chore: Upgrade Python requirements

.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
 
     services:
       mysql:
-        image: mysql:8.0
+        image: mysql:8.4
         options: '--health-cmd="mysqladmin ping -h localhost" --health-interval=10s --health-timeout=5s --health-retries=3'
         env:
           MYSQL_ROOT_PASSWORD:

requirements/base.txt

@@ -20,17 +20,17 @@ certifi==2026.7.22
     # via
     #   elasticsearch
     #   requests
-cffi==2.1.0
+cffi==2.1.1
     # via
     #   cryptography
     #   pynacl
-charset-normalizer==3.4.9
+charset-normalizer==3.5.1
     # via requests
 click==8.4.2
     # via edx-django-utils
-cryptography==49.0.0
+cryptography==50.0.0
     # via pyjwt
-django==5.2.16
+django==5.2.17
     # via
     #   -c requirements/constraints.txt
     #   -r requirements/base.in
@@ -60,7 +60,7 @@ django-waffle==5.0.0
     # via
     #   edx-django-utils
     #   edx-drf-extensions
-djangorestframework==3.17.1
+djangorestframework==3.18.0
     # via
     #   -r requirements/base.in
     #   django-elasticsearch-dsl-drf
@@ -108,7 +108,7 @@ meilisearch==0.43.0
     # via -r requirements/base.in
 mysqlclient==2.2.8
     # via -r requirements/base.in
-packaging==26.2
+packaging==26.3
     # via
     #   django-nine
     #   gunicorn
@@ -163,7 +163,7 @@ six==1.17.0
     #   edx-django-release-util
     #   elasticsearch-dsl
     #   python-dateutil
-sqlparse==0.5.5
+sqlparse==0.6.0
     # via django
 stevedore==5.9.0
     # via
@@ -177,7 +177,7 @@ typing-extensions==4.16.0
     #   pydantic-core
     #   referencing
     #   typing-inspection
-typing-inspection==0.4.2
+typing-inspection==0.4.4
     # via pydantic
 uritemplate==4.2.0
     # via drf-spectacular
@@ -187,5 +187,5 @@ urllib3==1.26.20
     #   requests
 
 # The following packages are considered to be unsafe in a requirements file:
-setuptools==83.0.0
+setuptools==84.0.0
     # via -r requirements/base.in

requirements/ci.txt

@@ -4,37 +4,38 @@
 #
 #    make upgrade
 #
-cachetools==7.1.6
+cachetools==7.1.7
     # via tox
 colorama==0.4.6
     # via tox
 distlib==0.4.3
     # via virtualenv
-filelock==3.32.0
+filelock==3.32.3
     # via
     #   python-discovery
     #   tox
     #   virtualenv
-packaging==26.2
+packaging==26.3
     # via
     #   pyproject-api
     #   tox
-platformdirs==4.11.0
+platformdirs==4.11.3
     # via
-    #   python-discovery
     #   tox
     #   virtualenv
 pluggy==1.6.0
     # via tox
 pyproject-api==1.11.0
     # via tox
-python-discovery==1.5.0
+python-discovery==1.5.2
     # via
     #   tox
     #   virtualenv
 tomli-w==1.2.0
     # via tox
-tox==4.58.0
+tox==4.60.0
     # via -r requirements/ci.in
-virtualenv==21.7.0
+typing-extensions==4.16.0
+    # via tox
+virtualenv==21.7.4
     # via tox

requirements/common_constraints.txt

@@ -23,3 +23,20 @@ elasticsearch<7.14.0
 # Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561
 social-auth-app-django<6.0.0
 social-auth-core<5.0.0
+
+# 2026-08-11: pip-tools is only tested against the latest pip released at the time
+# pip-tools was released; also, pip-tools package dependencies are extremely permissive
+# about the pip version required, so the dependency resolver will not prevent an unwanted
+# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained
+# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <->
+# pip-tools compatibility.  We've constrained pip here in common_constraints.txt in the
+# past, but always removed it once the issue was "fixed". Removing this constraint was
+# always a mistake.
+#
+# This is a semi-permanent constraint and should be manually bumped after each pip-tools
+# release.
+#
+# Exceptional conditions for removal:
+# - We stop using pip-tools, OR
+# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257
+pip<26.2.1  # Known to work with pip-tools==7.6.1

requirements/django.txt

@@ -1 +1 @@
-django==5.2.16
+django==5.2.17

requirements/pip-tools.txt

@@ -8,17 +8,17 @@ build==1.5.0
     # via pip-tools
 click==8.4.2
     # via pip-tools
-packaging==26.2
+packaging==26.3
     # via
     #   build
     #   wheel
-pip-tools==7.6.0
+pip-tools==7.6.1
     # via -r requirements/pip-tools.in
 pyproject-hooks==1.2.0
     # via
     #   build
     #   pip-tools
-wheel==0.47.0
+wheel==0.48.0
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/pip.txt

