chore: tighten Pipfile — security patches, test deps to dev, audit tooling

[udernaeb]

Addresses several Pipfile hygiene issues: security-vulnerable runtime deps, test tooling leaking into the production image, and a duplicate pytest-django constraint causing an unsatisfiable lockfile.

Dependency changes

• Security patches: django → 5.2.13, djangorestframework → 3.17.1, django-cors-headers → 4.9.0
• Build tooling: added setuptools==82.0.1, wheel==0.46.3 to [packages]
• Dev tooling upgrades: black → 26.3.1, isort → 8.0.1
• New dev tools: pip-audit, safety, pipdeptree, pip-licenses

Test deps moved to [dev-packages]

pytest, pytest-django, pytest-cov were under [packages], causing them to be installed in the runtime container (pipenv install in docker/Dockerfile). Also resolves the conflicting duplicate pytest-django entry:

# Before
[packages]
pytest = "*"
pytest-django = "*"   # conflicts with dev-packages pin below
pytest-cov = "*"

[dev-packages]
pytest-django = "4.8.0"  # lockfile was resolving ==4.12.0 — unsatisfiable

# After
[packages]
# test tooling removed

[dev-packages]
pytest = "*"
pytest-django = "4.8.0"
pytest-cov = "*"

Other

• .gitignore: added results/ and requirements.txt
• Pipfile.lock regenerated

[Copilot]

Pull request overview

Updates Python dependency set to patched versions (notably Django/DRF) and adds dependency/security tooling, aiming to address security concerns and improve auditing for this Django REST API codebase.

Changes:

• Pin security-critical runtime dependencies (Django 5.2.13, DRF 3.17.1, django-cors-headers 4.9.0) and refresh lockfile resolutions.
• Add/upgrade dev tooling (black/isort) and introduce auditing/license tools (pip-audit, safety, pipdeptree, pip-licenses).
• Extend .gitignore to ignore results/ and requirements.txt.

Reviewed changes

Copilot reviewed 1 out of 3 changed files in this pull request and generated 3 comments.

File	Description
Pipfile	Pins core deps; adds setuptools/wheel; adds dev audit/license tooling.
Pipfile.lock	Re-locks dependency graph to updated versions and new tooling deps.
.gitignore	Ignores results/ and requirements.txt.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Copilot reviewed 1 out of 3 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[udernaeb]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Updated the PR description to comprehensively cover all changes in the branch:

• Security-critical runtime dependency upgrades (Django 5.2.13, DRF 3.17.1, django-cors-headers 4.9.0) with rationale
• Addition of setuptools/wheel to [packages]
• Move of test deps (pytest, pytest-django, pytest-cov) to [dev-packages]
• Dev tooling upgrades (black, isort) and new audit tools (pip-audit, safety, etc.)
• .gitignore and Pipfile.lock updates

The PR description now accurately reflects the full scope of changes rather than just the test-dependency move.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 3 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[freefri]

i blindly approve this