build: upgrade to Django 5.2 and django-cms 4.x

This commit upgrades the project from Django 4.2.x to Django 5.2 and
from django-cms 3.11.x to django-cms 4.x with djangocms-versioning.

Key changes:

**Django 5.2 compatibility:**
- Logout now requires POST instead of GET
- User.objects.make_random_password() removed - use secrets module
- Form field choices return tuples instead of lists

**CMS 4.x with djangocms-versioning:**
- Page.is_published() removed - use Version model to check state
- page.publish() removed - use versioning API via _publish_page() helper
- api.create_page() requires created_by parameter for version creation
- Placeholders are on PageContent, not Page
- Use PageContent.admin_manager to access draft content

**Test infrastructure:**
- Added cms_tools helpers: _cleanup_cms_test_user(), user_queryset()
- Updated OIDC tests to exclude CMS system user from counts
- Fixed menu tests for CMS 4.x versioning behavior
- Added data migration for ExtendedCMSLink link field

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: alextreme

pyproject.toml

@@ -1,7 +1,7 @@
 [project]
 name = "open-inwoner"
 version = "2.0.0-dev"
-requires-python = "== 3.12"
+requires-python = ">=3.12"
 
 [tool.uv.pip]
 no-emit-package = [

requirements/base.in

@@ -3,7 +3,7 @@ Pillow>=9.0.0 # handle images
 psycopg2  # database driver
 pytz  # handle timezones
 python-dotenv  # environment variables for secrets
-python-decouple  # processing of envvar configs
+python-decouple>=3.8  # processing of envvar configs (3.8+ needed for Python 3.12)
 geopy # geo decoder
 glom # processing nested data
 furl # processing urls
@@ -14,10 +14,13 @@ pydantic[email]
 typing-extensions
 
 # Framework libraries
-Django>=4.2,<5.0
+Django>=5.2,<6.0
 django-admin-index
-django-axes
+django-axes>=7.0.0  # 7.0+ needed for Python 3.12
+django-formtools>=2.5  # 2.5+ needed for Python 3.12
 django-filer
+django-polymorphic>=4.0.0  # 4.0+ removes pkg_resources dependency (needed for Python 3.12+)
+easy-thumbnails>=2.9  # 2.9+ needed for Django 5.x
 django-ordered-model
 django-redis
 django-sniplates
@@ -55,11 +58,13 @@ django-yubin
 django-structlog
 jinja2
 
-# django cms
-django-cms
-djangocms-link
-djangocms-file
-djangocms-picture
+# django cms (upgraded to 4.x for Django 5.2 compatibility)
+django-cms>=4.1.0,<5.0
+djangocms-versioning  # provides publishing workflow for CMS 4.x
+djangocms-text  # replaces djangocms-text-ckeditor in CMS 4.x
+djangocms-link>=4.0.0
+djangocms-file  # Note: 3.0.1 may need patches for CMS 4.x
+djangocms-picture>=4.0.0
 # djangocms-video
 # djangocms-googlemap
 # djangocms-snippet
@@ -99,7 +104,7 @@ git+https://github.com/maykinmedia/django-celery-monitor@74b1252#egg=django_cele
 # Common Ground integration
 zgw-consumers
 zgw-consumers-oas
-notifications-api-common
+notifications-api-common>=0.10.0  # 0.10+ drops gemma-zds-client dependency (pkg_resources issue)
 objects-api-client-django
 
 