@@ -4,13 +4,15 @@
 #
 #    make upgrade
 #
-packaging==26.2
+packaging==26.3
     # via wheel
-wheel==0.47.0
+wheel==0.48.0
     # via -r requirements/pip.in
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==26.1.2
-    # via -r requirements/pip.in
-setuptools==83.0.0
+pip==26.2
+    # via
+    #   -c requirements/common_constraints.txt
+    #   -r requirements/pip.in
+setuptools==84.0.0
     # via -r requirements/pip.in

requirements/quality.txt

@@ -26,7 +26,7 @@ attrs==26.1.0
     #   -r requirements/test.txt
     #   jsonschema
     #   referencing
-cachetools==7.1.6
+cachetools==7.1.7
     # via
     #   -r requirements/test.txt
     #   tox
@@ -41,17 +41,17 @@ certifi==2026.7.22
     #   -r requirements/test.txt
     #   elasticsearch
     #   requests
-cffi==2.1.0
+cffi==2.1.1
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
     #   cryptography
     #   pynacl
-chardet==7.4.3
+chardet==7.6.0
     # via
     #   -r requirements/test.txt
     #   diff-cover
-charset-normalizer==3.4.9
+charset-normalizer==3.5.1
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
@@ -75,18 +75,18 @@ colorama==0.4.6
     # via
     #   -r requirements/test.txt
     #   tox
-coverage[toml]==7.15.2
+coverage[toml]==7.15.4
     # via
     #   -r requirements/test.txt
     #   pytest-cov
-cryptography==49.0.0
+cryptography==50.0.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
     #   pyjwt
 ddt==1.7.2
     # via -r requirements/test.txt
-diff-cover==10.4.1
+diff-cover==10.5.1
     # via -r requirements/test.txt
 dill==0.4.1
     # via
@@ -96,7 +96,7 @@ distlib==0.4.3
     # via
     #   -r requirements/test.txt
     #   virtualenv
-django==5.2.16
+django==5.2.17
     # via
     #   -c requirements/constraints.txt
     #   -r requirements/base.txt
@@ -140,7 +140,7 @@ django-waffle==5.0.0
     #   -r requirements/test.txt
     #   edx-django-utils
     #   edx-drf-extensions
-djangorestframework==3.17.1
+djangorestframework==3.18.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
@@ -201,7 +201,7 @@ faker==40.36.0
     # via
     #   -r requirements/test.txt
     #   factory-boy
-filelock==3.32.0
+filelock==3.32.3
     # via
     #   -r requirements/test.txt
     #   python-discovery
@@ -262,7 +262,7 @@ mysqlclient==2.2.8
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
-packaging==26.2
+packaging==26.3
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
@@ -282,11 +282,10 @@ path-py==12.5.0
     #   -r requirements/test.txt
 pep8==1.7.1
     # via -r requirements/test.txt
-platformdirs==4.11.0
+platformdirs==4.11.3
     # via
     #   -r requirements/test.txt
     #   pylint
-    #   python-discovery
     #   tox
     #   virtualenv
 pluggy==1.6.0
@@ -329,7 +328,7 @@ pyjwt[crypto]==2.13.0
     #   -r requirements/test.txt
     #   drf-jwt
     #   edx-drf-extensions
-pylint==4.0.6
+pylint==4.0.7
     # via
     #   -r requirements/quality.in
     #   -r requirements/test.txt
@@ -366,14 +365,14 @@ pytest==9.1.1
     #   pytest-django
 pytest-cov==7.1.0
     # via -r requirements/test.txt
-pytest-django==4.12.0
+pytest-django==4.14.0
     # via -r requirements/test.txt
 python-dateutil==2.9.0.post0
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
     #   elasticsearch-dsl
-python-discovery==1.5.0
+python-discovery==1.5.2
     # via
     #   -r requirements/test.txt
     #   tox
@@ -422,7 +421,7 @@ six==1.17.0
     #   edx-lint
     #   elasticsearch-dsl
     #   python-dateutil
-sqlparse==0.5.5
+sqlparse==0.6.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
@@ -447,7 +446,7 @@ tomlkit==0.15.1
     #   -r requirements/test.txt
     #   edx-lint
     #   pylint
-tox==4.58.0
+tox==4.60.0
     # via -r requirements/test.txt
 typing-extensions==4.16.0
     # via
@@ -457,8 +456,9 @@ typing-extensions==4.16.0
     #   pydantic
     #   pydantic-core
     #   referencing
+    #   tox
     #   typing-inspection
-typing-inspection==0.4.2
+typing-inspection==0.4.4
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt
@@ -474,13 +474,13 @@ urllib3==1.26.20
     #   -r requirements/test.txt
     #   elasticsearch
     #   requests
-virtualenv==21.7.0
+virtualenv==21.7.4
     # via
     #   -r requirements/test.txt
     #   tox
 
 # The following packages are considered to be unsafe in a requirements file:
-setuptools==83.0.0
+setuptools==84.0.0
     # via
     #   -r requirements/base.txt
     #   -r requirements/test.txt