A patched admin, and a framework we can keep moving

Django shipped a security release on 4 August, and one of its four issues reaches anyone running their own copy: the admin turned stored URL values into clickable links without checking the scheme first, so a value saved by a customer could run code in the session of whoever opened the list. We are on the patched release, with a test that fails if anyone steps back below it. The framework itself moved to 6.1 along the way, and the one package holding it back turned out to be switched off and no longer needed.

• On the patched Django release, with the admin link fix in place
• The upgrade needed no code changes and no database migration
• A dependency that had been dormant since the switch to slug-based separation is gone, so future upgrades are not blocked by it
• Nothing changes for hosted publications; this matters if you run PayGlue yourself