Bump djangorestframework-stubs from 3.17.0 to 3.17.1 (#2211)

* Bump djangorestframework-stubs from 3.17.0 to 3.17.1

Bumps [djangorestframework-stubs](https://github.com/typeddjango/djangorestframework-stubs) from 3.17.0 to 3.17.1.
- [Release notes](https://github.com/typeddjango/djangorestframework-stubs/releases)
- [Commits](typeddjango/djangorestframework-stubs@3.17.0...3.17.1)

---
updated-dependencies:
- dependency-name: djangorestframework-stubs
  dependency-version: 3.17.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix typing errors with django-stubs 6.0.7

* Support django field signatures across stub versions

* Fix Codecov coverage for django stubs update

* Bump django-stubs to 6.0.7 to satisfy djangorestframework-stubs 3.17.1's constraint

djangorestframework-stubs 3.17.1 requires django-stubs>=6.0.7, causing
pip's ResolutionImpossible against the django-stubs==6.0.6 pin still in
requirements/local.txt. The three preceding commits are the same
django-stubs 6.0.7 mypy fixes already landed on the parallel
django-stubs bump PR.

* Fix mypy union-attr error from djangorestframework-stubs 3.17.1's widened request.data type

3.17.1 widens request.data to dict[str, Any] | list[Any] to match DRF's
real behavior for bulk JSON array payloads, which broke .get() on the
worker-uploads endpoint's metadata-size check. That endpoint only
accepts MultiPartParser, so request.data is always dict-like at
runtime; narrowed with isinstance rather than suppressing the check.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: JSv4 <scrudato@umich.edu>

Author: dependabot[bot]

changelog.d/2211-drf-stubs-request-data-union.fixed.md

@@ -0,0 +1,7 @@
+- `opencontractserver/worker_uploads/views.py:94` — `djangorestframework-stubs`
+  3.17.1 widened `request.data`'s type to `dict[str, Any] | list[Any]`
+  (matching DRF's real behavior for bulk JSON array payloads), which surfaced
+  a `union-attr` mypy error on `request.data.get(...)`. This view only accepts
+  `MultiPartParser`, so `request.data` is always dict-like at runtime; added
+  an `isinstance` narrowing consistent with the existing dict check two lines
+  below rather than suppressing the type error.

opencontractserver/worker_uploads/views.py

@@ -91,7 +91,17 @@ def post(self, request: Request) -> Response:
         # Enforce metadata size limit
         max_metadata_size = settings.MAX_WORKER_METADATA_SIZE_BYTES
         if max_metadata_size:
-            raw_metadata = request.data.get("metadata", "")
+            # request.data is dict-like here in practice: this view only
+            # accepts MultiPartParser (see parser_classes above), never
+            # JSONParser, so DRF's request.data | list[Any] union (list is
+            # DRF's shape for a bulk JSON array body) never actually resolves
+            # to a list on this endpoint.
+            request_data = request.data
+            raw_metadata = (
+                request_data.get("metadata", "")
+                if isinstance(request_data, dict)
+                else ""
+            )
             if isinstance(raw_metadata, dict):
                 metadata_size = len(json.dumps(raw_metadata).encode())
             else:

requirements/local.txt

@@ -12,7 +12,7 @@ pytest==9.1.1  # https://github.com/pytest-dev/pytest
 pytest-cov==7.1.0  # https://github.com/pytest-dev/pytest-cov
 pytest-xdist==3.8.0  # https://github.com/pytest-dev/pytest-xdist (parallel test execution)
 pytest-timeout==2.4.0  # https://github.com/pytest-dev/pytest-timeout (per-test hang guard in CI)
-djangorestframework-stubs==3.17.0  # https://github.com/typeddjango/djangorestframework-stubs
+djangorestframework-stubs==3.17.1  # https://github.com/typeddjango/djangorestframework-stubs
 responses==0.26.2  # https://github.com/getsentry/responses
 # Keep at >=8.2.0. Earlier releases' aiohttp stub subclasses
 # aiohttp.streams.AsyncStreamReaderMixin at import time, a symbol aiohttp 3.14