chore(deps): bump Django to 5.2.17

[vpetersson-bot]

Issues Fixed

Clears the eight Dependabot advisories open against django 5.2.14 in uv.lock (alerts 302, 304, 305, 306, 307, 308, 309, 310):

CVE	Issue	Fixed in
CVE-2026-7666	Reuse of a partially-initialized connection after a failed STARTTLS handshake	5.2.15
CVE-2026-35193	UpdateCacheMiddleware omits Authorization from Vary	5.2.15
CVE-2026-48587	has_vary_header mishandles whitespace in Vary values	5.2.15
CVE-2026-8404	UpdateCacheMiddleware handles Cache-Control case-sensitively	5.2.15
CVE-2026-6873	Signed cookies vulnerable to salt namespace collisions	5.2.15
CVE-2026-53877	GDALRaster heap over-read when constructed from bytes	5.2.16
CVE-2026-53878	DomainNameValidator permits newlines (header injection)	5.2.16
CVE-2026-48588	Cached Set-Cookie response exposed when the request carries an unrelated cookie	5.2.16

Description

Bumps Django from 5.2.14 to 5.2.17, the latest patch in the 5.2 LTS series, in all three dependency groups plus the resolved viewer pin. Only django moves in the lockfile; there is no transitive churn.

Going to 5.2.17 rather than stopping at 5.2.16 also picks up four fixes that were never raised as alerts here, including one rated high:

• CVE-2026-15307 (high): server-side file write and request forgery via spatial lookups
• CVE-2026-15830 (moderate): denial of service via deeply nested GEOMETRYCOLLECTION
• CVE-2026-15920 (moderate): cross-site scripting via URLField values in the admin
• CVE-2026-15337 (low): denial of service in check_for_language()

No code changes are needed. Each affected API was checked against the tree and none is used: no get_signed_cookie/set_signed_cookie, no django.contrib.gis, no UpdateCacheMiddleware/cache_page, no DomainNameValidator, no SMTP email backend, and no set_language view. The one backward-incompatible change in 5.2.17 (spatial lookups now reject dict and non-geometry str) needs GeoDjango, so it does not apply.

OSV reports no remaining advisories against 5.2.17.

Verified locally: 1985 passed / 3 skipped (-m "not integration"), mypy . clean across 195 files, ruff check and ruff format --check clean.

Checklist

• I have performed a self-review of my own code.
• New and existing unit tests pass locally and on CI with my changes.
• I have done an end-to-end test for Raspberry Pi devices.
• I have tested my changes for x86 devices.
• I added a documentation for the changes I have made (when necessary).

Device testing is not applicable: this is a patch-level dependency bump with no runtime behavior change on any board.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Updates the project’s pinned Django patch version to the latest 5.2 LTS patch release in order to address multiple security advisories, without introducing dependency churn beyond Django itself.

Changes:

• Bump Django from 5.2.14 to 5.2.17 in the relevant dependency groups in pyproject.toml.
• Update uv.lock to reflect the resolved Django 5.2.17 package metadata and group pins.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
pyproject.toml	Updates the pinned Django version in the server, viewer, and mypy dependency groups.
uv.lock	Updates locked Django version and associated artifact hashes/URLs across dependency groups and the django package entry.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@4e6b88d). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #3301   +/-   ##
=========================================
  Coverage          ?   90.31%           
=========================================
  Files             ?       85           
  Lines             ?     9942           
  Branches          ?     1098           
=========================================
  Hits              ?     8979           
  Misses            ?      709           
  Partials          ?      254           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.