From 9b58d0459ed272f323d814013a153b1ec4bcdef4 Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Tue, 13 Oct 2026 13:23:08 -0400 Subject: [PATCH 1/2] fix: upgrade openedx-forum to 0.4.1.post1 Security release of the forum app for GHSA-c6fp-f54c-6cv4: the forum HTTP API is no longer routed unless FORUM_ENABLE_HTTP_API is set, and requires a staff caller when it is. https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4 Co-Authored-By: Claude Opus 5.5 --- requirements/constraints.txt | 6 ++++-- requirements/edx/base.txt | 2 +- requirements/edx/development.txt | 2 +- requirements/edx/doc.txt | 2 +- requirements/edx/testing.txt | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index d25f0099da96..7d3e5aa20233 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -69,15 +69,17 @@ openedx-learning==0.30.2 openai<=0.28.1 # Date: 2026-06-04 -# Cap openedx-forum to 0.4.1 on the Ulmo release line: +# Cap openedx-forum to the 0.4.1 line on the Ulmo release line: # * 0.4.1 contains the fix for the "pinned" NULL sort bug # (https://github.com/openedx/forum/pull/270 — discussion threads were not # ordering correctly when sorted by "recent first"). See user report: # https://discuss.openedx.org/t/discuss-forum-messages-order-not-organized-as-expected-in-teak/18665 # * 0.4.2 drops Python 3.11 support. # * 0.4.3 removes the MongoDB backend, which Ulmo deployments may still rely on. +# * 0.4.1.post1 is a security release on the 0.4.1 line +# (https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4). # Remove this cap on master / post-Ulmo release lines. -openedx-forum<=0.4.1 +openedx-forum<0.4.2 # Date: 2024-04-26 # path==16.12.0 breaks the unit test collections check diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt index 2112b43dab11..21d6f52e57fb 100644 --- a/requirements/edx/base.txt +++ b/requirements/edx/base.txt @@ -854,7 +854,7 @@ openedx-filters==2.1.0 # -r requirements/edx/kernel.in # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/constraints.txt # -r requirements/edx/kernel.in diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt index b1953f6c6849..3faa92255735 100644 --- a/requirements/edx/development.txt +++ b/requirements/edx/development.txt @@ -1412,7 +1412,7 @@ openedx-filters==2.1.0 # -r requirements/edx/testing.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/constraints.txt # -r requirements/edx/doc.txt diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt index 90fcb2081903..a3c8a3759b7b 100644 --- a/requirements/edx/doc.txt +++ b/requirements/edx/doc.txt @@ -1029,7 +1029,7 @@ openedx-filters==2.1.0 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/constraints.txt # -r requirements/edx/base.txt diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt index c60f91688343..bc03f3106089 100644 --- a/requirements/edx/testing.txt +++ b/requirements/edx/testing.txt @@ -1075,7 +1075,7 @@ openedx-filters==2.1.0 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/constraints.txt # -r requirements/edx/base.txt From d7543f3057e97d8524f4c496c7828172ee267a85 Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Wed, 14 Oct 2026 10:45:05 -0400 Subject: [PATCH 2/2] style: fix blank-line pycodestyle errors in two test files E302 in test_extract_archive.py and E303 in test_videos.py came in with earlier security backports (97de0586d8, c99de016f1), which merged from a private fork where CI does not run. They fail the "Quality Others" check on every PR against this branch. Co-Authored-By: Claude Opus 5.5 --- .../contentstore/rest_api/v1/views/tests/test_videos.py | 1 - openedx/core/lib/tests/test_extract_archive.py | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_videos.py b/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_videos.py index 3b77068f9ec6..2b1746686cdf 100644 --- a/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_videos.py +++ b/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_videos.py @@ -144,7 +144,6 @@ def test_VideoTranscriptEnabledFlag_enabled(self): self.assertTrue(response.data["is_ai_translations_enabled"]) - class VideoDownloadViewTest(CourseTestCase): """ Tests for VideoDownloadView. diff --git a/openedx/core/lib/tests/test_extract_archive.py b/openedx/core/lib/tests/test_extract_archive.py index 6b999586eae3..2bf507bedc8b 100644 --- a/openedx/core/lib/tests/test_extract_archive.py +++ b/openedx/core/lib/tests/test_extract_archive.py @@ -19,8 +19,8 @@ from openedx.core.lib.extract_archive import _is_bad_path, safe_extractall -# Direct tests of the path-containment helper. No Django settings needed. +# Direct tests of the path-containment helper. No Django settings needed. def test_is_bad_path_prefix_bypass_is_rejected(): """ A sibling path whose name extends the base's name as a raw string prefix