chore(deps): bump Django, django-guardian, django-filter, drf-spectacular-sidecar

- django 5.2.17 -> 5.2.18 (security release: DoS fixes in language variant lookup and header parameter parsing, plus other security fixes)
- django-guardian 3.5.0 -> 3.5.2 (GHSA-5729-mvhf-9gq4: get_objects_for_user could return objects missing required permissions; also fixes global permission handling in get_objects_for_group and get_40x_or_None)
- django-filter 26.1 -> 26.2 (LinkWidget label escaping hardening)
- drf-spectacular-sidecar 2026.9.1 -> 2026.10.1

pyproject.toml

@@ -26,22 +26,22 @@ dependencies = [
   "dateparser~=1.4",
   # WARNING: django does not use semver.
   #          Only patch versions are guaranteed to not introduce breaking changes.
-  "django~=5.2.13",
+  "django~=5.2.18",
   "django-allauth[mfa,socialaccount]~=65.20.0",
   "django-auditlog~=3.4.1",
   "django-cachalot~=2.9.0",
   "django-compression-middleware~=0.5.0",
   "django-cors-headers~=4.9.0",
   "django-extensions~=4.1",
-  "django-filter>=25.1,<27",
-  "django-guardian>=3.3.3,<3.6",
+  "django-filter>=26.2,<27",
+  "django-guardian>=3.5.2,<3.6",
   "django-multiselectfield~=1.0.1",
   "django-rich~=2.2.0",
   "django-soft-delete~=1.0.18",
   "django-treenode>=0.24",
   "djangorestframework~=3.16",
   "drf-spectacular~=0.30",
-  "drf-spectacular-sidecar>=2026.7.1,<2026.10",
+  "drf-spectacular-sidecar>=2026.10.1,<2026.11",
   "drf-writable-nested~=0.7.1",
   "filelock>=3.32,<4.3",
   "flower>=2.0.1,<2.3",