4...4.5.0

4.4.4

What's Changed

• Fix #743 -- Add redis label to JSON views by @​codingjoe in codingjoe/django-health-check#753

Full Changelog: codingjoe/django-health-check@4.4.3...4.4.4

4.4.3

What's Changed

• Fix #742 -- Remove blank lines in OpenMetrics output by @​pfcodes in codingjoe/django-health-check#741

New Contributors

• @​pfcodes made their first contribution in codingjoe/django-health-check#741

Full Changelog: codingjoe/django-health-check@4.4.2...4.4.3

4.4.2

What's Changed

• Add sponsors to readme

Full Changelog: codingjoe/django-health-check@4.4.1...4.4.2

4.4.1

What's Changed

• Update deprecated redis_url test case by @​M-Hassan-Raza in codingjoe/django-health-check#726
• Add atlassian extra depnency test group by @​codingjoe in codingjoe/django-health-check#732
• Fix Atlassian incident checks by @​M-Hassan-Raza in codingjoe/django-health-check#731

... (truncated)

Commits

• 0de6650 Fix CI by managing integration services with testcontainers (#766)
• 3408809 Rewrite documentation in Simplified English (#765)
• 8d0e3dc Fix #760 -- Document that the health_check URL pattern requires a name
• 918881b [pre-commit.ci] pre-commit autoupdate
• fa6f5c0 [pre-commit.ci] auto fixes from pre-commit.com hooks
• 34839b7 [pre-commit.ci] pre-commit autoupdate
• 2181b6f Fix #758 -- Support Django 6.1 MAILERS setting in Mail health check (#759)
• b71b988 [pre-commit.ci] pre-commit autoupdate
• 1e09a5a Fix #743 -- Add redis label to JSON views
• bbe3826 [pre-commit.ci] pre-commit autoupdate
• Additional commits viewable in compare view

Updates django-filter from 25.2 to 26.1

Changelog

Sourced from django-filter's changelog.

Version 26.1 (2026-07-11)

• Added testing for Django 6.1.

  DRF integration will require the upcoming DRF v3.18. See encode/django-rest-framework#9978

• Added testing against Python 3.14.

Commits

• 52c3c0f Set date and bump version for 26.1 release.
• 6a3222a Add testing for Python 3.14.
• aa3bd8e Added testing against Django 6.1
• ec717ea Correct Language header in Greek locale file (el) (#1751)
• 31b297c Bump the github-actions group with 2 updates (#1733)
• 590c0a3 Fix version range for Django 6.0 (#1731)
• 6204bc4 Added release date for v25.2.
• See full diff in compare view

Updates django-grappelli from 4.0.3 to 5.0.0

Changelog

Sourced from django-grappelli's changelog.

5.0.0 (April 29th, 2026)

• Compatibility with Django 6.x

4.0.5 (not yet released)

4.0.4 (April 28th, 2026)

• Improved: raised margins within radiolists
• Improved: layout for multiple inputs in related widget
• Improved: layout for related widget display in change list

Commits

• 98c98e7 docs for upcoming release (5.0.0)
• fa9fdbd fix with dashboard modules
• fd0552f Merge branch 'master' into stable/5.0.x
• be75293 docs for upcoming release (4.0.4)
• dec6e41 apply label styles to legends in grp-rows, #1077
• 0208cce hide datetime inline labels, #1077
• 84d070b improving layout for related widget display in change list, related to #1072
• 9e52129 improving layout for multiple inputs in related widget, #1072
• 6622c4b improving layout for related widget display in change list, related to #1072
• 1edb009 improving layout for multiple inputs in related widget, #1072
• Additional commits viewable in compare view

Updates gunicorn from 23.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates django-debug-toolbar from 5.2.0 to 8.0.0

Release notes

Sourced from django-debug-toolbar's releases.

8.0.0

Changelog

• Refreshed the toolbar's visual design with self-hosted Alef (panel titles) and Geist (body text) fonts, an updated color palette, and per-panel navigation icons.
• Added a new project logo and brand identity, designed by Robin of RBNX Studio <https://www.rbnx.studio>_.
• Added a "Docs" link to the toolbar that opens the documentation.
• Changed the highlight color for the current request and other "relevant to you" rows from yellow to a green tint, with a left border accent for legibility in dark mode.
• Added a design guidelines page to the documentation describing the project's logo, color palette and typography.
• Improved toolbar accessibility: visible keyboard focus, keyboard-operable scroll regions, reduced-motion support, aria-expanded on panel toggles, an aria-live status for history refreshes, and WCAG 2.1 AA contrast in both themes.
• Added a talk to the resources documentation.
• Updated the example screenshot.
• Updated the screenshot capture logic to find the toolbar elements in the shadow DOM.
• Track and display processing time of application, including the toolbar's time, in the timer panel.
• Fixed the History panel rendering a duplicate Refresh button below the one in its title bar.
• Fixed the History panel's Refresh button submitting its form when clicked before the panel's script had loaded.
• Documented the USE_SHADOW_DOM setting, which was added in 7.0.0 but was missing from the configuration documentation, and added test coverage for it.

