diff --git a/.github/workflows/static-assets-check.yml b/.github/workflows/static-assets-check.yml index 502dddce08ad..4ef914e9c283 100644 --- a/.github/workflows/static-assets-check.yml +++ b/.github/workflows/static-assets-check.yml @@ -70,6 +70,7 @@ jobs: - name: Install Limited Python Deps for Build run: | + pip install -r requirements/pip.txt pip install -r requirements/edx/assets.txt - name: Add node_modules bin to $Path diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt index 748858b7015a..1e1a8941c0df 100644 --- a/requirements/common_constraints.txt +++ b/requirements/common_constraints.txt @@ -22,3 +22,26 @@ Django<6.0 # elastic search changelog: https://www.elastic.co/guide/en/enterprise-search/master/release-notes-7.14.0.html # See https://github.com/openedx/edx-platform/issues/35126 for more info elasticsearch<7.14.0 + +# 2026-07-06: Constrain social-auth-* packages to the latest version compatible with +# edx-drf-extensions<=10.6.0. (Newer versions require a POST instead of a GET.) +# Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561 +social-auth-app-django<6.0.0 +social-auth-core<5.0.0 + +# 2026-08-11: pip-tools is only tested against the latest pip released at the time +# pip-tools was released; also, pip-tools package dependencies are extremely permissive +# about the pip version required, so the dependency resolver will not prevent an unwanted +# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained +# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <-> +# pip-tools compatibility. We've constrained pip here in common_constraints.txt in the +# past, but always removed it once the issue was "fixed". Removing this constraint was +# always a mistake. +# +# This is a semi-permanent constraint and should be manually bumped after each pip-tools +# release. +# +# Exceptional conditions for removal: +# - We stop using pip-tools, OR +# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257 +pip<26.2.1 # Known to work with pip-tools==7.6.1 diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 549fa458d597..da56f0d268de 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -120,15 +120,17 @@ openedx-learning==0.26.0 openai<=0.28.1 # Date: 2026-06-04 -# Cap openedx-forum to 0.4.1 on the Teak release line: +# Cap openedx-forum to the 0.4.1 line on the Teak release line: # * 0.4.1 contains the fix for the "pinned" NULL sort bug # (https://github.com/openedx/forum/pull/270 — discussion threads were not # ordering correctly when sorted by "recent first"). See user report: # https://discuss.openedx.org/t/discuss-forum-messages-order-not-organized-as-expected-in-teak/18665 # * 0.4.2 drops Python 3.11 support, which Teak still supports. # * 0.4.3 removes the MongoDB backend, which Teak deployments may still rely on. +# * 0.4.1.post1 is a security release on the 0.4.1 line +# (https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4). # Remove this cap on master / post-Teak release lines. -openedx-forum<=0.4.1 +openedx-forum<0.4.2 # Date: 2026-06-04 # openedx-forum>=0.4.1 introduces an (off-by-default) Typesense search backend diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt index d700bc6f1779..aaa78c92ab27 100644 --- a/requirements/edx/base.txt +++ b/requirements/edx/base.txt @@ -815,7 +815,7 @@ openedx-filters==2.0.1 # -r requirements/edx/kernel.in # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in @@ -1111,11 +1111,13 @@ snowflake-connector-python==3.14.1 # via edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in # edx-auth-backends diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt index 7974a84fe16a..49684bbb7944 100644 --- a/requirements/edx/development.txt +++ b/requirements/edx/development.txt @@ -1374,7 +1374,7 @@ openedx-filters==2.0.1 # -r requirements/edx/testing.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt @@ -1951,12 +1951,14 @@ snowflake-connector-python==3.14.1 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt index d38baf49944c..72efc423175b 100644 --- a/requirements/edx/doc.txt +++ b/requirements/edx/doc.txt @@ -986,7 +986,7 @@ openedx-filters==2.0.1 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt @@ -1361,11 +1361,13 @@ snowflake-connector-python==3.14.1 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt index daa4635fe785..593c5f13fbe5 100644 --- a/requirements/edx/testing.txt +++ b/requirements/edx/testing.txt @@ -1044,7 +1044,7 @@ openedx-filters==2.0.1 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt @@ -1486,11 +1486,13 @@ snowflake-connector-python==3.14.1 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends diff --git a/requirements/pip.txt b/requirements/pip.txt index d52d3d7fdf3b..6bb638bff471 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -9,6 +9,8 @@ wheel==0.45.1 # The following packages are considered to be unsafe in a requirements file: pip==24.2 - # via -r requirements/pip.in + # via + # -c requirements/common_constraints.txt + # -r requirements/pip.in setuptools==79.0.0 # via -r requirements/pip.in