From 8450899b79a629f67d3ca678d03886f97325c74c Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Tue, 13 Oct 2026 13:23:07 -0400 Subject: [PATCH 1/3] fix: upgrade openedx-forum to 0.4.1.post1 Security release of the forum app for GHSA-c6fp-f54c-6cv4: the forum HTTP API is no longer routed unless FORUM_ENABLE_HTTP_API is set, and requires a staff caller when it is. https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4 Co-Authored-By: Claude Opus 5.5 --- requirements/constraints.txt | 6 ++++-- requirements/edx/base.txt | 2 +- requirements/edx/development.txt | 2 +- requirements/edx/doc.txt | 2 +- requirements/edx/testing.txt | 2 +- 5 files changed, 8 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 549fa458d597..da56f0d268de 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -120,15 +120,17 @@ openedx-learning==0.26.0 openai<=0.28.1 # Date: 2026-06-04 -# Cap openedx-forum to 0.4.1 on the Teak release line: +# Cap openedx-forum to the 0.4.1 line on the Teak release line: # * 0.4.1 contains the fix for the "pinned" NULL sort bug # (https://github.com/openedx/forum/pull/270 — discussion threads were not # ordering correctly when sorted by "recent first"). See user report: # https://discuss.openedx.org/t/discuss-forum-messages-order-not-organized-as-expected-in-teak/18665 # * 0.4.2 drops Python 3.11 support, which Teak still supports. # * 0.4.3 removes the MongoDB backend, which Teak deployments may still rely on. +# * 0.4.1.post1 is a security release on the 0.4.1 line +# (https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4). # Remove this cap on master / post-Teak release lines. -openedx-forum<=0.4.1 +openedx-forum<0.4.2 # Date: 2026-06-04 # openedx-forum>=0.4.1 introduces an (off-by-default) Typesense search backend diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt index d700bc6f1779..797159e12067 100644 --- a/requirements/edx/base.txt +++ b/requirements/edx/base.txt @@ -815,7 +815,7 @@ openedx-filters==2.0.1 # -r requirements/edx/kernel.in # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt index 7974a84fe16a..414f26b8324a 100644 --- a/requirements/edx/development.txt +++ b/requirements/edx/development.txt @@ -1374,7 +1374,7 @@ openedx-filters==2.0.1 # -r requirements/edx/testing.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt index d38baf49944c..ebe3b78d53bc 100644 --- a/requirements/edx/doc.txt +++ b/requirements/edx/doc.txt @@ -986,7 +986,7 @@ openedx-filters==2.0.1 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt index daa4635fe785..451cf9f36d06 100644 --- a/requirements/edx/testing.txt +++ b/requirements/edx/testing.txt @@ -1044,7 +1044,7 @@ openedx-filters==2.0.1 # -r requirements/edx/base.txt # lti-consumer-xblock # ora2 -openedx-forum==0.4.1 +openedx-forum==0.4.1.post1 # via # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt From 2c7a201a2f63ebd8c7c4f622056476fe4d55eacc Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Wed, 14 Oct 2026 10:41:35 -0400 Subject: [PATCH 2/3] build: install the pinned pip before building static-asset deps The static assets check used the runner's default pip, which builds legacy setup.py-only packages in an isolated environment with the latest setuptools. ora2's loremipsum==1.0.5 dependency imports pkg_resources at build time, which setuptools 81+ no longer ships, so the job failed before collecting any assets. Install requirements/pip.txt (pip 24.2, setuptools 79) first, as the Makefile's pre-requirements target does. With it, loremipsum builds against the environment's setuptools and installs cleanly. Release lines from Ulmo on avoid this by moving to ora2 6.17.2, which drops the loremipsum dependency. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/static-assets-check.