Bump whitenoise from 6.7.0 to 6.12.0 in /backend

[dependabot]

Bumps whitenoise from 6.7.0 to 6.12.0.

Changelog

Sourced from whitenoise's changelog.

6.12.0 (2026-02-27)

• Drop Python 3.9 support.
• Fix potential unauthorised file access vulnerability in "autorefesh" mode. See PR [#684](https://github.com/evansd/whitenoise/issues/684) <https://github.com/evansd/whitenoise/pull/684>__ for details, and a reminder that autorefresh mode has always been documented as unsuitable for production use. Thanks Seth Larson for reporting.

6.11.0 (2025-09-18)

• Support Django 6.0.

6.10.0 (2025-09-09)

• Support Python 3.14.

6.9.0 (2025-02-06)

• Support Django 5.2.

6.8.2 (2024-10-29)

• Fix compression speed gains for the thread pool when running Django’s collectstatic. The thread pool had no effect due to use of a generator for the results, a refactoring introduced when reviewing the initial PR.

  Thanks to Petr Přikryl for the investigation and fix in PR [#616](https://github.com/evansd/whitenoise/issues/616) <https://github.com/evansd/whitenoise/pull/616>__.

6.8.1 (2024-10-28)

• Raise any errors from threads in the whitenoise.compress command.

  Regression in 6.8.0. Thanks to Tom Grainger for the spotting this with a comment on PR [#484](https://github.com/evansd/whitenoise/issues/484) <https://github.com/evansd/whitenoise/pull/484#discussion_r1818989096>__.

6.8.0 (2024-10-28)

• Drop Django 3.2 to 4.1 support.

• Drop Python 3.8 support.

• Support Python 3.13.

• Fix a bug introduced in version 6.0.0 where Range requests could lead to database connection errors in other requests.

  Thanks to Per Myren for the detailed investigation and fix in PR [#612](https://github.com/evansd/whitenoise/issues/612) <https://github.com/evansd/whitenoise/pull/612>__.

... (truncated)

Commits

• 1e3a30b Version 6.12.0
• bc4c738 Merge pull request #684 from evansd/use-commonpath
• 505ed8d Use os.path.commonpath() to identify child paths
• b6d8ed4 Upgrade dependencies (#683)
• edc79de [pre-commit.ci] pre-commit autoupdate (#682)
• 79fb2f1 Bump the github-actions group with 2 updates (#680)
• 2b245df [pre-commit.ci] pre-commit autoupdate (#681)
• dcb50f3 Upgrade dependencies (#678)
• 1c4a746 [pre-commit.ci] pre-commit autoupdate (#677)
• e7f970a Bump actions/checkout from 5 to 6 in the github-actions group (#676)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pycon	Ready	Preview	Aug 25, 2026 4:40am

[marcoacierno]

@claude update the lock file

Remember you can rely on CI to run the full test suite

[claude]

Claude finished @marcoacierno's task in 1m 36s —— View job

---

Lock file updated ✅

• Read PR context (backend/pyproject.toml: whitenoise==6.7.0 → 6.12.0)
• Run uv lock in backend/
• Sanity-check the lock diff
• Commit & push to this branch

Pushed d24b702 — backend/uv.lock now matches the bumped pin. The resolution was clean: only whitenoise moved, no transitive churn.

Resolved 236 packages in 863ms
Updated whitenoise v6.7.0 -> v6.12.0

backend/uv.lock diff (4 insertions, 4 deletions):

• requires-dist specifier ==6.7.0 → ==6.12.0
• package version, sdist and wheel entries updated to 6.12.0

Compatibility notes

• The project pins django==5.2.8 and runs Python 3.13 — whitenoise added Django 5.2 support in 6.9.0 and Python 3.13 in 6.8.0, so both are covered. The drops in this range (Django 3.2–4.1, Python 3.8/3.9) don't affect this repo.
• Usage is limited to three spots in backend/pycon/settings/base.py: the whitenoise.runserver_nostatic app (line 84), WhiteNoiseMiddleware (line 134), and CompressedManifestStaticFilesStorage (line 268). None of their APIs changed across 6.7.0 → 6.12.0.
• 6.12.0 includes a fix for a path-traversal issue in autorefresh mode, which this repo doesn't enable (WHITENOISE_AUTOREFRESH is not set, so it defaults to off outside DEBUG).

Verification run here

uv sync --frozen installed 6.12.0 cleanly, and a quick smoke subset passed:

$ uv run pytest api/tests/test_utils.py api/tests/test_error_type.py -q
13 passed, 9 warnings in 2.11s

I deliberately did not run the full suite locally — as you said, CI covers that, and it's now running against the pushed commit.
• branch dependabot/pip/backend/whitenoise-6.12.0

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.08%. Comparing base (2926457) to head (d24b702).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4817   +/-   ##
=======================================
  Coverage   93.08%   93.08%           
=======================================
  Files         356      356           
  Lines       11173    11173           
  Branches      902      902           
=======================================
  Hits        10400    10400           
  Misses        662      662           
  Partials      111      111           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.