From a89f51c37b2cb181754fd6db6fdc4b1a5d942796 Mon Sep 17 00:00:00 2001 From: Kyle D McCormick Date: Thu, 22 Oct 2026 14:31:36 -0400 Subject: [PATCH 1/2] build: Upgrade certifi, pip, and pip-tools [ulmo] Upgrades certifi from 2025.10.5 to 2026.10.19, pip from 25.2 to 26.2.2, and pip-tools from 7.5.1 to 7.6.2 (older pip-tools doesn't work with pip 26.2+). certifi older than 2026.10.19 and pip older than 26.2.2 trust the compromised emSign intermediate CAs. Generated with `make upgrade` limited to --upgrade-package for those three packages. Part of: https://github.com/openedx/public-engineering/issues/574 Co-authored-by: Claude Opus 5.5 --- requirements/base.txt | 3 +-- requirements/pip-tools.txt | 2 +- requirements/pip.txt | 2 +- requirements/quality.txt | 2 +- requirements/test.txt | 2 +- 5 files changed, 5 insertions(+), 6 deletions(-) diff --git a/requirements/base.txt b/requirements/base.txt index 598b33d7..bbb5661a 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -16,7 +16,7 @@ attrs==25.4.0 # referencing camel-converter[pydantic]==5.0.0 # via meilisearch -certifi==2025.10.5 +certifi==2026.10.19 # via # elasticsearch # requests @@ -172,7 +172,6 @@ stevedore==5.5.0 typing-extensions==4.15.0 # via # edx-opaque-keys - # elasticsearch-dsl # pydantic # pydantic-core # referencing diff --git a/requirements/pip-tools.txt b/requirements/pip-tools.txt index e97cb1b3..173c2952 100644 --- a/requirements/pip-tools.txt +++ b/requirements/pip-tools.txt @@ -10,7 +10,7 @@ click==8.3.0 # via pip-tools packaging==25.0 # via build -pip-tools==7.5.1 +pip-tools==7.6.2 # via -r requirements/pip-tools.in pyproject-hooks==1.2.0 # via diff --git a/requirements/pip.txt b/requirements/pip.txt index dec15874..95095799 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -8,7 +8,7 @@ wheel==0.45.1 # via -r requirements/pip.in # The following packages are considered to be unsafe in a requirements file: -pip==25.2 +pip==26.2.2 # via -r requirements/pip.in setuptools==80.9.0 # via -r requirements/pip.in diff --git a/requirements/quality.txt b/requirements/quality.txt index 35c34a73..6e4dc217 100644 --- a/requirements/quality.txt +++ b/requirements/quality.txt @@ -35,7 +35,7 @@ camel-converter[pydantic]==5.0.0 # -r requirements/base.txt # -r requirements/test.txt # meilisearch -certifi==2025.10.5 +certifi==2026.10.19 # via # -r requirements/base.txt # -r requirements/test.txt diff --git a/requirements/test.txt b/requirements/test.txt index 671e738c..372c5853 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -28,7 +28,7 @@ camel-converter[pydantic]==5.0.0 # via # -r requirements/base.txt # meilisearch -certifi==2025.10.5 +certifi==2026.10.19 # via # -r requirements/base.txt # elasticsearch From 49f27d4e28cde9308bbb7009ee503bb7d7cc3b7e Mon Sep 17 00:00:00 2001 From: Kyle D McCormick Date: Fri, 23 Oct 2026 10:37:37 -0400 Subject: [PATCH 2/2] build: pin Django in the check_keywords tox env `make upgrade` strips Django from requirements/test.txt so that tox can choose the Django version, but the check_keywords env only installed test.txt and has no django52 factor. pip then pulled in the latest Django (now 6.x), which breaks DRF's import of django.utils.cache.cc_delim_re. Install the pinned version from requirements/django.txt. Part of: https://github.com/openedx/public-engineering/issues/574 Co-authored-by: Claude Opus 5.5 (cherry picked from commit 91fc242f2c2c5249c04cbe1b37da067e942fda87) --- tox.ini | 1 + 1 file changed, 1 insertion(+) diff --git a/tox.ini b/tox.ini index 6b961b0a..ef95baf8 100644 --- a/tox.ini +++ b/tox.ini @@ -47,6 +47,7 @@ setenv = allowlist_externals = make deps = + -r{toxinidir}/requirements/django.txt -r{toxinidir}/requirements/test.txt commands = make check_keywords