diff --git a/requirements/ci.txt b/requirements/ci.txt index dbffe72..e35d8c3 100644 --- a/requirements/ci.txt +++ b/requirements/ci.txt @@ -10,7 +10,7 @@ colorama==0.4.6 # via tox distlib==0.4.3 # via virtualenv -filelock==3.32.2 +filelock==3.32.3 # via # python-discovery # tox @@ -19,7 +19,7 @@ packaging==26.3 # via # pyproject-api # tox -platformdirs==4.11.2 +platformdirs==4.11.3 # via # tox # virtualenv @@ -33,7 +33,7 @@ python-discovery==1.5.2 # virtualenv tomli-w==1.2.0 # via tox -tox==4.59.0 +tox==4.60.0 # via -r requirements/ci.in typing-extensions==4.16.0 # via tox diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt index edb1bcb..f60f86e 100644 --- a/requirements/common_constraints.txt +++ b/requirements/common_constraints.txt @@ -24,3 +24,20 @@ elasticsearch<7.14.0 # Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561 social-auth-app-django<6.0.0 social-auth-core<5.0.0 + +# 2026-08-11: pip-tools is only tested against the latest pip released at the time +# pip-tools was released; also, pip-tools package dependencies are extremely permissive +# about the pip version required, so the dependency resolver will not prevent an unwanted +# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained +# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <-> +# pip-tools compatibility. We've constrained pip here in common_constraints.txt in the +# past, but always removed it once the issue was "fixed". Removing this constraint was +# always a mistake. +# +# This is a semi-permanent constraint and should be manually bumped after each pip-tools +# release. +# +# Exceptional conditions for removal: +# - We stop using pip-tools, OR +# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257 +pip<26.2.1 # Known to work with pip-tools==7.6.1 diff --git a/requirements/dev.txt b/requirements/dev.txt index db6b8b0..e94b1c7 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -21,7 +21,7 @@ cachetools==7.1.7 # via # -r requirements/ci.txt # tox -chardet==7.5.1 +chardet==7.6.0 # via diff-cover click==8.4.2 # via @@ -47,7 +47,7 @@ coverage[toml]==7.15.4 # via # -r requirements/quality.txt # pytest-cov -diff-cover==10.5.0 +diff-cover==10.5.1 # via -r requirements/dev.in dill==0.4.1 # via @@ -63,7 +63,7 @@ django==5.2.17 # -r requirements/quality.txt edx-lint==6.1.0 # via -r requirements/quality.txt -filelock==3.32.2 +filelock==3.32.3 # via # -r requirements/ci.txt # python-discovery @@ -104,7 +104,7 @@ packaging==26.3 # wheel pip-tools==7.6.1 # via -r requirements/pip-tools.txt -platformdirs==4.11.2 +platformdirs==4.11.3 # via # -r requirements/ci.txt # -r requirements/quality.txt @@ -184,7 +184,7 @@ snowballstemmer==3.1.1 # via # -r requirements/quality.txt # pydocstyle -sqlparse==0.5.5 +sqlparse==0.6.0 # via # -r requirements/quality.txt # django @@ -205,7 +205,7 @@ tomlkit==0.15.1 # -r requirements/quality.txt # edx-lint # pylint -tox==4.59.0 +tox==4.60.0 # via -r requirements/ci.txt typing-extensions==4.16.0 # via diff --git a/requirements/django.txt b/requirements/django.txt index c59a106..91927ae 100644 --- a/requirements/django.txt +++ b/requirements/django.txt @@ -10,5 +10,5 @@ django==5.2.17 # via # -c requirements/common_constraints.txt # -r requirements/django.in -sqlparse==0.5.5 +sqlparse==0.6.0 # via django diff --git a/requirements/doc.txt b/requirements/doc.txt index 72e7cdf..43757f2 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -22,7 +22,7 @@ certifi==2026.7.22 # via requests cffi==2.1.1 # via cryptography -charset-normalizer==3.5.0 +charset-normalizer==3.5.1 # via requests click==8.4.2 # via -r requirements/test.txt @@ -166,7 +166,7 @@ sphinxcontrib-qthelp==2.0.0 # via sphinx sphinxcontrib-serializinghtml==2.0.0 # via sphinx -sqlparse==0.5.5 +sqlparse==0.6.0 # via # -r requirements/test.txt # django diff --git a/requirements/pip.txt b/requirements/pip.txt index 047c23f..582d620 100644 --- a/requirements/pip.txt +++ b/requirements/pip.txt @@ -10,7 +10,9 @@ wheel==0.48.0 # via -r requirements/pip.in # The following packages are considered to be unsafe in a requirements file: -pip==26.2.1 - # via -r requirements/pip.in +pip==26.2 + # via + # -c requirements/common_constraints.txt + # -r requirements/pip.in setuptools==84.0.0 # via -r requirements/pip.in diff --git a/requirements/quality.txt b/requirements/quality.txt index df32cbe..1c9e40e 100644 --- a/requirements/quality.txt +++ b/requirements/quality.txt @@ -58,7 +58,7 @@ packaging==26.3 # via # -r requirements/test.txt # pytest -platformdirs==4.11.2 +platformdirs==4.11.3 # via pylint pluggy==1.6.0 # via @@ -105,7 +105,7 @@ six==1.17.0 # via edx-lint snowballstemmer==3.1.1 # via pydocstyle -sqlparse==0.5.5 +sqlparse==0.6.0 # via # -r requirements/test.txt # django diff --git a/requirements/test.txt b/requirements/test.txt index 97cfc49..095b587 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -41,7 +41,7 @@ python-slugify==8.0.4 # via -r requirements/base.txt pyyaml==6.0.3 # via -r requirements/base.txt -sqlparse==0.5.5 +sqlparse==0.6.0 # via # -r requirements/django.txt # django