feanil · Oct 14, 2026 · Oct 13, 2026 · Oct 14, 2026
diff --git a/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_videos.py b/cms/djangoapps/contentstore/rest_api/v1/views/tests/test_videos.py
@@ -144,7 +144,6 @@ def test_VideoTranscriptEnabledFlag_enabled(self):
             self.assertTrue(response.data["is_ai_translations_enabled"])
 
 
-
 class VideoDownloadViewTest(CourseTestCase):
     """
     Tests for VideoDownloadView.

diff --git a/openedx/core/lib/tests/test_extract_archive.py b/openedx/core/lib/tests/test_extract_archive.py
@@ -19,8 +19,8 @@
 
 from openedx.core.lib.extract_archive import _is_bad_path, safe_extractall
 
-# Direct tests of the path-containment helper. No Django settings needed.
 
+# Direct tests of the path-containment helper. No Django settings needed.
 def test_is_bad_path_prefix_bypass_is_rejected():
     """
     A sibling path whose name extends the base's name as a raw string prefix

diff --git a/requirements/constraints.txt b/requirements/constraints.txt
@@ -69,15 +69,17 @@ openedx-learning==0.30.2
 openai<=0.28.1
 
 # Date: 2026-06-04
-# Cap openedx-forum to 0.4.1 on the Ulmo release line:
+# Cap openedx-forum to the 0.4.1 line on the Ulmo release line:
 #   * 0.4.1 contains the fix for the "pinned" NULL sort bug
 #     (https://github.com/openedx/forum/pull/270 — discussion threads were not
 #     ordering correctly when sorted by "recent first"). See user report:
 #     https://discuss.openedx.org/t/discuss-forum-messages-order-not-organized-as-expected-in-teak/18665
 #   * 0.4.2 drops Python 3.11 support.
 #   * 0.4.3 removes the MongoDB backend, which Ulmo deployments may still rely on.
+#   * 0.4.1.post1 is a security release on the 0.4.1 line
+#     (https://github.com/openedx/forum/security/advisories/GHSA-c6fp-f54c-6cv4).
 # Remove this cap on master / post-Ulmo release lines.
-openedx-forum<=0.4.1
+openedx-forum<0.4.2
 
 # Date: 2024-04-26
 # path==16.12.0 breaks the unit test collections check

diff --git a/requirements/edx/base.txt b/requirements/edx/base.txt
@@ -854,7 +854,7 @@ openedx-filters==2.1.0
     #   -r requirements/edx/kernel.in
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.4.1
+openedx-forum==0.4.1.post1
     # via
     #   -c requirements/constraints.txt
     #   -r requirements/edx/kernel.in

diff --git a/requirements/edx/development.txt b/requirements/edx/development.txt
@@ -1412,7 +1412,7 @@ openedx-filters==2.1.0
     #   -r requirements/edx/testing.txt
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.4.1
+openedx-forum==0.4.1.post1
     # via
     #   -c requirements/constraints.txt
     #   -r requirements/edx/doc.txt

diff --git a/requirements/edx/doc.txt b/requirements/edx/doc.txt
@@ -1029,7 +1029,7 @@ openedx-filters==2.1.0
     #   -r requirements/edx/base.txt
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.4.1
+openedx-forum==0.4.1.post1
     # via
     #   -c requirements/constraints.txt
     #   -r requirements/edx/base.txt

diff --git a/requirements/edx/testing.txt b/requirements/edx/testing.txt
@@ -1075,7 +1075,7 @@ openedx-filters==2.1.0
     #   -r requirements/edx/base.txt
     #   lti-consumer-xblock
     #   ora2
-openedx-forum==0.4.1
+openedx-forum==0.4.1.post1
     # via
     #   -c requirements/constraints.txt
     #   -r requirements/edx/base.txt
-Original file line number
+Diff line change
@@ Expand Up / @@ -144,7 +144,6 @@ def test_VideoTranscriptEnabledFlag_enabled(self): @@
                 self.assertTrue(response.data["is_ai_translations_enabled"])
     class VideoDownloadViewTest(CourseTestCase):
         """
         Tests for VideoDownloadView.
@@ Expand Down @@