Bump django-stubs from 6.0.6 to 6.0.7

[dependabot]

Bumps django-stubs from 6.0.6 to 6.0.7.

Commits

• a7686ba Update mypy to 2.3.0, release 6.0.7 (#3487)
• 7fc1512 Lock file maintenance (#3486)
• 5ea3999 Update int128/hide-comment-action action to v1.65.0 (#3485)
• 48fa1fb Annotate unparameterized Field references (#3482)
• 1cebbea Support django models discovery by the plugin in tests/assert_type (#3483)
• cd42cb5 [pre-commit.ci] pre-commit autoupdate (#3484)
• e584eff Improve local justfile (#3481)
• ca6810c Preserve values() aliases through annotate() for order_by (#3479)
• b15cf82 Update dependency ty to v0.0.58 (#3480)
• 3c1769f Fully annotate Field.formfield keyword args (#3443)
• Additional commits viewable in compare view

[claude]

Review

This is a routine Dependabot dependency bump with a single one-line change to requirements/local.txt, updating django-stubs from 6.0.6 to 6.0.7.

Overview

• django-stubs is a dev-only dependency (type stubs for Django, used by mypy) declared in requirements/local.txt, not requirements/base.txt or production.txt — it has no runtime/production impact.
• The upstream 6.0.6 → 6.0.7 changelog (per the PR description) is a patch release: mypy version alignment (2.3.0, which already matches the pinned mypy==2.3.0 in this file) plus incremental stub annotation fixes (unparameterized Field references, values()/annotate() alias preservation for order_by, Field.formfield kwarg annotations). No breaking API changes noted.

Code quality / correctness

• Change is minimal and mechanically correct — version bump only, no other lines touched.
• mypy and django-stubs versions remain compatible per the changelog (this release is explicitly about keeping them in sync).

Risk / test coverage

• Since this only affects static type checking (mypy) in local/dev tooling, the main risk is CI's mypy/pre-commit step surfacing new type errors if the updated stubs are stricter or fix previously-incorrect annotations elsewhere in the codebase. Worth confirming the pre-commit run --all-files / mypy CI check passes on this branch before merging.
• No application tests are needed for this change since it doesn't touch runtime code.

Security

• No security concerns — this is a type-stub-only package with no runtime footprint.

Recommendation: Safe to merge once CI (particularly the mypy/type-checking step) passes green.

[JSv4]

@dependabot rebase

[claude]

Review

This is a routine Dependabot patch bump: django-stubs 6.0.6 → 6.0.7 in requirements/local.txt, a dev-only type-stub dependency (no production code paths touched).

Findings:

• Change is a single line, dev-tooling only — no runtime/security impact.
• Per the upstream changelog, this django-stubs release itself bumps its mypy pin to 2.3.0. requirements/local.txt already pins mypy==2.3.0 here, so there's no version mismatch to worry about.
• No test coverage concerns — type-stub upgrades aren't exercised by the runtime test suite; the relevant validation is that mypy/pre-commit still passes with the new stubs.

Recommendation: Safe to merge once CI (in particular the mypy/pre-commit check) passes. No code quality, correctness, or security concerns for a change of this scope.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[claude]

Review

Small, well-scoped dependency bump (django-stubs 6.0.6 → 6.0.7) with the two typing fallout fixes needed to keep mypy green. Went through the diff in opencontractserver/documents/services/relationships.py, opencontractserver/shared/fields.py, and requirements/local.txt.

opencontractserver/shared/fields.py — NullableJSONField.formfield

• Replacing the **{"form_class": UTF8JSONFormField, **kwargs} merge trick with explicit form_class/choices_form_class parameters is a good change — it drops the # type: ignore[override] by making the signature match Field.formfield's actual shape (form_class, choices_form_class, **kwargs) instead of widening to **kwargs only.
• Verified behavior is preserved for the tested path: NullableJSONFieldTests.test_formfield (opencontractserver/tests/test_custom_fields.py:53) still gets a UTF8JSONFormField instance by default, and an explicit form_class=None/override still flows through correctly since it's now a real keyword-or-positional parameter rather than a dict-merge override.
• Minor observation (non-blocking): none of the existing tests exercise the new choices_form_class parameter or an explicit form_class= override, so the parity with base Django Field.formfield semantics is asserted by inspection rather than a test. Not required for a typing-only fix, but worth keeping in mind if this field ever gets a form_class override call site.

opencontractserver/documents/services/relationships.py

• Pure rename (row → source_row) in the first aggregation loop to avoid a redefinition-with-different-type flagged by the stricter stubs; the second loop's row variable is untouched. No behavioral change — confirmed the aggregation logic (source counts, then target counts excluding self-referential rows) is identical to before.

requirements/local.txt

• Straightforward version bump, no other pins needed adjustment.

Other notes

• No changelog.d/ fragment was added. Per CLAUDE.md's changelog policy, pure typing/dependency-bump fixes are borderline (there's precedent for a .changed.md fragment on a similar django-stubs-triggered mypy fix in changelog.d/1738-extract-tests-mypy.changed.md), but given this PR has no runtime behavior change, I'd call this optional rather than a blocker.
• Didn't spot any security, performance, or test-coverage concerns beyond the minor note above — this looks safe to merge once CI (mypy/typecheck) is green.