From 9681b1f6f3be7b2fe53dbe415a7812c53045dab8 Mon Sep 17 00:00:00 2001 From: Kyle D McCormick Date: Thu, 22 Oct 2026 14:32:00 -0400 Subject: [PATCH 1/2] build: Upgrade certifi, pip, and pip-tools [verawood] Upgrades certifi from 2026.4.22 to 2026.10.19, pip from 26.1 to 26.2.2, and pip-tools from 7.5.3 to 7.6.2 (older pip-tools doesn't work with pip 26.2+). certifi older than 2026.10.19 and pip older than 26.2.2 trust the compromised emSign intermediate CAs. Generated with `make upgrade` limited to --upgrade-package for those three packages. Part of: https://github.com/openedx/public-engineering/issues/574 Co-authored-by: Claude Opus 5.5 --- requirements/base.txt | 3 +-- requirements/pip-tools.txt | 2 +- requirements/pip.txt | 2 +- requirements/quality.txt | 2 +- requirements/test.txt | 2 +- 5 files changed, 5 insertions(+), 6 deletions(-) diff --git a/requirements/base.txt b/requirements/base.txt index 6b74d058..40eb50bb 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -16,7 +16,7 @@ attrs==26.1.0 # referencing camel-converter[pydantic]==5.1.0 # via meilisearch -certifi==2026.4.22 +certifi==2026.10.19 # via # elasticsearch # requests @@ -172,7 +172,6 @@ stevedore==5.7.0 typing-extensions==4.15.0 # via # edx-opaque-keys - # elasticsearch-dsl # pydantic # pydantic-core # referencing diff --git a/requirements/pip-tools.txt b/requirements/pip-tools.txt index 894e0ebe..336e63ef 100644 --- a/requirements/pip-tools.txt +++ b/requirements/pip-tools.txt @@ -12,7 +12,7 @@ packaging==26.2 # via # build # wheel -pip-tools==7.5.3 +pip-tools==7.6.2 # via -r requirements/pip-tools.in pyproject-hooks==1.2.0 # via diff --git a/requirements/pip.txt b/requirements/pip.txt index 2f205539..9aace7b8 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -10,7 +10,7 @@ wheel==0.47.0 # via -r requirements/pip.in # The following packages are considered to be unsafe in a requirements file: -pip==26.1 +pip==26.2.2 # via -r requirements/pip.in setuptools==82.0.1 # via -r requirements/pip.in diff --git a/requirements/quality.txt b/requirements/quality.txt index c63ae202..202dbf6d 100644 --- a/requirements/quality.txt +++ b/requirements/quality.txt @@ -35,7 +35,7 @@ camel-converter[pydantic]==5.1.0 # -r requirements/base.txt # -r requirements/test.txt # meilisearch -certifi==2026.4.22 +certifi==2026.10.19 # via # -r requirements/base.txt # -r requirements/test.txt diff --git a/requirements/test.txt b/requirements/test.txt index e5597a50..a03f48a9 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -28,7 +28,7 @@ camel-converter[pydantic]==5.1.0 # via # -r requirements/base.txt # meilisearch -certifi==2026.4.22 +certifi==2026.10.19 # via # -r requirements/base.txt # elasticsearch From a1230cc773f56a03df2bd62fd607ec658f8905ae Mon Sep 17 00:00:00 2001 From: Kyle D McCormick Date: Fri, 23 Oct 2026 10:37:37 -0400 Subject: [PATCH 2/2] build: pin Django in the check_keywords tox env `make upgrade` strips Django from requirements/test.txt so that tox can choose the Django version, but the check_keywords env only installed test.txt and has no django52 factor. pip then pulled in the latest Django (now 6.x), which breaks DRF's import of django.utils.cache.cc_delim_re. Install the pinned version from requirements/django.txt. Part of: https://github.com/openedx/public-engineering/issues/574 Co-authored-by: Claude Opus 5.5 (cherry picked from commit 91fc242f2c2c5249c04cbe1b37da067e942fda87) --- tox.ini | 1 + 1 file changed, 1 insertion(+) diff --git a/tox.ini b/tox.ini index 666c1b4e..92125d56 100644 --- a/tox.ini +++ b/tox.ini @@ -47,6 +47,7 @@ setenv = allowlist_externals = make deps = + -r{toxinidir}/requirements/django.txt -r{toxinidir}/requirements/test.txt commands = make check_keywords