Upgrade Django to 6.0 with built-in CSP support + wagtail-localize (#444). Fix #443

[Raghaddahi]

Fixes #443

Description

Upgrade the project from Django 5.2 to 6.0. Includes CSP migration to Django 6.0 built-in support, wagtail-localize bump to 1.13, and removal of deprecated settings.

Methodology and assumptions

• Treated the project as a site/app, so the Django constraint was bumped to a single new range.
• Used Poetry 2.2.1 for dependency management.
• Re-ran the project's own make targets (lint, test, check) plus extra deprecation-warning checks.
• No unrelated lint/formatting changes included.

Changes

Change	File(s)
Django version bump	pyproject.toml
wagtail-localize upgrade	pyproject.toml
CSP migration to Django built-in	apps/guide/settings/base.py, apps/guide/settings/production.py
Fix locale in HomePageFactory	apps/core/factories.py
Remove deprecated SECURE_BROWSER_XSS_FILTER	apps/guide/settings/base.py

Django 6.0 considerations reviewed

• DEFAULT_AUTO_FIELD — already set to BigAutoField in settings, no change needed.
• URLField default scheme — no custom code affected.
• Model.save() positional args — all calls use keyword args or no args.
• Built-in CSP support — adopted to replace django-csp package.

Post-upgrade fix discovered during QA

Wagtail's search backend requires django.contrib.postgres in INSTALLED_APPS for PostgreSQL SearchVectorField support. Added to apps/guide/settings/base.py after encountering system check errors during Django 6.0 compatibility verification.

Testing

Check	Result
make lint	Clean
make test	48 tests passed
python manage.py check	No issues
makemigrations --check --dry-run	No changes
python -Wa manage.py test	No deprecation warnings
make frontend	Build successful

AI usage

AI-assisted: OpenCode (Kimi) used for debugging and PR description drafting; all code reviewed and tested by author.

References

• Django 6.0 release notes
• How to upgrade Django to a newer version

[thibaudcolas]

🚢 🇮🇹