[syedsajjadkazmii]

Depends on #780 (PyJWT 2.15.1)

social-auth-core 5.0.x requires PyJWT[crypto]>=2.13.0, and this branch is based on ulmo/rwaq-dev, which still pins PyJWT 2.10.1. Installing this branch alone fails with a pip ResolutionImpossible error, which is why most CI jobs on this PR fail at the install step (Compile requirements, Lint Python Imports, Static analysis, JS tests, migrations checks, pylint). Merge #780 first, then update this branch and re-run CI. In the local containers, with all six upgrades installed together, pip check is clean.

Summary

Upgrades social-auth-core from 4.8.1 to 5.0.2 in the edx-platform requirement files (base, development, testing, doc). 5.0.2 requires cryptography>=46.0.7 and requests>=2.34, so this also bumps:

• cryptography 45.0.7 to 46.0.7
• requests 2.32.5 to 2.34.2
• removes the cryptography<46.0.0 cap from requirements/constraints.txt. It existed because cryptography 46.0.0 conflicted with snowflake-connector-python (Upgrade Requirements action broken on snowflake-connector-python openedx/openedx-platform#37417). snowflake-connector-python 4.0.0 is installed, and pyOpenSSL 25.3.0 allows cryptography<47. The pact-python<3.0.0 cap stays.

Advisories fixed

• GHSA-vqg6-3fw6-j9jg: session fixation (fixed in 5.0.0).
• GHSA-526j-582w-7fm9: login CSRF in the LINE backend (5.0.2).
• Others fixed in 5.0.0, none for backends that look enabled here: VK app (high), LoginRadius, Vend.

Known test failures (12)

12 third_party_auth integration tests fail only on the new versions: test_full_pipeline_succeeds_for_linking_account, ..._for_signing_in_to_existing_active_account and ..._registering_new_account for Azure AD, Google, LinkedIn and Twitter. In assert_logged_in_cookie_redirect the redirect after the registration step is / where the tests expect /auth/complete/<backend>/? (the pipeline resume URL), so the partial pipeline is not resumed.

This matches social-auth-core 5.0.0 and 5.0.1: partial pipeline resume now requires session ownership or explicit confirmation to prevent login CSRF. Upstream has the same failure and pinned social-auth-core<5.0.0 as a workaround (openedx#38841, open). Upstream master is on 4.9.1, which does not fix the session fixation bug.

Why this is safe for Rwaq (checked 2026-10-26, read-only)

On Rwaq prod: third-party auth is enabled but no provider is configured (0 OAuth2, SAML, SAML configuration and LTI provider rows), so the Google, LinkedIn, Azure AD and Twitter flows these tests cover do not exist there. The only social login in use is the edx-oauth2 backend, which Studio uses to sign in through the LMS (28 linked users out of about 2.5 million). That login is covered by the session fixation fix.

Tested locally on these versions in the CMS container: LMS login, Studio login redirect through the LMS (/login/edx-oauth2/), the Studio MFE after login, and sign out then sign in again. All passed. The Studio login test was done by hand in a browser.

Testing (local Tutor, pip check clean, same suites on old and new versions in one container)

third_party_auth, oauth_dispatch, auth_exchange, user_authn, test_jwt and lti_provider: 41 failed on the new versions, 29 on the old. The 29 are test-environment failures that exist on both (CMS-only plugin middleware in the CMS container). The 12 extra failures are the pipeline tests above. The cryptography-dependent libraries import cleanly (snowflake-connector, paramiko, pgpy, jwcrypto, fernet fields).

Decision on the 12 failing tests

Left failing on purpose (decided 2026-10-26). They are not skipped or changed in this PR, so the failures stay visible until the upstream issue (openedx-platform#38841) is resolved.

Release

Goes into rwaq_release_v1.3.1 with #779 to #783. No migrations. After deploy on stage, sign in to Studio through the LMS and confirm the course list loads.

[Faraz32123]

LGTM. Dependency version bump with correct test adaptations.