[pip] Bump the vreapis-pip group across 1 directory with 6 updates

[dependabot]

Bumps the vreapis-pip group with 6 updates in the /vreapis directory:

Package	From	To
django	5.1	5.1.4
djangorestframework-gis	1.0	1.1
whitenoise	6.7.0	6.8.2
gunicorn	22.0.0	23.0.0
django-cors-headers	4.4.0	4.6.0
psycopg2	2.9.9	2.9.10

Updates django from 5.1 to 5.1.4

Commits

• 2d4add1 [5.1.x] Bumped version for 5.1.4 release.
• 6943d61 [5.1.x] Fixed CVE-2024-53908 -- Prevented SQL injections in direct HasKeyLook...
• bbc74a7 [5.1.x] Fixed CVE-2024-53907 -- Mitigated potential DoS in strip_tags().
• 5b4d949 [5.1.x] Removed question marks from headings in docs/topics/db/fixtures.txt.
• 6e3e735 [5.1.x] Fixed #35950 -- Restored refreshing of relations when fields deferred.
• ee2698d [5.1.x] Removed reference to "removing older versions of Django" in tutorial.
• bed70e2 [5.1.x] Upgraded to Python 3.12, Ubuntu 24.04, and enabled fail_on_warning fo...
• 5f82a5e [5.1.x] Added stub release notes and release date for 5.1.4, 5.0.10, and 4.2.17.
• 4b26240 [5.1.x] Fixed #35942 -- Fixed createsuperuser crash on Python 3.13+ when user...
• 08ac8c1 [5.1.x] Updated maintainers of Django Debug Toolbar to Django Commons.
• Additional commits viewable in compare view

Updates djangorestframework-gis from 1.0 to 1.1

Release notes

Sourced from djangorestframework-gis's releases.

1.1.0 [2024-08-17]

Features

• Allowed GeoFeatureModelSerializer to support models without geometry field.

Changes

Dependencies:

• Bumped django-filters~=23.5.

• Added Django 4.2, 5.0, 5.1 to automated testing build.

• Dropped several EOL dependencies from automated testing build:

  • Python 3.6 and 3.7.
  • Django 2.2, 3.0, 3.1 and 4.0.
  • djangorestframework < 3.12.

  The library may continue working with the dependencies listed above, but it's not guaranteed.

Changelog

Sourced from djangorestframework-gis's changelog.

Version 0.11.1 [2017-05-05]

• [#119](https://github.com/openwisp/django-rest-framework-gis/issues/119) <https://github.com/openwisp/django-rest-framework-gis/issues/119>_: Added support to "all" fields in serializer
• [#130](https://github.com/openwisp/django-rest-framework-gis/issues/130) <https://github.com/openwisp/django-rest-framework-gis/pull/130>_: Added compatibility with DRF 3.6

Commits

• 927c9ee 1.1.0 release
• 533567a [deps] Allow djangorestframework up to 3.15.x
• 3449785 [deps] Update psycopg2 requirement from ~=2.8.0 to ~=2.9.9
• 00096c0 [deps] Update django-filter requirement from ~=23.5 to >=23.5,<25.0
• 2f6df04 [deps/ci] QA reformat, updated CI, updated deps
• 110abaa [docs] Added Issue Template, PR Template
• 01e43df [deps] Update openwisp-utils[qa] requirement from ~=1.0.0 to ~=1.0.5
• 33df16c [deps] Enabled dependabot
• 4e661aa [docs] Fixed build status badge
• 4f244d5 [feature] Allow geometry-less models #282
• Additional commits viewable in compare view

Updates whitenoise from 6.7.0 to 6.8.2

Changelog

Sourced from whitenoise's changelog.

6.8.2 (2024-10-29)

• Fix compression speed gains for the thread pool when running Django’s collectstatic. The thread pool had no effect due to use of a generator for the results, a refactoring introduced when reviewing the initial PR.

