Update Django to 5.2

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
       # Label used to access the service container
       db:
         # Docker Hub image
-        image: postgres:12.22
+        image: postgres:15
         # Set health checks to wait until postgres has started
         options: >-
           --health-cmd pg_isready

channels/migrations/0017_channelgrouprole_index.py

@@ -0,0 +1,17 @@
+# Generated by Django 5.2.16 on 2026-08-13 14:09
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("channels", "0016_alter_channel_featured_list"),
+    ]
+
+    operations = [
+        migrations.RenameIndex(
+            model_name="channelgrouprole",
+            new_name="channelgrouprole_ch_role_idx",
+            old_fields=("channel", "role"),
+        ),
+    ]

channels/models.py

@@ -279,7 +279,11 @@ class ChannelGroupRole(TimestampedModel):
 
     class Meta:
         unique_together = (("channel", "group", "role"),)
-        index_together = (("channel", "role"),)
+        indexes = [
+            models.Index(
+                fields=["channel", "role"], name="channelgrouprole_ch_role_idx"
+            )
+        ]
 
     def __str__(self):
         return (

fixtures/common.py

@@ -50,6 +50,14 @@ def warnings_as_errors():
             module=".*(api_jwt|api_jws|rest_framework_jwt|astroid|bs4|celery|factory|botocore|posthog|pydantic).*",
             category=DeprecationWarning,
         )
+        # django-safedelete 1.4.1 (latest) still calls LogEntry.objects.log_action(),
+        # deprecated in Django 5.2. Drop once upstream moves to log_actions().
+        warnings.filterwarnings(
+            "ignore",
+            message=r"LogEntryManager\.log_action\(\) is deprecated.*",
+            module=r"safedelete\.admin",
+            category=DeprecationWarning,
+        )
         yield
     finally:
         warnings.resetwarnings()

main/middleware/apisix_user.py

@@ -12,7 +12,6 @@
 from django.core.exceptions import ObjectDoesNotExist
 from django.db.models import Q
 from django.http import HttpRequest
-from django.http.response import HttpResponseBase
 from posthog import Posthog
 
 from authentication.api import user_created_actions
@@ -215,7 +214,7 @@ class ApisixUserMiddleware(RemoteUserMiddleware):
 
     header = "HTTP_X_USERINFO"
 
-    def process_request(self, request: HttpRequest) -> HttpResponseBase | None:
+    def process_request(self, request: HttpRequest) -> None:
         """
         Modify the header to contain username, pass off to RemoteUserMiddleware
         """
@@ -242,7 +241,7 @@ def process_request(self, request: HttpRequest) -> HttpResponseBase | None:
                 # Already logged in as this user: skip login() so we don't cycle
                 # the session and write last_login on every request.
                 request.user = apisix_user
-                return self.get_response(request)
+                return None
 
             if request.user.is_authenticated and request.user != apisix_user:
                 # The user is authenticated, but doesn't match the user we got
@@ -266,4 +265,4 @@ def process_request(self, request: HttpRequest) -> HttpResponseBase | None:
             log.debug("Forcing user logout because no APISIX user was found")
             logout(request)
 
-        return self.get_response(request)
+        return None

main/middleware/apisix_user_test.py

@@ -158,7 +158,7 @@ def test_get_request_ambiguous_identity_fails_closed(mocker, mock_login):
     mock_get_response = mocker.Mock(return_value="response")
     apisix_middleware = ApisixUserMiddleware(mock_get_response)
 
-    assert apisix_middleware.process_request(mock_request) == "response"
+    assert apisix_middleware(mock_request) == "response"
 
     mock_login.assert_not_called()
     mock_get_response.assert_called_once_with(mock_request)
@@ -187,9 +187,11 @@ def test_get_request_different_user_logout(mocker, client, same_user):
     )
     mocker.patch("main.middleware.apisix_user.login")
     mock_logout = mocker.patch("main.middleware.apisix_user.logout")
-    apisix_middleware = ApisixUserMiddleware(mocker.Mock())
-    apisix_middleware.process_request(mock_request)
+    mock_get_response = mocker.Mock(return_value="response")
+    apisix_middleware = ApisixUserMiddleware(mock_get_response)
+    assert apisix_middleware(mock_request) == "response"
     assert mock_logout.call_count == (0 if same_user else 1)
+    mock_get_response.assert_called_once_with(mock_request)
 
 
 @pytest.mark.django_db(transaction=True)

main/settings.py

@@ -305,8 +305,6 @@
 
 USE_I18N = True
 
-USE_L10N = True
-
 USE_TZ = True
 
 AUTHENTICATION_BACKENDS = (

pyproject.toml

@@ -11,7 +11,7 @@ classifiers = [
     "Programming Language :: Python :: 3.12",
 ]
 dependencies = [
-    "Django==4.2.30",
+    "Django==5.2.16",
     "attrs>=25.0.0,<26",
     "base36>=0.1.1,<0.2",
     "beautifulsoup4>=4.8.2,<5",
@@ -30,7 +30,7 @@ dependencies = [
     "django-bitfield>=2.2.0,<3",
     "django-cache-memoize>=0.2.0,<0.3",
     "django-cors-headers>=4.0.0,<5",
-    "django-filter>=2.4.0,<3",
+    "django-filter>=26.1",
     "django-guardian>=3.0.0,<4",
     "django-health-check>=3.24.0,<4",
     "django-imagekit>=6.0.0,<7",

renovate.json

@@ -3,7 +3,7 @@
   "extends": ["local>mitodl/.github:renovate-config"],
   "packageRules": [
     {
-      "allowedVersions": "<5",
+      "allowedVersions": "<6",
       "matchPackageNames": ["django", "Django"]
     }
   ]