[matteius]

This fixes authorization and input-trust failures that allowed unsafe SSO account linking, access to private submission receipts and analytics, forged upload references, and server-side requests during PDF rendering. It also raises dependency security minimums and tests supported Django branches in CI.

Security changes

• Replace email-based SSO account matching with explicit provider/subject bindings; reject disabled accounts and inactive API-token owners.
• Authorize submission receipts, bind anonymous receipts to the submitting session, and escape/sanitize success-message answers.
• Recover validated uploads from the session instead of browser-supplied metadata; protect draft/autosave file references and validate uploads before storage.
• Escape PDF template answers and block network/file resource fetching by default for individual and bulk PDFs.
• Enforce login and one-per-user rules on embedded forms, and model permissions on custom builder/sync endpoints. Workflow builder GETs no longer create records.
• Scope analytics and exports to visible submissions, escape chart JSON, and neutralize CSV formulas.
• Use trusted-proxy rules and atomic rate-limit counters; reject public submissions if the cache fails and flag unsuitable production cache backends.

Dependencies and rollout

• Require Python 3.11+ and Django security patch minimums of 5.2.18, 6.0.9, or 6.1.2; refresh Python and JavaScript locks, including Pillow, jaraco.context, and Vitest.
• Expand CI across Django 5.2/6.0/6.1 and Python 3.11–3.14, and add JavaScript tests and dependency audits.
• Make the example production settings explicit, with HTTPS, secure cookies, environment-provided secrets, shared caching, and SMTP/MAILERS configuration.

Read docs/SECURITY_UPGRADE.md before rollout. Existing deployments need explicit SSO bindings, suitable staff model permissions, and a shared Redis/Memcached cache. Remote PDF assets must become embedded raster images or use a reviewed custom fetcher. Existing SSO associations and suspicious pre-upgrade file metadata require review. No database schema migration is needed.

Validation

• Python 3.13 / Django 5.2.18: 823 passed, 1 skipped.
• Python 3.11 / Django 5.2.18: 823 passed, 1 skipped.
• Python 3.12 / Django 6.0.9: 823 passed, 1 skipped.
• Python 3.13 / Django 6.1.2: 823 passed, 1 skipped.
• Includes 45 new security regression cases; JavaScript: 222 passed.
• All locked Python dependency versions and the npm lock scan report no known vulnerabilities.
• Ruff lint/format, diff checks, wheel/sdist builds, and dependency metadata checks passed.
• Configured production example deployment checks and migration-drift checks passed on Django 5.2.18 and 6.1.2.

Validation used local SQLite and synthetic/mocked identity/storage integrations; live SSO, LDAP, production databases, SMTP delivery, and shared-cache connectivity were not exercised. Django 5.2 runs retain three URLField deprecation warnings.