  Thanks to Petr Přikryl for the investigation and fix in PR [#616](https://github.com/evansd/whitenoise/issues/616) <https://github.com/evansd/whitenoise/pull/616>__.

6.8.1 (2024-10-28)

• Raise any errors from threads in the whitenoise.compress command.

  Regression in 6.8.0. Thanks to Tom Grainger for the spotting this with a comment on PR [#484](https://github.com/evansd/whitenoise/issues/484) <https://github.com/evansd/whitenoise/pull/484#discussion_r1818989096>__.

6.8.0 (2024-10-28)

• Drop Django 3.2 to 4.1 support.

• Drop Python 3.8 support.

• Support Python 3.13.

• Fix a bug introduced in version 6.0.0 where Range requests could lead to database connection errors in other requests.

  Thanks to Per Myren for the detailed investigation and fix in PR [#612](https://github.com/evansd/whitenoise/issues/612) <https://github.com/evansd/whitenoise/pull/612>__.

• Use Django’s |FORCE_SCRIPT_NAME|__ setting correctly. This reverts a change from version 5.3.0 that added a call to Django’s |get_script_prefix() method|__ outside of the request-response cycle.

  .. |FORCE_SCRIPT_NAME| replace:: FORCE_SCRIPT_NAME __ https://docs.djangoproject.com/en/stable/ref/settings/#std:setting-FORCE_SCRIPT_NAME

  .. |get_script_prefix() method| replace:: get_script_prefix() method __ https://docs.djangoproject.com/en/stable/ref/urlresolvers/#django.urls.get_script_prefix

  Thanks to Sarah Boyce in PR [#486](https://github.com/evansd/whitenoise/issues/486) <https://github.com/evansd/whitenoise/pull/486>__.

• Compress files using a thread pool. This speeds up the compression step up to four times in benchmarks.

  Thanks to Anthony Ricaud in PR [#484](https://github.com/evansd/whitenoise/issues/484) <https://github.com/evansd/whitenoise/pull/484>__.

Commits

• 2f75ac8 Version 6.8.2
• 61853c7 Fix compression speed gains (#616)
• bfc5dae Version 6.8.1
• 6bbec0f Raise errors from threads in whitenoise.compress (#615)
• 0b054e5 Version 6.8.0
• 54c464a Upgrade and clarify Django quickstart docs (#548)
• d5caf8d Compress each file in a ThreadPool (#484)
• 9494ff3 Use settings.FORCE_SCRIPT_NAME correctly (#486)
• c42e93c Make sure SlicedFile is closed properly (#612)
• f8dff50 Drop Django 3.2 to 4.1 support (#614)
• Additional commits viewable in compare view

Updates gunicorn from 22.0.0 to 23.0.0

Release notes

Sourced from gunicorn's releases.

23.0.0

Gunicorn 23.0.0 has been released. This version improve HTTP 1.1. support and which improve safety

You're invited to upgrade asap your own installation.

23.0.0 - 2024-08-10

• minor docs fixes (:pr:3217, :pr:3089, :pr:3167)
• worker_class parameter accepts a class (:pr:3079)
• fix deadlock if request terminated during chunked parsing (:pr:2688)
• permit receiving Transfer-Encodings: compress, deflate, gzip (:pr:3261)
• permit Transfer-Encoding headers specifying multiple encodings. note: no parameters, still (:pr:3261)
• sdist generation now explicitly excludes sphinx build folder (:pr:3257)
• decode bytes-typed status (as can be passed by gevent) as utf-8 instead of raising TypeError (:pr:2336)
• raise correct Exception when encounting invalid chunked requests (:pr:3258)
• the SCRIPT_NAME and PATH_INFO headers, when received from allowed forwarders, are no longer restricted for containing an underscore (:pr:3192)
• include IPv6 loopback address [::1] in default for :ref:forwarded-allow-ips and :ref:proxy-allow-ips (:pr:3192)

