From df4b1f4da6ba295672adf79892fa48e3e355f678 Mon Sep 17 00:00:00 2001
From: catborise <catborise@gmail.com>
Date: Sun, 11 Oct 2026 20:40:19 +0300
Subject: [PATCH] build(deps): djangorestframework 3.18.3

3.18.2 hardens content negotiation against large Accept headers
(GHSA-33wh-fxxf-88vv) and refuses non-text charsets
(GHSA-3547-9m27-7rxg); the API reads both. 3.18 drops Django < 5.2 and
reports list serializer errors as a dict; the API's many=True
serializers only render output.
---
 conf/requirements.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/conf/requirements.txt b/conf/requirements.txt
index 1f2d2bd0..f4e44eec 100644
--- a/conf/requirements.txt
+++ b/conf/requirements.txt
@@ -5,7 +5,7 @@ django-otp==1.7.3
 django-qr-code==4.2.0
 django-auth-ldap==5.3.0
 django-axes==8.3.1
-djangorestframework==3.17.2
+djangorestframework==3.18.3
 drf-nested-routers==0.95.3
 drf-spectacular[sidecar]==0.30.0
 eventlet==0.41.2