From 6e6604376a2fafa9fe5ebf4084f555f94b4fd6c9 Mon Sep 17 00:00:00 2001 From: edX requirements bot Date: Thu, 22 Oct 2026 10:45:51 -0400 Subject: [PATCH] build: upgrade pip to 26.2.2 --- requirements/common_constraints.txt | 23 +++++++++++++++++++++++ requirements/dev.txt | 2 +- requirements/pip-tools.txt | 2 +- requirements/pip.txt | 2 +- 4 files changed, 26 insertions(+), 3 deletions(-) diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt index 43c7b4d2..67a45d4c 100644 --- a/requirements/common_constraints.txt +++ b/requirements/common_constraints.txt @@ -23,3 +23,26 @@ Django<6.0 # elastic search changelog: https://www.elastic.co/guide/en/enterprise-search/master/release-notes-7.14.0.html # See https://github.com/openedx/edx-platform/issues/35126 for more info elasticsearch<7.14.0 + +# 2026-07-06: Constrain social-auth-* packages to the latest version compatible with +# edx-drf-extensions<=10.6.0. (Newer versions require a POST instead of a GET.) +# Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561 +social-auth-app-django<6.0.0 +social-auth-core<5.0.0 + +# 2026-08-11: pip-tools is only tested against the latest pip released at the time +# pip-tools was released; also, pip-tools package dependencies are extremely permissive +# about the pip version required, so the dependency resolver will not prevent an unwanted +# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained +# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <-> +# pip-tools compatibility. We've constrained pip here in common_constraints.txt in the +# past, but always removed it once the issue was "fixed". Removing this constraint was +# always a mistake. +# +# This is a semi-permanent constraint and should be manually bumped after each pip-tools +# release. +# +# Exceptional conditions for removal: +# - We stop using pip-tools, OR +# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257 +pip<=26.2.2 # Known to work with pip-tools==7.6.2 diff --git a/requirements/dev.txt b/requirements/dev.txt index 02c2ac95..5a07963b 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -118,7 +118,7 @@ packaging==26.0 # wheel path==17.1.1 # via -r requirements/test.txt -pip-tools==7.5.3 +pip-tools==7.6.2 # via -r requirements/pip-tools.txt platformdirs==4.9.4 # via diff --git a/requirements/pip-tools.txt b/requirements/pip-tools.txt index 8b3b2959..9ef82b22 100644 --- a/requirements/pip-tools.txt +++ b/requirements/pip-tools.txt @@ -12,7 +12,7 @@ packaging==26.0 # via # build # wheel -pip-tools==7.5.3 +pip-tools==7.6.2 # via -r requirements/pip-tools.in pyproject-hooks==1.2.0 # via diff --git a/requirements/pip.txt b/requirements/pip.txt index b61502dc..79e0ec40 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -10,7 +10,7 @@ wheel==0.46.3 # via -r requirements/pip.in # The following packages are considered to be unsafe in a requirements file: -pip==26.0.1 +pip==26.2.2 # via # -c requirements/common_constraints.txt # -r requirements/pip.in