** NOTE **

• The SCRIPT_NAME change mitigates a regression that appeared first in the 22.0.0 release
• Review your :ref:forwarded-allow-ips setting if you are still not seeing the SCRIPT_NAME transmitted
• Review your :ref:forwarder-headers setting if you are missing headers after upgrading from a version prior to 22.0.0

** Breaking changes **

• refuse requests where the uri field is empty (:pr:3255)
• refuse requests with invalid CR/LR/NUL in heade field values (:pr:3253)
• remove temporary --tolerate-dangerous-framing switch from 22.0 (:pr:3260)
• If any of the breaking changes affect you, be aware that now refused requests can post a security problem, especially so in setups involving request pipe-lining and/or proxies.

Fix CVE-2024-1135

Commits

• 411986d fix doc
• 334392e Merge pull request #2559 from laggardkernel/bugfix/reexec-env
• e75c353 Merge pull request #3189 from pajod/patch-py36
• 9357b28 keep document user in access_log_format setting
• 79fdef0 bump to 23.0.0
• 3acd9fb Merge pull request #2620 from talkerbox/improve-access-log-format-docs
• 3f56d76 Merge pull request #3192 from pajod/patch-allowed-script-name
• 256d474 docs: revert duped directive
• ffa48b5 test: default change was intentional
• 52538ca docs: recommend SCRIPT_NAME=/subfolder
• Additional commits viewable in compare view

Updates django-cors-headers from 4.4.0 to 4.6.0

Changelog

Sourced from django-cors-headers's changelog.

4.6.0 (2024-10-29)

• Drop Django 3.2 to 4.1 support.

4.5.0 (2024-10-12)

• Drop Python 3.8 support.

• Support Python 3.13.

Commits

• fd8e9af Version 4.6.0
• a3479b1 Drop Django 3.2 to 4.1 support (#978)
• 6f5222d Version 4.5.0
• 96ef5d7 Drop Python 3.8 support (#977)
• 6a0d30d Add automated release process (#976)
• e816d10 [pre-commit.ci] pre-commit autoupdate (#975)
• 132f381 Bump astral-sh/setup-uv from 1 to 3 in the github-actions group (#974)
• 3194a6d Support Python 3.13 (#972)
• 1cba108 Upgrade requirements (#971)
• a56c753 Use uv on GitHub Actions (#970)
• Additional commits viewable in compare view

Updates psycopg2 from 2.9.9 to 2.9.10

Changelog

Sourced from psycopg2's changelog.

Current release

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).
• Fix building when pg_config returns an empty string (:ticket:[#1599](https://github.com/psycopg/psycopg2/issues/1599)).
• Wheel package bundled with OpenSSL 1.1.1v.

What's new in psycopg 2.9.6 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Package manylinux 2014 for aarch64 and ppc64le platforms, in order to include libpq 15 in the binary package (:ticket:[#1396](https://github.com/psycopg/psycopg2/issues/1396)).
• Wheel package bundled with OpenSSL 1.1.1t.

What's new in psycopg 2.9.5 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.11.
• Add support for rowcount in MERGE statements in binary packages (:ticket:[#1497](https://github.com/psycopg/psycopg2/issues/1497)).

... (truncated)

Commits

• a805acf chore: bump to version 2.9.10
• 78561ac Merge pull request #1728 from romank0/fetch-notifications-on-commit
• 5283a83 chore: add TransactionTimeout error, added in PostgreSQL 17
• f64dd39 docs: add news entry about notifications on commit
• cba6d39 removes duplication in tests
• 282360d adds notifications processing after every PQexec
• 362cb00 Adds notifies processing in pq_commit
• eaeeb76 Merge pull request #1729 from edgarrmondragon/1692-py313-wheels
• 4987362 ci(windows): drop Python 3.8 packages
• 8c9a35d ci: test with PostgreSQL 17
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions