[marcoacierno]

Fixes all the warnings in the backend test job (e.g. run 42327842658). Locally the suite now runs with 0 warnings (708 before).

Changes

Warning	Fix
GrantResource / RankSubmissionResource: ignoring field ... because not declared in 'fields' whitelist	django-import-export 4 (upgraded in #4841) ignores declared fields that aren't in Meta.fields. Since that upgrade, the grant export has been missing age_group, email, has_sent_submission, submission_title, submission_tags, submission_admin_link, submission_pycon_link, grant_admin_link, and the ranking export has been missing submission__title. They're back in the whitelists, in the same order v3 produced. Added regression tests.
RemovedInDjango60Warning: URLField default scheme will change to https	Opted into the Django 6 default. Admins and inlines with URL fields set formfield_overrides = HTTPS_URL_FORMFIELD_OVERRIDES. Module-level ModelForms set Meta.formfield_callback = formfield_with_https_urls, because ModelAdmin replaces that callback with its own. Behaviour change: a URL typed in the admin without a scheme (example.com) is saved as https://example.com instead of http://example.com. A new test builds every registered admin and inline form and checks that its URL fields assume https, so a future admin that misses the override fails.
xdist: --rsyncdir ... deprecated	pytest-cov 4.1.0 passed --rsyncdir to xdist. Bumped to 7.1.0 (rsync support was removed in 5.0).
sentry: push_scope is deprecated, Scope.user setter is deprecated	sentry_sdk.new_scope() + scope.set_user() in pretix.create_order.
pypdf: remove_identicals / remove_orphans deprecated	Switched to remove_duplicates / remove_unreferenced.
WhiteNoise: No directory at: .../backend/static/	collectstatic never runs in CI, so test settings now drop the WhiteNoise middleware (same pattern as the debug toolbar). This one made up most of the 708 warnings.
WeasyPrint: HarfBuzz-Subset will be required	CI now installs libharfbuzz-subset0, which the production Dockerfile already installs.
Actions: Node.js 20 is deprecated (+ punycode deprecation in post-job)	actions/setup-python v5.6.0 → v7.1.0 (pinned SHA) in all workflows. v7 only removed the pip-install input, which we don't use.

Note on the setup-uv cache annotation

The first CI run of this PR showed Failed to save: Unable to reserve cache. Backend tests, Backend checks and GraphQL schema all start in parallel with the same setup-uv cache key whenever uv.lock changes, so only one of them can save it. A rerun got a cache hit and showed no annotation. It only shows on the first run after a lockfile change, so I didn't change anything for it.

Testing

• Full suite in Docker with -n 8 --cov: 1370 passed, 0 warnings, coverage 92.17%.
• I checked that the new tests fail without their fixes. For the admin test, removing any single formfield_overrides makes it fail.
• I couldn't reproduce the WhiteNoise and WeasyPrint warnings locally (the dev container has static/ and harfbuzz-subset), so CI confirms those two: the PR run shows neither.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pycon	Ready	Preview	Nov 7, 2026 2:26pm UTC

[claude]

Summary: Bundles several unrelated changes: admin URL fields default to https via formfield_overrides, extra grant/voting export columns, and dependency/CI bumps (setup-python, pytest-cov, pypdf kwargs, sentry scope API, libharfbuzz).

Issues

• backend/uv.lock: revision goes from 5 to 3. This looks like the lock was regenerated with an older uv than the pinned 0.12.5. Re-lock with the pinned version to avoid churn or CI lock-check failures.
• backend/pycon/settings/test.py: MIDDLEWARE.remove("whitenoise...") raises ValueError if the middleware isn't in the base settings. Guard it the same way as the debug-toolbar line above it.
• HTTPS_URL_FORMFIELD_OVERRIDES has to be added to every admin and inline by hand, and also needs formfield_callback on custom forms. Any new admin silently misses it. The all-admins test does catch this. A shared base ModelAdmin/mixin would be more robust.
• backend/badge_scanner/admin.py and backend/events/admin.py: the import placement leaves a stray extra blank line, and google_api/admin.py mixes the new import into the third-party block. Run ruff format/ruff check.
• Scope: the grant export columns, the voting export column, the sentry/pypdf API changes and the CI dependency bumps are unrelated to the URL change. Consider splitting them so they can be reviewed and reverted independently. The visa compress_identical_objects kwarg rename and the sentry new_scope change have no tests. Confirm the pinned pypdf and sentry-sdk versions actually support those names.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.43%. Comparing base (a1e0b2b) to head (ab27559).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4855   +/-   ##
=======================================
  Coverage   92.42%   92.43%           
=======================================
  Files         360      360           
  Lines       10935    10938    +3     
  Branches      949      949           
=======================================
+ Hits        10107    10110    +3     
  Misses        706      706           
  Partials      122      122           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.