From 2c135f679f196be580c148407246a807d1192f5e Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Tue, 13 Oct 2026 13:23:07 -0400 Subject: [PATCH 1/2] fix: upgrade openedx-forum to 0.2.1 Security release of the forum app for GHSA-c6fp-f54c-6cv4: the forum HTTP API is no longer routed unless FORUM_ENABLE_HTTP_API is set, and requires a staff caller when it is. https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4 Co-Authored-By: Claude Opus 5.5 --- requirements/edx/base.txt | 2 +- requirements/edx/development.txt | 2 +- requirements/edx/doc.txt | 2 +- requirements/edx/testing.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt index 94084345ad47..3aa59ed9894c 100644 --- a/requirements/edx/base.txt +++ b/requirements/edx/base.txt @@ -838,7 +838,7 @@ openedx-filters==1.11.0 # -r requirements/edx/kernel.in # lti-consumer-xblock # ora2 -openedx-forum==0.2.0 +openedx-forum==0.2.1 # via -r requirements/edx/kernel.in openedx-learning==0.18.1 # via diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt index c0667cf4959c..89f1823608e8 100644 --- a/requirements/edx/development.txt +++ b/requirements/edx/development.txt @@ -1393,7 +1393,7 @@ openedx-filters==1.11.0 # -r requirements/edx/testing.txt # lti-consumer-xblock # ora2 -openedx-forum==0.2.0 +openedx-forum==0.2.1 # via # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt index a5ed7ac21f28..ded2a192b51a 100644 --- a/requirements/edx/doc.txt +++ b/requirements/edx/doc.txt @@ -1007,7 +1007,7 @@ openedx-filters==1.11.0 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.2.0 +openedx-forum==0.2.1 # via -r requirements/edx/base.txt openedx-learning==0.18.1 # via diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt index 309887480f96..1a9bd7041cf1 100644 --- a/requirements/edx/testing.txt +++ b/requirements/edx/testing.txt @@ -1052,7 +1052,7 @@ openedx-filters==1.11.0 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.2.0 +openedx-forum==0.2.1 # via -r requirements/edx/base.txt openedx-learning==0.18.1 # via From 44b4ab2986fadf63c5c75c67b6284608934ce0af Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Wed, 14 Oct 2026 10:38:40 -0400 Subject: [PATCH 2/2] build: keep Sumac's dropped common constraints locally `make compile-requirements` downloads common_constraints.txt from edx-lint's master branch, which has since dropped Django<5.0, pip<24.3 and urllib3<2.3.0, and added caps for pip and social-auth. That made the "Compile requirements" check fail on every PR against this branch. Commit the current common_constraints.txt, carry the three dropped caps in requirements/constraints.txt since this release line still depends on them, and commit the recompiled files. No pinned version changes, only the "via" comments. Co-Authored-By: Claude Opus 5.5 --- requirements/common_constraints.txt | 31 +++++++++++++------ requirements/constraints.txt | 8 +++++ requirements/edx/base.txt | 4 ++- requirements/edx/development.txt | 4 ++- requirements/edx/doc.txt | 4 ++- requirements/edx/paver.txt | 2 +- requirements/edx/semgrep.txt | 2 +- requirements/edx/testing.txt | 4 ++- requirements/pip.txt | 1 + scripts/user_retirement/requirements/base.txt | 2 +- scripts/xblock/requirements.txt | 2 +- 11 files changed, 47 insertions(+), 17 deletions(-) diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt index f3cc8fc9c9e8..1e1a8941c0df 100644 --- a/requirements/common_constraints.txt +++ b/requirements/common_constraints.txt @@ -16,19 +16,32 @@ # this file from Github directly. It does not require packaging in edx-lint. # using LTS django version -Django<5.0 +Django<6.0 # elasticsearch>=7.14.0 includes breaking changes in it which caused issues in discovery upgrade process. # elastic search changelog: https://www.elastic.co/guide/en/enterprise-search/master/release-notes-7.14.0.html # See https://github.com/openedx/edx-platform/issues/35126 for more info elasticsearch<7.14.0 -# django-simple-history>3.0.0 adds indexing and causes a lot of migrations to be affected +# 2026-07-06: Constrain social-auth-* packages to the latest version compatible with +# edx-drf-extensions<=10.6.0. (Newer versions require a POST instead of a GET.) +# Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561 +social-auth-app-django<6.0.0 +social-auth-core<5.0.0 -# Cause: https://github.com/openedx/edx-lint/issues/458 -# This can be unpinned once https://github.com/openedx/edx-lint/issues/459 has been resolved. -pip<24.3 - -# Cause: https://github.com/openedx/edx-lint/issues/475 -# This can be unpinned once https://github.com/openedx/edx-lint/issues/476 has been resolved. -urllib3<2.3.0 +# 2026-08-11: pip-tools is only tested against the latest pip released at the time +# pip-tools was released; also, pip-tools package dependencies are extremely permissive +# about the pip version required, so the dependency resolver will not prevent an unwanted +# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained +# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <-> +# pip-tools compatibility. We've constrained pip here in common_constraints.txt in the +# past, but always removed it once the issue was "fixed". Removing this constraint was +# always a mistake. +# +# This is a semi-permanent constraint and should be manually bumped after each pip-tools +# release. +# +# Exceptional