What's Changed

• Update the design interface of the toolbar by @​VeldaKiara in django-commons/django-debug-toolbar#2429
• Updated example screenshot of the toolbar with the new design. by @​tim-schilling in django-commons/django-debug-toolbar#2446
• docs: fix typos in apps.py docstrings by @​aoright in django-commons/django-debug-toolbar#2452
• Track and display middleware time in the toolbar by @​earthcomfy in django-commons/django-debug-toolbar#2049
• Improve cache hit/miss reporting for cache.get() by @​Harsh3006 in django-commons/django-debug-toolbar#2418
• Square the toolbar handle corners facing the viewport edge by @​federicobond in django-commons/django-debug-toolbar#2460
• Show a single Refresh button in the History panel by @​federicobond in django-commons/django-debug-toolbar#2459
• Document and test the USE_SHADOW_DOM setting by @​alissaahodge in django-commons/django-debug-toolbar#2461

New Contributors

• @​aoright made their first contribution in django-commons/django-debug-toolbar#2452
• @​earthcomfy made their first contribution in django-commons/django-debug-toolbar#2049
• @​Harsh3006 made their first contribution in django-commons/django-debug-toolbar#2418
• @​alissaahodge made their first contribution in django-commons/django-debug-toolbar#2461

Full Changelog: django-commons/django-debug-toolbar@7.1.1...8.0.0

7.1.1

Changelog

• Serialize TaskResult in the Tasks panel to accommodate the storage mechanism.
• Removed whitespace on Task panel’s kwargs column.

What's Changed

• Serialize the TaskResult class for Tasks panel. by @​tim-schilling in django-commons/django-debug-toolbar#2444

Full Changelog: django-commons/django-debug-toolbar@7.1.0...7.1.1

7.1.0

... (truncated)

Changelog

Sourced from django-debug-toolbar's changelog.

8.0.0 (2026-09-02)

• Refreshed the toolbar's visual design with self-hosted Alef (panel titles) and Geist (body text) fonts, an updated color palette, and per-panel navigation icons.
• Added a new project logo and brand identity, designed by Robin of RBNX Studio <https://www.rbnx.studio>_.
• Added a "Docs" link to the toolbar that opens the documentation.
• Changed the highlight color for the current request and other "relevant to you" rows from yellow to a green tint, with a left border accent for legibility in dark mode.
• Added a design guidelines page to the documentation describing the project's logo, color palette and typography.
• Improved toolbar accessibility: visible keyboard focus, keyboard-operable scroll regions, reduced-motion support, aria-expanded on panel toggles, an aria-live status for history refreshes, and WCAG 2.1 AA contrast in both themes.
• Added a talk to the resources documentation.
• Updated the example screenshot.
• Updated the screenshot capture logic to find the toolbar elements in the shadow DOM.
• Track and display processing time of application, including the toolbar's time, in the timer panel.
• Fixed the History panel rendering a duplicate Refresh button below the one in its title bar.
• Fixed the History panel's Refresh button submitting its form when clicked before the panel's script had loaded.
• Documented the USE_SHADOW_DOM setting, which was added in 7.0.0 but was missing from the configuration documentation, and added test coverage for it.

7.1.1 (2026-08-14)

• Serialize TaskResult in the Tasks panel to accommodate the storage mechanism.
• Removed whitespace on Task panel's kwargs column.

7.1.0 (2026-08-10)

• Added a Tasks panel that shows tasks queued during the request via Django's built-in tasks framework (django.tasks, Django 6.0+). On older versions of Django, the panel explains that upgrading is required.
• Fixed the Django version check in the SQL panel test suite for Django's boolean parameter handling.
• Fixed show_toolbar_with_docker on Docker runtimes such as OrbStack that can resolve host.docker.internal to an address outside the container network.
• Restored the select and explain buttons for queries that run without

... (truncated)

Commits

• 85b98c6 Version 8.0.0
• 8fb3fe8 Document and test the USE_SHADOW_DOM setting
• 3f748fc Show a single Refresh button in the History panel
• 19fce30 Square the toolbar handle corners facing the viewport edge
• ff94889 Bump the minor-npm-dependencies group with 2 updates
• 65f6854 Bump py-cov-action/python-coverage-comment-action
• c7dc154 [pre-commit.ci] pre-commit autoupdate
• 93e89b1 Fix CI with spelling words and biome schema version.
• ecf3e1e Make the cache discussion link open in a new tab.
• 28996cc Improve cache hit/miss reporting for cache.get()
• Additional commits viewable in compare view