Security hardening, dependency updates, and CI fixes

[AevumDecessus]

Summary

Merges all changes from dev to master since the last sync. This release includes security hardening from a full codebase audit, routine dependency bumps, and CI workflow fixes.

Security Fixes

pyjwt 2.12.1 -> 2.13.0 (#1013) - 5 CVEs patched, most critical: GHSA-xgmm-8j9v-c9wx (JWK JSON accepted as HMAC secret, algorithm confusion attack). Used by django-oauth-toolkit and social-auth-app-django in the authentication path.

Remove django-oauth-toolkit (#1025) - The OAuth2 provider at /o/ was installed but never used (0 registered applications). Any authenticated guild member could register an OAuth2 app for phishing. Removed entirely along with its transitive dependency jwcrypto.

Stream key PRNG + entropy (#1024) - Replaced random.choices (Mersenne Twister) with secrets.choice (OS CSPRNG). Expanded wordlist from 310 to 1000 verified 3-4 syllable words. Entropy increased from 33.1 to 39.9 bits (key space from ~9.2 billion to 1 trillion).

CSRF_TRUSTED_ORIGINS (#1026) - Added the setting required by Django 5.2. Hardcodes prod and dev origins; additional origins (fragdev, local Caddy) configurable via env var.

ORM order_by injection (#1028) - User-controlled orderBy parameter passed directly to .order_by() now validated against a whitelist. Invalid values silently fall back to id.

Pin actions/checkout SHA (#1027) - The sync-dev-to-master.yaml workflow was the only one using a mutable @v6 tag with contents:write permission. Pinned to the same SHA used by all other workflows.

CI/CD Fixes

SonarCloud JRE provisioning (#1018) - sonarqube-scan-action v7's JRE provisioning endpoint returns 403 on the free open source plan. Added actions/setup-java so the scanner uses the system JRE and skips the API call.

Bump actions/setup-java to v5.2.0 (#1019) - v4 ran on Node.js 20 (deprecated June 2, 2026). v5.2.0 targets Node.js 24.

Dependency Bumps

Package	From	To	PR	Notes
pyjwt	2.12.1	2.13.0	#1013	Security release, 5 CVEs
certifi	2026.4.22	2026.5.20	#1011	CA bundle refresh
aiohappyeyeballs	2.6.1	2.6.2	#1012	Bug fix in connection algorithm
idna	3.15	3.17	#1014, #1020	Memory reduction, input length cap
click	8.4.0	8.4.1	#1015	Bug fixes
coverage	7.14.0	7.14.1	#1016	Dev/CI only, HTML report fix
redis	7.4.0	8.0.0	#1021	Major bump, tested locally against all 5 DB indexes
pip	26.1.1	26.1.2	#1022	Dev only, security hardening
django-oauth-toolkit	3.2.0	removed	#1023, #1025	Bumped then removed entirely

Production Deployment Notes

After deploying, drop the stale oauth2_provider tables (0 data in all):

DROP TABLE IF EXISTS oauth2_provider_accesstoken CASCADE;
DROP TABLE IF EXISTS oauth2_provider_application CASCADE;
DROP TABLE IF EXISTS oauth2_provider_grant CASCADE;
DROP TABLE IF EXISTS oauth2_provider_idtoken CASCADE;
DROP TABLE IF EXISTS oauth2_provider_refreshtoken CASCADE;
DELETE FROM django_migrations WHERE app = 'oauth2_provider';

Set CSRF_TRUSTED_ORIGINS in .env for any non-production/dev environments (e.g. CSRF_TRUSTED_ORIGINS=https://fragdev.0n5.us,https://localhost:8443). Production and dev origins are hardcoded and require no env var.

Test plan

• All individual PRs passed CI before merge
• SonarCloud Quality Gate passed on all PRs
• Redis 8.0.0 tested locally (cache, Celery broker, all 5 DB indexes)
• Stream key generation verified in container (1000 words, secrets.choice, no dupes)
• CSRF_TRUSTED_ORIGINS verified in container (hardcoded + env var override)
• OAuth2 provider removal verified (570 tests pass, no module references remain)
• PR CI checks pass
• Production deploy: drop oauth2_provider tables
• Production deploy: verify /o/ returns 404
• Production deploy: verify stream key generation still works

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud