[baealex]

🎯 Goal

• Resolve the current backend and frontend dependency security findings.
• Apply patch-level fixes now because they remove known vulnerabilities without changing application contracts or database schema.

🔧 Core Changes

• Upgrade Django from 6.0.7 to 6.0.8 for the latest 6.0 security fixes.
• Upgrade sqlparse from 0.5.5 to 0.6.0 for the current Dependabot advisories.
• Upgrade the transitive development dependency nanoid from 3.3.17 to 3.3.18 through the existing pnpm override.

🤔 Key Decisions

• Keep Django on the existing 6.0 release line instead of mixing a framework feature upgrade into a security patch.
• Limit the JavaScript change to the existing transitive override because nanoid is only reached through build tooling.
• Avoid unrelated dependency refreshes so the patch remains small and reviewable.

🧪 Verification Guide

How to verify

1. Run npm audit --audit-level=high, pnpm audit --audit-level=high, pnpm audit --prod --audit-level=high, and pip-audit -r backend/src/requirements.txt.
2. Run npm run server:check-migrations and npm run server:test.
3. Run npm run islands:test, npm run islands:type-check, npm run islands:lint, and npm run islands:build.

Expected result

• All dependency audits report no known vulnerabilities.
• All 1,470 backend tests pass with no migration changes.
• Islands tests, type checks, lint, and production build pass; lint retains seven existing warnings and no errors.

✅ Checklist

• Lint completed
• Type-check completed
• Tests completed
• Documentation updated (not needed: dependency-only patch)