From 920f318601844de354d492ce367dc206da3cf0cf Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Sat, 3 Oct 2026 15:30:38 +0300
Subject: [PATCH] build: Django 5.2.17 LTS

Django 4.2 reached end of life on 2026-04-07.

- Django==5.2.17; django-login-required-middleware 0.9.0 keeps working
  (the authorization matrix passes).
- USE_L10N removed from the settings template.
- Log out is a POST form in the navbar; Django 5 removed GET logout.
- pip-audit in CI no longer ignores the Django 4.2.30 advisories.
- README: Django 5.2, backup step and upgrade notes for existing
  settings and GET logout callers.

python -Wd manage.py test shows no Django deprecation warnings. The live
libvirt suite passes on 5.2 and on 4.2 against a RHEL qemu-kvm host.
---
 .github/workflows/test.yml        | 13 +------------
 README.md                         |  6 +++++-
 accounts/tests.py                 |  2 +-
 conf/requirements.txt             |  2 +-
 templates/navbar.html             |  5 ++++-
 webvirtcloud/settings.py.template |  1 -
 6 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 400b3519..90d960aa 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,19 +68,8 @@ jobs:
       - name: Deployment Checks
         run: python manage.py check --deploy --fail-level ERROR
 
-      # The ignored IDs are Django 4.2.30 advisories, fixed in Django 5.2.17.
-      # Remove them with the Django 5.2 upgrade.
       - name: Audit Installed Packages
-        run: |
-          pip-audit \
-            --ignore-vuln PYSEC-2026-198 \
-            --ignore-vuln PYSEC-2026-199 \
-            --ignore-vuln PYSEC-2026-201 \
-            --ignore-vuln PYSEC-2026-2090 \
-            --ignore-vuln PYSEC-2026-2091 \
-            --ignore-vuln PYSEC-2026-2092 \
-            --ignore-vuln PYSEC-2026-3717 \
-            --ignore-vuln PYSEC-2026-4035
+        run: pip-audit
 
   docker:
     name: Docker Image
diff --git a/README.md b/README.md
index 1164df40..2ad82c6d 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 [![Gitpod ready-to-code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/retspen/webvirtcloud)
 
 # WebVirtCloud
-###### Python >=3.10 & Django 4.2 LTS (tested on Python 3.10 – 3.13)
+###### Python >=3.10 & Django 5.2 LTS (tested on Python 3.10 – 3.13)
 
 ## Purpose and Scope
 
@@ -394,6 +394,10 @@ environment=CSRF_TRUSTED_ORIGINS="https://webvirtcloud.example.com"
 
 ## How To Update
 
+Back up `db.sqlite3` before updating (in Docker it lives in the `data` volume).
+
+Upgrading from Django 4.2: delete `USE_L10N` from `webvirtcloud/settings.py` (Django 5 ignores it). Logging out now needs a POST; links or scripts that call `/accounts/logout/` with GET get 405.
+
 Before running migrations, add `accounts.middleware.ForcePasswordChangeMiddleware`
 to `MIDDLEWARE` in your existing `webvirtcloud/settings.py`, after
 `django.contrib.auth.middleware.AuthenticationMiddleware` (and the OTP/login-required
diff --git a/accounts/tests.py b/accounts/tests.py
index 22cb6a26..3267c7b4 100644
--- a/accounts/tests.py
+++ b/accounts/tests.py
@@ -76,7 +76,7 @@ class AccountsTestCase(TestCase):
         )
         self.assertRedirects(response, settings.LOGIN_REDIRECT_URL)
 
-        response = client.get(reverse("accounts:logout"))
+        response = client.post(reverse("accounts:logout"))
         self.assertRedirects(response, reverse("accounts:login"))
 
     def test_change_password(self):
diff --git a/conf/requirements.txt b/conf/requirements.txt
index 7435ab46..30d0260f 100644
--- a/conf/requirements.txt
+++ b/conf/requirements.txt
@@ -1,4 +1,4 @@
-Django==4.2.30
+Django==5.2.17
 django_bootstrap5==26.2
 django-bootstrap-icons==0.9.0
 django-login-required-middleware==0.9.0
diff --git a/templates/navbar.html b/templates/navbar.html
index 72f38925..e71867ba 100644
--- a/templates/navbar.html
+++ b/templates/navbar.html
@@ -44,7 +44,10 @@
             </a>
             <a class="dropdown-item {% view_active request 'accounts:profile' %}" href="{% url 'accounts:profile' %}">{% bs_icon 'person-vcard' %} {% trans "Profile" %}</a>
             <div class="dropdown-divider"></div>
-            <a class="dropdown-item" href="{% url 'accounts:logout' %}">{% bs_icon 'power' %}  {% trans "Log Out" %}</a>
+            <form method="post" action="{% url 'accounts:logout' %}">
+              {% csrf_token %}
+              <button type="submit" class="dropdown-item">{% bs_icon 'power' %}  {% trans "Log Out" %}</button>
+            </form>
           </div>
         </li>
       </ul>
diff --git a/webvirtcloud/settings.py.template b/webvirtcloud/settings.py.template
index d77cf51c..9a35b25a 100644
--- a/webvirtcloud/settings.py.template
+++ b/webvirtcloud/settings.py.template
@@ -141,7 +141,6 @@ TIME_ZONE = "UTC"
 
 USE_I18N = True
 
-USE_L10N = True
 
 USE_TZ = True