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/static-assets-check.yml b/.github/workflows/static-assets-check.yml index 502dddce08ad..4ef914e9c283 100644 --- a/.github/workflows/static-assets-check.yml +++ b/.github/workflows/static-assets-check.yml @@ -70,6 +70,7 @@ jobs: - name: Install Limited Python Deps for Build run: | + pip install -r requirements/pip.txt pip install -r requirements/edx/assets.txt - name: Add node_modules bin to $Path From 2fc9a1c849f6d0a0e3cc2b2c0387858c59ddb4a7 Mon Sep 17 00:00:00 2001 From: Feanil Patel Date: Wed, 14 Oct 2026 10:44:41 -0400 Subject: [PATCH 3/3] build: refresh common constraints for the compile-requirements check `make compile-requirements` downloads common_constraints.txt from edx-lint's master branch, which has since added caps for pip and social-auth. That made the "Compile requirements" check fail on every PR against this branch. Commit the current common_constraints.txt and the recompiled files. Teak's pins already satisfy the new caps, so no pinned version changes, only the "via" comments. Co-Authored-By: Claude Opus 5.5 --- requirements/common_constraints.txt | 23 +++++++++++++++++++++++ requirements/edx/base.txt | 2 ++ requirements/edx/development.txt | 2 ++ requirements/edx/doc.txt | 2 ++ requirements/edx/testing.txt | 2 ++ requirements/pip.txt | 4 +++- 6 files changed, 34 insertions(+), 1 deletion(-) diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt index 748858b7015a..1e1a8941c0df 100644 --- a/requirements/common_constraints.txt +++ b/requirements/common_constraints.txt @@ -22,3 +22,26 @@ Django<6.0 # elastic search changelog: https://www.elastic.co/guide/en/enterprise-search/master/release-notes-7.14.0.html # See https://github.com/openedx/edx-platform/issues/35126 for more info elasticsearch<7.14.0 + +# 2026-07-06: Constrain social-auth-* packages to the latest version compatible with +# edx-drf-extensions<=10.6.0. (Newer versions require a POST instead of a GET.) +# Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561 +social-auth-app-django<6.0.0 +social-auth-core<5.0.0 + +# 2026-08-11: pip-tools is only tested against the latest pip released at the time +# pip-tools was released; also, pip-tools package dependencies are extremely permissive +# about the pip version required, so the dependency resolver will not prevent an unwanted +# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained +# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <-> +# pip-tools compatibility. We've constrained pip here in common_constraints.txt in the +# past, but always removed it once the issue was "fixed". Removing this constraint was +# always a mistake. +# +# This is a semi-permanent constraint and should be manually bumped after each pip-tools +# release. +# +# Exceptional conditions for removal: +# - We stop using pip-tools, OR +# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257 +pip<26.2.1 # Known to work with pip-tools==7.6.1 diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt index 797159e12067..aaa78c92ab27 100644 --- a/requirements/edx/base.txt +++ b/requirements/edx/base.txt @@ -1111,11 +1111,13 @@ snowflake-connector-python==3.14.1 # via edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/kernel.in # edx-auth-backends diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt index 414f26b8324a..49684bbb7944 100644 --- a/requirements/edx/development.txt +++ b/requirements/edx/development.txt @@ -1951,12 +1951,14 @@ snowflake-connector-python==3.14.1 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/doc.txt # -r requirements/edx/testing.txt diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt index ebe3b78d53bc..72efc423175b 100644 --- a/requirements/edx/doc.txt +++ b/requirements/edx/doc.txt @@ -1361,11 +1361,13 @@ snowflake-connector-python==3.14.1 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt index 451cf9f36d06..593c5f13fbe5 100644 --- a/requirements/edx/testing.txt +++ b/requirements/edx/testing.txt @@ -1486,11 +1486,13 @@ snowflake-connector-python==3.14.1 # edx-enterprise social-auth-app-django==5.4.1 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends social-auth-core==4.5.4 # via + # -c requirements/edx/../common_constraints.txt # -c requirements/edx/../constraints.txt # -r requirements/edx/base.txt # edx-auth-backends diff --git a/requirements/pip.txt b/requirements/pip.txt index d52d3d7fdf3b..6bb638bff471 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -9,6 +9,8 @@ wheel==0.45.1 # The following packages are considered to be unsafe in a requirements file: pip==24.2 - # via -r requirements/pip.in + # via + # -c requirements/common_constraints.txt + # -r requirements/pip.in setuptools==79.0.0 # via -r requirements/pip.in