I think there is still a mention here:

This one should be removed:

And this one should be changed to pyproject.toml:

Also this:

I think there is still a mention here:

django-rest-framework/docs/community/project-management.md

Lines 84 to 88 in c847be5

	## Project requirements
	All our test requirements are pinned to exact versions, in order to ensure that our test runs are reproducible. We maintain the requirements in the `requirements` directory. The requirements files are referenced from the `tox.ini` configuration file, ensuring we have a single source of truth for package versions used in testing.
	Package upgrades should generally be treated as isolated pull requests. You can check if there are any packages available at a newer version, by using the `pip list --outdated`.

This one should be removed:

django-rest-framework/.github/workflows/main.yml

Line 31 in b05db8b

cache-dependency-path: 'requirements/*.txt'

And this one should be changed to pyproject.toml:

django-rest-framework/.github/workflows/mkdocs-deploy.yml

Line 10 in 1c4af77

- requirements/requirements-documentation.txt

Also this:

django-rest-framework/.github/workflows/mkdocs-deploy.yml

Line 28 in 1c4af77

- run: pip install -r requirements/requirements-documentation.txt

Thanks for catching this.

Looking at the logs more closely, I think something isn't right:

py310-django42: asgiref==3.11.0,attrs==22.1.0,certifi==2025.11.12,charset-normalizer==3.4.4,coreapi==2.3.1,coreschema==0.0.4,coverage==7.13.0,Django==5.2.9,django-filter==25.2,django-guardian==2.4.0,djangorestframework @ file:///home/runner/work/django-rest-framework/django-rest-framework/.tox/.tmp/package/1/djangorestframework-3.16.1.tar.gz#sha256=2aed51d9d37a155d67965e004f4c13de30000ed00f4d684a7009a7b3d5fa5e37,exceptiongroup==1.3.1,idna==3.11,importlib-metadata==4.13.0,inflection==0.5.1,iniconfig==2.3.0,itypes==1.2.0,Jinja2==3.1.6,Markdown==3.10,MarkupSafe==3.0.3,packaging==25.0,pip==25.3,pluggy==1.6.0,psycopg==3.3.2,psycopg-binary==3.3.2,Pygments==2.17.2,pytest==7.4.4,pytest-cov==4.1.0,pytest-django==4.11.1,pytz==2025.2,PyYAML==5.3.1,requests==2.32.5,setuptools==80.9.0,sqlparse==0.5.4,tomli==2.3.0,typing_extensions==4.15.0,uritemplate==4.2.0,urllib3==2.6.2,zipp==3.23.0
py310-django42: commands[0]> python -W error::DeprecationWarning -W error::PendingDeprecationWarning runtests.py --coverage
/home/runner/work/django-rest-framework/django-rest-framework/.tox/venvs/py310-django42/lib/python3.10/site-packages/coreapi/utils.py:5: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
  import pkg_resources
============================= test session starts ==============================
platform linux -- Python 3.10.19, pytest-7.4.4, pluggy-1.6.0
cachedir: .tox/venvs/py310-django42/.pytest_cache
django: version: 5.2.9
rootdir: /home/runner/work/django-rest-framework/django-rest-framework
configfile: pyproject.toml
plugins: django-4.11.1, cov-4.1.0
collected 1618 items

The py310-django42 tox target runs rightfully on Python 3.10 but it runs against Django 5.2

The py310-django42 tox target runs rightfully on Python 3.10 but it runs against Django 5.2

may be bcs of this step
py310-django42: install_package_deps> python -I -m pip install 'django>=4.2'

Right so tox does:

1. install deps from tox target py312-django42: install_deps> pip install 'Django<5.0,>=4.2'
2. Install dependency-groups
3. Install package deps py312-django42: install_package_deps> pip install 'django>=4.2'
4. Install package py312-django42: install_package> pip install --reinstall --no-deps .

So I initially assumed step 3 overrides the version from step 1, but it's actually overridden in step 2 (by running tox -re py312-django42 -vv)

DEBUG Requirement installed, but mismatched:
  Installed: InstalledDist { kind: Registry(InstalledRegistryDist { name: PackageName("django"), version: "4.2.27", path: ".../.tox/venvs/py312-django42/lib/python3.12/site-packages/django-4.2.27.dist-info", cache_info: None, build_info: None }), metadata_cache: OnceLock(<uninit>), tags_cache: OnceLock(<uninit>) }
  Requested: Registry { specifier: VersionSpecifiers([VersionSpecifier { operator: Equal, version: "6.0" }]), index: Some(IndexMetadata { url: Pypi(VerbatimUrl { url: DisplaySafeUrl { scheme: "https", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("pypi.org")), port: None, path: "/simple", query: None, fragment: None }, given: None }), format: Simple }), conflict: None }

So one of our testing or optional dependency is requesting a Django version newer than 4.2, causing it to upgrade. It's a bit annoying that the incompatibility is not flagged more loudly 😞