conditions for removal: +# - We stop using pip-tools, OR +# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257 +pip<26.2.1 # Known to work with pip-tools==7.6.1 diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 9a9207bd8eef..031ec655e40d 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -13,6 +13,14 @@ # This file contains all common constraints for edx-repos -c common_constraints.txt +# Date: 2026-10-14 +# The upstream common_constraints.txt has since dropped these caps, which the +# Sumac release line still depends on. Keep them here so `make compile-requirements` +# reproduces the files committed on this branch. +Django<5.0 +pip<24.3 +urllib3<2.3.0 + # Date: 2024-08-21 # Description: This is the major upgrade of algoliasearch python client and it will # break one of the edX' platform plugin, so we need to make that compatible first. diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt index 3aa59ed9894c..73087831d9a7 100644 --- a/requirements/edx/base.txt +++ b/requirements/edx/base.txt @@ -1165,11 +1165,13 @@ snowflake-connector-python==3.12.2 # via edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -r requirements/edx/kernel.in # edx-auth-backends # social-auth-app-django @@ -1238,7 +1240,7 @@ uritemplate==4.1.1 # google-api-python-client urllib3==2.2.3 # via - # -c requirements/edx/../common_constraints.txt + # -c requirements/edx/../constraints.txt # -r requirements/edx/paver.txt # botocore # elasticsearch diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt index 89f1823608e8..f3041ffc1d77 100644 --- a/requirements/edx/development.txt +++ b/requirements/edx/development.txt @@ -1989,12 +1989,14 @@ snowflake-connector-python==3.12.2 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt # edx-auth-backends @@ -2185,7 +2187,7 @@ uritemplate==4.1.1 # google-api-python-client urllib3==2.2.3 # via - # -c requirements/edx/../common_constraints.txt + # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt # botocore diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt index ded2a192b51a..5c4333f35e0f 100644 --- a/requirements/edx/doc.txt +++ b/requirements/edx/doc.txt @@ -1403,11 +1403,13 @@ snowflake-connector-python==3.12.2 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -r requirements/edx/base.txt # edx-auth-backends # social-auth-app-django @@ -1535,7 +1537,7 @@ uritemplate==4.1.1 # google-api-python-client urllib3==2.2.3 # via - # -c requirements/edx/../common_constraints.txt + # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # botocore # elasticsearch diff --git a/requirements/edx/paver.txt b/requirements/edx/paver.txt index 14aa08a2a6b0..c11f8badf42b 100644 --- a/requirements/edx/paver.txt +++ b/requirements/edx/paver.txt @@ -59,7 +59,7 @@ typing-extensions==4.12.2 # via edx-opaque-keys urllib3==2.2.3 # via - # -c requirements/edx/../common_constraints.txt + # -c requirements/edx/../constraints.txt # requests watchdog==5.0.3 # via -r requirements/edx/paver.in diff --git a/requirements/edx/semgrep.txt b/requirements/edx/semgrep.txt index 24c3c263b5a2..755bdbb62de7 100644 --- a/requirements/edx/semgrep.txt +++ b/requirements/edx/semgrep.txt @@ -126,7 +126,7 @@ typing-extensions==4.12.2 # semgrep urllib3==2.2.3 # via - # -c requirements/edx/../common_constraints.txt + # -c requirements/edx/../constraints.txt # requests # semgrep wcmatch==8.5.2 diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt index 1a9bd7041cf1..a522a0d56f63 100644 --- a/requirements/edx/testing.txt +++ b/requirements/edx/testing.txt @@ -1515,11 +1515,13 @@ snowflake-connector-python==3.12.2 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -r requirements/edx/base.txt # edx-auth-backends # social-auth-app-django @@ -1618,7 +1620,7 @@ uritemplate==4.1.1 # google-api-python-client urllib3==2.2.3 # via - # -c requirements/edx/../common_constraints.txt + # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # botocore # elasticsearch diff --git a/requirements/pip.txt b/requirements/pip.txt index 797974efa45a..56f11e9c93a2 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -11,6 +11,7 @@ wheel==0.44.0 pip==24.2 # via # -c requirements/common_constraints.txt + # -c requirements/constraints.txt # -r requirements/pip.in setuptools==75.2.0 # via -r requirements/pip.in diff --git a/scripts/user_retirement/requirements/base.txt b/scripts/user_retirement/requirements/base.txt index 3d81950df7e7..6134552da29b 100644 --- a/scripts/user_retirement/requirements/base.txt +++ b/scripts/user_retirement/requirements/base.txt @@ -158,7 +158,7 @@ uritemplate==4.1.1 # via google-api-python-client urllib3==1.26.20 # via - # -c scripts/user_retirement/requirements/../../../requirements/common_constraints.txt + # -c scripts/user_retirement/requirements/../../../requirements/constraints.txt # -r scripts/user_retirement/requirements/base.in # botocore # requests diff --git a/scripts/xblock/requirements.txt b/scripts/xblock/requirements.txt index 3e993640ea78..8c6bf4bc38aa 100644 --- a/scripts/xblock/requirements.txt +++ b/scripts/xblock/requirements.txt @@ -16,5 +16,5 @@ requests==2.32.3 # via -r scripts/xblock/requirements.in urllib3==2.2.3 # via - # -c scripts/xblock/../../requirements/common_constraints.txt + # -c scripts/xblock/../../requirements/constraints.txt # requests