chore(deps): security updates for urllib3, wagtail, bleach and djangorestframework

[blarghmatey]

What are the relevant tickets?

Supersedes #3990, #3988, #3766 and #3989.

Description (What does it do?)

Four Renovate security PRs are open against uv.lock, each green on its own. Merging them one at a time forces a Renovate rebase of the rest after every merge, and Renovate only runs on weekends. This cherry-picks the four Renovate commits onto one branch, one commit per package, so the combined lock is what CI tests.

• urllib3 2.6.3 -> 2.7.0: GHSA-mf9v-mfxr-j63j (high, 7.5, decompression-bomb safeguards bypassed in the streaming API) and GHSA-qccp-gfcp-xxvc (sensitive headers forwarded across origins on proxied redirects)
• wagtail 7.3.3 -> 7.3.4: five advisories, four of them improper restriction or permission handling in the admin and API, highest CVSS 6.5 (GHSA-x5cx-w6p2-mxf2, GHSA-jm5p-837g-rv8g, GHSA-c2xx-cjmh-9q8f, GHSA-3vrh-m9w7-v94f, GHSA-92hv-j533-69wc)
• bleach 6.3.0 -> 6.4.0: GHSA-gj48-438w-jh9v (6.1, URI sanitization skipped in formaction) and GHSA-8rfp-98v4-mmr6
• djangorestframework 3.16.1 -> 3.17.2: GHSA-2m8g-3cmr-wg3w (5.3, DATA_UPLOAD_MAX_MEMORY_SIZE bypass through request.data) and GHSA-g47c-3xmw-q6m2

Implementation details

The commits are Renovate's, unmodified, so the diff against main is 16 changed lines (+16/-16) across pyproject.toml and uv.lock. I did not re-resolve the lock: a newer local uv (0.11.31) reorders the exclude-newer-package table and adds about 70 lines of noise per bump.

Changelog review:

• DRF is the only minor bump with breaking changes. 3.17.0 drops Python 3.9 and coreapi. We run 3.11, nothing imports coreapi, and schemas come from drf-spectacular (DEFAULT_SCHEMA_CLASS in main/settings.py).
• urllib3 2.7.0 drops Python 3.9 and raises its existing deprecation notices from DeprecationWarning to FutureWarning. The suite runs with filterwarnings = error and none surfaced.
• wagtail 7.3.4 is the five security fixes plus a treebeard 5.3 warning fix.
• bleach 6.4.0 is the two fixes, a tokenizer change for malformed tags (see the testing notes), and dropping pypy 3.10.

How can this be tested?

I built the web image from this branch and ran the full suite in it against postgres and redis: pytest -n logical --no-cov, 3474 passed, 8 skipped, 0 failed. uv lock --check passes.

One limit on what that shows for bleach: every bleach assertion (cms/serializers_test.py, courses/serializers/v1/courses_test.py) computes its expected value with bleach.clean(...), so the suite can't detect a change in bleach's output. All of our call sites are bleach.clean(text, tags={}, strip=True), which keeps no tags and so no attributes, so the two URI-scheme fixes in sanitize_uri_value don't reach us.

One change in the 6.3.0...6.4.0 diff does: bleach/html5lib_shim.py now re-parses malformed input shaped like <nottag <b>text</b>. 6.3.0 emitted that whole run as characters. 6.4.0 emits <nottag as characters and parses the rest as a tag, which strip=True then removes. So a CMS description containing that kind of broken markup will come out with more markup stripped than before. That's the direction we want, and well-formed descriptions are unaffected.

To check by hand: load a course page and /api/v2/courses/ and confirm descriptions still render as plain text, and open a page in the Wagtail admin.

Additional Context

bleach 6.4.0 is its last release. Upstream's changelog says the project is no longer maintained and won't ship further security fixes (mozilla/bleach#698), so it needs replacing. That's follow-up work, not part of this PR.

#3767 (setuptools) and #3186 (react-router) are also labelled security and are left out on purpose. Three of setuptools' four advisories are already fixed in the locked 80.10.2 and the bump fails on pkg_resources. Both react-router advisories cover >= 6.0.0 and we run 4.3.1.

🤖 Generated with Claude Code

https://claude.ai/code/session_013ezgZuYQpg4JZU1ohZAxhb

[github-actions]

OpenAPI Changes

Show/hide changes

## Changes for v0.yaml:
No changes detected

## Changes for v1.yaml:
No changes detected

## Changes for v2.yaml:
No changes detected

Unexpected changes? Ensure your branch is up-to-date with main (consider rebasing).

[blarghmatey]

The first CI attempt failed python-tests (3) on courses/views/v2/views_test.py::test_get_courses[True-True-2-100]. Out of 100 courses, one differed: next_run_id and one run's is_archived. The in_progress factory trait sets end_date with Faker("future_datetime"), which can land seconds from now, and the test reads the clock twice (expected side first, then the view), so a run's end date passed in between. Not related to these bumps. I re-ran the failed shard and all checks pass.

[Copilot]

Copilot review overview

🟢 Approval recommended

Dependency declarations and lockfile entries are consistent, and the combined update passed the reported full test suite.

Review effort: Balanced
Findings: None

What changed in this PR

Updates four Python dependencies to patched versions addressing security advisories.

Changes:

• Upgrades Django REST Framework and Wagtail pins.
• Updates Bleach and urllib3 lockfile resolutions.
• Refreshes package hashes and distribution metadata.

File	Description
uv.lock	Locks all four patched dependency versions and artifacts.
pyproject.toml	Updates direct Django REST Framework and Wagtail pins.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.