[andreazedda]

Scope

Addresses the immediate dependency-audit blocker in #69 without combining it with documentation PR #68 or the durable Django 5.2 migration in #70.

Changes

• raises the direct security floor from sqlparse==0.5.4 to sqlparse==0.6.0;
• refreshes uv.lock through governed uv 0.12.3 lock generation;
• adds exact current Django advisory PYSEC-2026-3717 to the temporary Django 4.2 triage;
• gives all Django 4.2 advisory exceptions a hard expiry of 2026-09-30;
• makes the audit fail closed after the expiry;
• adds a regression test for the expiry boundary;
• updates the dependency triage record with current advisories, decisions and the mandatory [M0-R][FRAMEWORK] Migrate the unsupported Django 4.2 baseline to Django 5.2 LTS #70 migration path;
• records a clean repository scan for direct GeoDjango/GIS runtime references during lock generation;
• adds a stable final required job to the existing dependency/reproducibility workflow because master branch protection already requires that exact check context.

Verified baseline

base master = bf097810b337dc6b766cda04497005670cd96513
current head = c63e833fe7ecab8ca6ad1e70fe76b220127d739c
intended use = E1_research_prototype
Django = 4.2.30 (unsupported; temporary only)
sqlparse target = 0.6.0
durable framework target = Django 5.2 LTS under #70

Security decision

The temporary Django exception means only that the currently disclosed GeoDjango path is not known to be exposed by this repository. It does not make Django 4.2 supported and does not authorize shared/production promotion.

exception owner = Andrea Zedda
expiry = 2026-09-30
migration issue = #70
shared/production promotion = prohibited
blanket ignore = prohibited

Required-check correction

A first merge attempt was correctly blocked because branch protection already expected status context:

required

but the existing workflow had no final check with that name. This PR adds only the minimum fail-closed aggregate bridge:

locked-quality
+ Python 3.11/3.12 core matrix
+ docker-lock
→ required

This does not complete #13. Immutable Action pinning, exact-PR safety mode, documentation contracts, PR templates, CODEOWNERS and final workflow rationalization remain under #13 after #70.

Change classification

dependency lock: yes
runtime source: audit wrapper only
scientific equations/model parameters: no
DB schema/migrations: no
private data: no
intended use: unchanged
temporary security risk decision: yes, exact and expiring
minimal protected aggregate check: yes

Required validation

The pull request must record:

uv lock --check
frozen chemistry sync
pip-audit through scripts.audit_dependencies
Ruff and format
mypy
repository hygiene
Django check
migration drift
Python 3.11 core tests
Python 3.12 core tests
numerical baseline unchanged
Docker locked build
final required check
no-GIS code/settings evidence

Non-goals

• no Django framework upgrade in this PR;
• no permanent acceptance of Django 4.2 risk;
• no full [M0-R][CI] Consolidate existing workflows into mandatory scientific quality gates and protected PR governance #13 CI consolidation;
• no product-auth/RBAC change;
• no documentation source-of-truth merge;
• no scientific model or patient-specific run.

Rollback

Revert this PR only if a replacement security-governed dependency and branch-protection decision exists. Do not silently restore sqlparse 0.5.4, remove the audit expiry or remove the only check required by branch protection.

Follow-up

#70 must migrate the framework to a supported Django 5.2 LTS patch and remove the Django 4.2 exceptions before their expiry. #13 must then harden and rationalize the aggregate gate.

Closes #69