feanil · Oct 14, 2026 · Oct 13, 2026 · Oct 14, 2026
diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt
@@ -16,19 +16,32 @@
 #  this file from Github directly. It does not require packaging in edx-lint.
 
 # using LTS django version
-Django<5.0
+Django<6.0
 
 # elasticsearch>=7.14.0 includes breaking changes in it which caused issues in discovery upgrade process.
 # elastic search changelog: https://www.elastic.co/guide/en/enterprise-search/master/release-notes-7.14.0.html
 # See https://github.com/openedx/edx-platform/issues/35126 for more info
 elasticsearch<7.14.0
 
-# django-simple-history>3.0.0 adds indexing and causes a lot of migrations to be affected
+# 2026-07-06: Constrain social-auth-* packages to the latest version compatible with
+# edx-drf-extensions<=10.6.0. (Newer versions require a POST instead of a GET.)
+# Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561
+social-auth-app-django<6.0.0
+social-auth-core<5.0.0
 
-# Cause: https://github.com/openedx/edx-lint/issues/458
-# This can be unpinned once https://github.com/openedx/edx-lint/issues/459 has been resolved.
-pip<24.3
-
-# Cause: https://github.com/openedx/edx-lint/issues/475
-# This can be unpinned once https://github.com/openedx/edx-lint/issues/476 has been resolved.
-urllib3<2.3.0
+# 2026-08-11: pip-tools is only tested against the latest pip released at the time
+# pip-tools was released; also, pip-tools package dependencies are extremely permissive
+# about the pip version required, so the dependency resolver will not prevent an unwanted
+# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained
+# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <->
+# pip-tools compatibility.  We've constrained pip here in common_constraints.txt in the
+# past, but always removed it once the issue was "fixed". Removing this constraint was
+# always a mistake.
+#
+# This is a semi-permanent constraint and should be manually bumped after each pip-tools
+# release.
+#
+# Exceptional conditions for removal:
+# - We stop using pip-tools, OR
+# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257
+pip<26.2.1  # Known to work with pip-tools==7.6.1
diff --git a/requirements/constraints.txt b/requirements/constraints.txt
@@ -13,6 +13,14 @@
 # This file contains all common constraints for edx-repos
 -c common_constraints.txt
 
+# Date: 2026-10-14
+# The upstream common_constraints.txt has since dropped these caps, which the
+# Sumac release line still depends on.  Keep them here so `make compile-requirements`
+# reproduces the files committed on this branch.
+Django<5.0
+pip<24.3
+urllib3<2.3.0
+
 # Date: 2024-08-21
 # Description: This is the major upgrade of algoliasearch python client and it will
 # break one of the edX' platform plugin, so we need to make that compatible first.

diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt
@@ -838,7 +838,7 @@ openedx-filters==1.11.0
     #   -r requirements/edx/kernel.in
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.2.0
+openedx-forum==0.2.1
     # via -r requirements/edx/kernel.in
 openedx-learning==0.18.1
     # via
@@ -1165,11 +1165,13 @@ snowflake-connector-python==3.12.2
     # via edx-enterprise
 social-auth-app-django==5.4.1
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/kernel.in
     #   edx-auth-backends
 social-auth-core==4.5.4
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -r requirements/edx/kernel.in
     #   edx-auth-backends
     #   social-auth-app-django
@@ -1238,7 +1240,7 @@ uritemplate==4.1.1
     #   google-api-python-client
 urllib3==2.2.3
     # via
-    #   -c requirements/edx/../common_constraints.txt
+    #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/paver.txt
     #   botocore
     #   elasticsearch

diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt
@@ -1393,7 +1393,7 @@ openedx-filters==1.11.0
     #   -r requirements/edx/testing.txt
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.2.0
+openedx-forum==0.2.1
     # via
     #   -r requirements/edx/doc.txt
     #   -r requirements/edx/testing.txt
@@ -1989,12 +1989,14 @@ snowflake-connector-python==3.12.2
     #   edx-enterprise
 social-auth-app-django==5.4.1
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/doc.txt
     #   -r requirements/edx/testing.txt
     #   edx-auth-backends
 social-auth-core==4.5.4
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -r requirements/edx/doc.txt
     #   -r requirements/edx/testing.txt
     #   edx-auth-backends
@@ -2185,7 +2187,7 @@ uritemplate==4.1.1
     #   google-api-python-client
 urllib3==2.2.3
     # via
-    #   -c requirements/edx/../common_constraints.txt
+    #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/doc.txt
     #   -r requirements/edx/testing.txt
     #   botocore

diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt
@@ -1007,7 +1007,7 @@ openedx-filters==1.11.0
     #   -r requirements/edx/base.txt
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.2.0
+openedx-forum==0.2.1
     # via -r requirements/edx/base.txt
 openedx-learning==0.18.1
     # via
@@ -1403,11 +1403,13 @@ snowflake-connector-python==3.12.2
     #   edx-enterprise
 social-auth-app-django==5.4.1
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/base.txt
     #   edx-auth-backends
 social-auth-core==4.5.4
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -r requirements/edx/base.txt
     #   edx-auth-backends
     #   social-auth-app-django
@@ -1535,7 +1537,7 @@ uritemplate==4.1.1
     #   google-api-python-client
 urllib3==2.2.3
     # via
-    #   -c requirements/edx/../common_constraints.txt
+    #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/base.txt
     #   botocore
     #   elasticsearch

diff --git a/requirements/edx/paver.txt b/requirements/edx/paver.txt
@@ -59,7 +59,7 @@ typing-extensions==4.12.2
     # via edx-opaque-keys
 urllib3==2.2.3
     # via
-    #   -c requirements/edx/../common_constraints.txt
+    #   -c requirements/edx/../constraints.txt
     #   requests
 watchdog==5.0.3
     # via -r requirements/edx/paver.in

diff --git a/requirements/edx/semgrep.txt b/requirements/edx/semgrep.txt
@@ -126,7 +126,7 @@ typing-extensions==4.12.2
     #   semgrep
 urllib3==2.2.3
     # via
-    #   -c requirements/edx/../common_constraints.txt
+    #   -c requirements/edx/../constraints.txt
     #   requests
     #   semgrep
 wcmatch==8.5.2

diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt
@@ -1052,7 +1052,7 @@ openedx-filters==1.11.0
     #   -r requirements/edx/base.txt
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.2.0
+openedx-forum==0.2.1
     # via -r requirements/edx/base.txt
 openedx-learning==0.18.1
     # via
@@ -1515,11 +1515,13 @@ snowflake-connector-python==3.12.2
     #   edx-enterprise
 social-auth-app-django==5.4.1
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/base.txt
     #   edx-auth-backends
 social-auth-core==4.5.4
     # via
+    #   -c requirements/edx/../common_constraints.txt
     #   -r requirements/edx/base.txt
     #   edx-auth-backends
     #   social-auth-app-django
@@ -1618,7 +1620,7 @@ uritemplate==4.1.1
     #   google-api-python-client
 urllib3==2.2.3
     # via
-    #   -c requirements/edx/../common_constraints.txt
+    #   -c requirements/edx/../constraints.txt
     #   -r requirements/edx/base.txt
     #   botocore
     #   elasticsearch

diff --git a/requirements/pip.txt b/requirements/pip.txt
@@ -11,6 +11,7 @@ wheel==0.44.0
 pip==24.2
     # via
     #   -c requirements/common_constraints.txt
+    #   -c requirements/constraints.txt
     #   -r requirements/pip.in
 setuptools==75.2.0
     # via -r requirements/pip.in
diff --git a/scripts/user_retirement/requirements/base.txt b/scripts/user_retirement/requirements/base.txt
@@ -158,7 +158,7 @@ uritemplate==4.1.1
     # via google-api-python-client
 urllib3==1.26.20
     # via
-    #   -c scripts/user_retirement/requirements/../../../requirements/common_constraints.txt
+    #   -c scripts/user_retirement/requirements/../../../requirements/constraints.txt
     #   -r scripts/user_retirement/requirements/base.in
     #   botocore
     #   requests

diff --git a/scripts/xblock/requirements.txt b/scripts/xblock/requirements.txt
@@ -16,5 +16,5 @@ requests==2.32.3
     # via -r scripts/xblock/requirements.in
 urllib3==2.2.3
     # via
-    #   -c scripts/xblock/../../requirements/common_constraints.txt
+    #   -c scripts/xblock/../../requirements/constraints.txt
     #   requests