requirements/base.txt

@@ -8,11 +8,13 @@ annotated-types==0.6.0
     # via pydantic
 ape-pie==0.1.0
     # via
+    #   notifications-api-common
     #   objects-api-client-django
     #   zgw-consumers
-asgiref==3.7.2
+asgiref==3.11.1
     # via
     #   django
+    #   django-axes
     #   django-htmx
     #   django-structlog
 asn1crypto==1.5.1
@@ -97,7 +99,7 @@ defusedxml==0.7.1
     # via odfpy
 diff-match-patch==20200713
     # via django-import-export
-django==4.2.28
+django==5.2.11
     # via
     #   -r requirements/base.in
     #   django-admin-index
@@ -118,6 +120,7 @@ django==4.2.28
     #   django-filer
     #   django-filter
     #   django-formtools
+    #   django-fsm-2
     #   django-health-check
     #   django-htmx
     #   django-import-export
@@ -170,9 +173,9 @@ django-appdata==0.4.0
     # via aldryn-apphooks-config
 django-autoslug==1.9.8
     # via -r requirements/base.in
-django-axes==5.25.0
+django-axes==8.1.0
     # via -r requirements/base.in
-django-celery-beat==2.6.0
+django-celery-beat==2.8.1
     # via -r requirements/base.in
 django-celery-monitor @ git+https://github.com/maykinmedia/django-celery-monitor@74b12529dcdd6923a4deed4c4b6fd3c9fc56eecd#egg=django_celery_monitor
     # via -r requirements/base.in
@@ -184,41 +187,44 @@ django-classy-tags==4.0.0
     # via
     #   django-cms
     #   django-sekizai
-django-cms==3.11.1
+django-cms==4.1.9
     # via
     #   -r requirements/base.in
     #   aldryn-apphooks-config
     #   djangocms-attributes-field
     #   djangocms-file
     #   djangocms-link
     #   djangocms-picture
+    #   djangocms-versioning
 django-colorfield==0.4.5
     # via -r requirements/base.in
 django-cors-headers==3.10.0
     # via -r requirements/base.in
 django-csp==3.7
     # via -r requirements/base.in
-django-csp-reports==1.9.1
+django-csp-reports==1.10.0
     # via -r requirements/base.in
 django-digid-eherkenning[oidc] @ git+https://github.com/maykinmedia/django-digid-eherkenning@8be5292813d58eda2910cd0a535baa39fc566006#egg=django-digid-eherkenning
     # via -r requirements/base.in
 django-elasticsearch-dsl==8.2
     # via -r requirements/base.in
 django-extra-fields==3.0.2
     # via -r requirements/base.in
-django-filer==3.1.1
+django-filer==3.4.3
     # via
     #   -r requirements/base.in
     #   djangocms-file
-    #   djangocms-link
     #   djangocms-picture
     #   maykin-django-prosemirror
 django-filter==21.1
     # via -r requirements/base.in
-django-formtools==2.3
+django-formtools==2.5.1
     # via
+    #   -r requirements/base.in
     #   django-cms
     #   django-two-factor-auth
+django-fsm-2==4.1.0
+    # via djangocms-versioning
 django-health-check==3.20.8
     # via maykin-common
 django-htmx==1.23.0
@@ -228,9 +234,7 @@ django-image-cropping==1.7
 django-import-export==2.6.1
     # via -r requirements/base.in
 django-ipware==4.0.0
-    # via
-    #   django-axes
-    #   django-structlog
+    # via django-structlog
 django-js-asset==2.2.0
     # via django-ckeditor
 django-jsonform==2.22.0
@@ -251,8 +255,10 @@ django-otp==1.3.0
     # via django-two-factor-auth
 django-phonenumber-field==5.2.0
     # via django-two-factor-auth
-django-polymorphic==3.0.0
-    # via django-filer
+django-polymorphic==4.10.5
+    # via
+    #   -r requirements/base.in
+    #   django-filer
 django-privates==3.1.1
     # via
     #   -r requirements/base.in
@@ -317,10 +323,14 @@ djangocms-attributes-field==2.1.0
     #   djangocms-picture
 djangocms-file==3.0.1
     # via -r requirements/base.in
-djangocms-link==3.1.1
+djangocms-link==5.1.0
     # via -r requirements/base.in
 djangocms-picture==4.1.1
     # via -r requirements/base.in
+djangocms-text==0.9.3
+    # via -r requirements/base.in
+djangocms-versioning==2.5.0
+    # via -r requirements/base.in
 djangorestframework==3.16.1
     # via
     #   -r requirements/base.in
@@ -337,8 +347,9 @@ docutils==0.21.2
     # via django-setup-configuration
 drf-spectacular==0.20.1
     # via -r requirements/base.in
-easy-thumbnails[svg]==2.8.5
+easy-thumbnails[svg]==2.10.1
     # via
+    #   -r requirements/base.in
     #   django-filer
     #   djangocms-picture
 ecs-logging==2.1.0
@@ -366,8 +377,6 @@ furl==2.1.3
     #   -r requirements/base.in
     #   ape-pie
     #   django-digid-eherkenning
-gemma-zds-client==2.0.0
-    # via notifications-api-common
 geographiclib==1.52
     # via geopy
 geopy==2.2.0
@@ -407,6 +416,7 @@ kombu==5.5.4
 lxml==6.0.0
     # via
     #   django-digid-eherkenning
+    #   djangocms-text
     #   mail-editor
     #   maykin-python3-saml
     #   prosemirror
@@ -446,7 +456,9 @@ mozilla-django-oidc-db[setup-configuration]==0.23.0
     # via
     #   -r requirements/base.in
     #   django-digid-eherkenning
-notifications-api-common==0.2.2
+nh3==0.3.2
+    # via djangocms-text
+notifications-api-common==0.10.1
     # via -r requirements/base.in
 oath==1.4.4
     # via -r requirements/base.in
@@ -511,6 +523,9 @@ orderedmultidict==1.0.1
     # via furl
 packaging==23.0
     # via
+    #   django-cms
+    #   djangocms-text
+    #   djangocms-versioning
     #   kombu
     #   opentelemetry-instrumentation
 phonenumbers==8.13.29
@@ -520,6 +535,7 @@ phonenumberslite==8.13.29
 pillow==10.3.0
     # via
     #   -r requirements/base.in
+    #   djangocms-text
     #   easy-thumbnails
     #   reportlab
     #   weasyprint
@@ -555,7 +571,6 @@ pygments==2.19.2
     # via rich
 pyjwt==2.8.0
     # via
-    #   gemma-zds-client
     #   messagebird
     #   zgw-consumers
 pyopenssl==25.1.0
@@ -577,7 +592,7 @@ python-dateutil==2.8.2
     #   faker
     #   messagebird
     #   python-crontab
-python-decouple==3.5
+python-decouple==3.8
     # via
     #   -r requirements/base.in
     #   maykin-common
@@ -594,7 +609,6 @@ pytz==2021.3
 pyyaml==6.0.2
     # via
     #   drf-spectacular
-    #   gemma-zds-client
     #   pydantic-settings
     #   tablib
     #   zgw-consumers-oas
@@ -613,7 +627,6 @@ requests==2.32.5
     #   ape-pie
     #   django-log-outgoing-requests
     #   django-open-forms-client
-    #   gemma-zds-client
     #   mail-editor
     #   maykin-common
     #   maykin-python3-saml
@@ -651,7 +664,9 @@ sqlparse==0.5.3
 structlog==25.4.0
     # via django-structlog
 svglib==1.5.1
-    # via easy-thumbnails
+    # via
+    #   django-filer
+    #   easy-thumbnails
 tablib[html, ods, xls, xlsx, yaml]==3.1.0
     # via django-import-export
 tinycss2==1.5.1
@@ -725,7 +740,7 @@ xmlsec==1.3.16
     # via maykin-python3-saml
 xsdata==23.8
     # via -r requirements/base.in
-zgw-consumers==0.38.1
+zgw-consumers==1.2.0
     # via
     #   -r requirements/base.in
     #   notifications-api-common