GeezerVison

Updates strawberry-graphql to address GHSA-pfvf-fwfp-25mp (PYSEC-2026-4303) and GHSA-m952-2w3f-6r8h (PYSEC-2026-4302).

Evidence:

• backend/uv.lock referenced [email protected]
• osv-scanner reported PYSEC-2026-4303 (GHSA-pfvf-fwfp-25mp) and PYSEC-2026-4302 (GHSA-m952-2w3f-6r8h) on 0.324.0 before the update
• updated version: [email protected], still compatible with strawberry-graphql-django==0.87.0 (requires strawberry-graphql>=0.310.1)

Validation:

• osv-scanner no longer reports any advisory for strawberry-graphql on the updated backend/uv.lock
• uv lock --check passes
• isolated venv install of strawberry-graphql==0.327.7 with strawberry-graphql-django==0.87.0: both import, schema builds and executes

Not run locally: cd backend && uv run pytest (the command documented in AGENTS.md). The environment build fails on uwsgi==2.0.30 linking libpython3.14, which is unrelated to this change; the project docs use docker compose for local development. strawberry-graphql-django and the Django pins are untouched.

Note: osv-scanner still reports separate pre-existing advisories on other pins in this lockfile, including django 5.2.8 (30 IDs, among them GHSA-pwjp-ccjc-ghwg at CVSS 9.8), pillow 12.2.0 (14), wagtail 7.3.2 (10), urllib3 2.7.0 (3), nltk 3.10.3, oauthlib 3.3.1, werkzeug 3.1.8, tablib 3.5.0, djangorestframework 3.17.1. This patch only clears the strawberry-graphql advisories.

Scope: dependency pin and lockfile update only (backend/pyproject.toml, backend/uv.lock).