Bump djangorestframework from 3.15.2 to 3.17.1 in /backend

[dependabot]

Bumps djangorestframework from 3.15.2 to 3.17.1.

Release notes

Sourced from djangorestframework's releases.

3.17.1

What's Changed

Bug fixes

• Fix HTMLFormRenderer with empty datetime values by @​p-r-a-v-i-n in encode/django-rest-framework#9928

Full Changelog: encode/django-rest-framework@3.17.0...3.17.1

3.17.0

What's Changed

Breaking changes

• Drop support for Python 3.9 by @​auvipy in encode/django-rest-framework#9781
• Drop deprecated coreapi support by @​browniebroke in encode/django-rest-framework#9895

Features

• Add ability to specify output format for DurationField by @​sevdog in encode/django-rest-framework#8532
• Add missing decorators: @versioning_class(), @content_negotiation_class(), @metadata_class() for function-based views by @​qqii in encode/django-rest-framework#9719
• Add support for Python 3.14 by @​cclauss in encode/django-rest-framework#9780
• Support violation_error_code and violation_error_message from UniqueConstraint in UniqueTogetherValidator by @​s-aleshin in encode/django-rest-framework#9766
• Add support for ipaddress objects in JSONEncoder by @​corenting in encode/django-rest-framework#9087
• Add optional support to serialize BigInteger to string by @​HoodyH in encode/django-rest-framework#9775
• Add Django 6.0 support by @​MehrazRumman in encode/django-rest-framework#9819

Bug fixes

• Prevent small risk of Token overwrite by @​mahdirahimi1999 in encode/django-rest-framework#9754
• Fix UniqueTogetherValidator validation when condition references a read-only field by @​ticosax in encode/django-rest-framework#9764
• Fix validation on many to many field when default=None by @​Genarito in encode/django-rest-framework#9790
• Fix invalid SPDX license expression in __init__.py by @​TheFunctionalGuy in encode/django-rest-framework#9799
• Fix HTMLFormRenderer to ensure a valid datetime-local format by @​mgaligniana in encode/django-rest-framework#9365
• Fix mutable default arguments in OrderingFilter methods by @​killerdevildog in encode/django-rest-framework#9742
• Update TokenAdmin to respect USERNAME_FIELD of the user model by @​m000 in encode/django-rest-framework#9836
• Preserve ordering in MultipleChoiceField by @​fbozhang in encode/django-rest-framework#9735

Translations

• Update French translation by @​SebCorbin in encode/django-rest-framework#9770
• Update Brazilian Portuguese translations by @​JVPinheiroReis in encode/django-rest-framework#9828
• Fix and improve French translations by @​deronnax in encode/django-rest-framework#9896
• Add missing Russian translation by @​minorytanaka in encode/django-rest-framework#9903

Packaging

• Migrate packaging to pyproject.toml by @​deronnax in encode/django-rest-framework#9056
• Move package data rules from MANIFEST.in to pyproject.toml by @​p-r-a-v-i-n in encode/django-rest-framework#9825
• Set up release workflow with trusted publisher by @​browniebroke in encode/django-rest-framework#9852

Other changes

• Refactor token generation to use the secrets module by @​mahdirahimi1999 in encode/django-rest-framework#9760
• Add validation for decorator out-of-order with @api_view by @​kernelshard in encode/django-rest-framework#9821
• Switch to mkdocs material theme for documentation by @​browniebroke in encode/django-rest-framework#9849

New Contributors

• @​khaledsukkar2 made their first contribution in encode/django-rest-framework#9717

... (truncated)

Commits

• 22e231c Prepare bug fix release 3.17.1 (#9931)
• 8e99b53 Add condition to skip pushed tags from forks (#9924)
• c0407de Fix HTMLFormRenderer with empty datetime values (#9928)
• 30d58a7 Fix the book sizing in the documentation (#9926)
• 6f03b79 Tweak order of changes in release notes
• 021ab56 Bump version and update release notes for 3.17.0 (#9921)
• 19ebad7 Bump mkdocs-material[imaging] from 9.7.4 to 9.7.5 (#9923)
• f222c55 Correct requires-python key in pyproject.toml
• 7e7de6f Remove code fences from release checklist
• c599d30 Update release process
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pycon	Error		May 6, 2026 4:08am

[marcoacierno]

@claude where do we use DRF in our codebase?

[claude]

Claude finished @marcoacierno's task in 50s —— View job

---

DRF Usage in Codebase

• Search for Django REST Framework imports and usage
• Summarize findings

DRF is used in 3 apps exclusively for webhook and external integration endpoints:

1. notifications/ - AWS SNS Webhook

• Endpoint: /notifications/sns-webhook/
• Purpose: Handles AWS SNS messages (e.g., email bounce notifications from SES)
• Uses: @api_view, custom authentication/permissions

2. association_membership/ - Payment Webhooks

• Endpoint: /stripe-webhook/
• Purpose: Receives Stripe payment events
• Endpoint: /pretix-webhook/
• Purpose: Receives Pretix ticketing events
• Uses: @api_view, custom authentication/permissions

3. integrations/ - Plain.com Integration

• Endpoint: /plain/customer-cards
• Purpose: Provides customer card data to Plain.com support tool
• Uses: @api_view, serializers for validation, custom authentication/permissions

Also used in:

• conftest.py: APIClient for testing REST endpoints

---

Summary: DRF is a lightweight dependency here - it's only used for a handful of webhook receivers and external service integrations, not the main API (which uses GraphQL/Strawberry). The upgrade should be low-risk since the usage is limited to basic decorators, responses, and authentication classes.