Repository navigation
release v1.3.1: security dependency upgrades - #785
Merged
Merged
Conversation
…779) Pillow 12.x is affected by critical advisories (for example GHSA-v9pv-5gc8-w2m6, GHSA-332p-7hrc-92wf, GHSA-5x8w-8jj5-q52h) that allow code execution from a crafted image such as a profile picture. 13.0.0 is the first patched release.
…780) PyJWT 2.10.1 is affected by several advisories fixed between 2.14.0 and 2.15.0, including GHSA-ffc3-869f-jxw9 (critical, key-format check bypass in the HS/asymmetric confusion guard), GHSA-pxh4-856f-4h89 and GHSA-9j54-fg26-wv3r (HS256 accepted with an empty JWK key). 2.15.1 also accepts base64url padding that 2.15.0 rejected. Tokens with extra characters now fail with DecodeError instead of InvalidSignatureError, so the two malformed token tests expect DecodeError. The only production caller, check_exam_access in the courseware views, catches every exception.
…d forum API (#781) Security release of the forum app for GHSA-c6fp-f54c-6cv4 (critical): the forum HTTP API under /forum/api/ was open to anonymous users, allowing thread reads and deletes and username replacement. It is no longer routed unless FORUM_ENABLE_HTTP_API is set, and requires a staff caller when it is. Same change as upstream release/ulmo commit 9b58d04, including the relaxed cap in constraints.txt.
…ty advisories (#782) certifi 2026.10.19 removes emSign root CAs with compromised intermediate keys (GHSA-6q48-6c7w-9gw2). urllib3 2.8.0 fixes an unbounded chunk buffer, an infinite loop in chunked deflate streaming and HTTPS proxy TLS settings being ignored (GHSA-vxq7-64xx-v4gw, GHSA-gh4c-6fx4-qh6g, GHSA-8988-9cw3-xx77). djangorestframework 3.18.2 fixes request content negotiation burning about 19 seconds of CPU, JSONParser applying an attacker-named codec, and TokenProxy.delete() revoking nothing (GHSA-33wh-fxxf-88vv, GHSA-3547-9m27-7rxg, GHSA-xw6w-gcfp-cf8m). DRF 3.18 reports errors for items in a list as a dict keyed by index instead of a list, so three expectations in user_api account tests change from [{...}] to {0: {...}}.
…CE timing (#783) oauthlib 4.0.0 fixes unsafe JSONP callback injection in the token revocation endpoint (GHSA-hj66-6f7g-4r5v) and a timing attack in the PKCE code_verifier comparison (GHSA-xpv3-w29h-x7cv). It removes JSONP from the revocation endpoint and validates grant request parameters before authenticating the client, so a password grant request with no client credentials and no username or password now gets 400 instead of 401. The matching oauth_dispatch test expects 400.
…equests 2.34.2 (#784) * fix: upgrade social-auth-core to 5.0.2 (breaks third-party login pipeline, do not merge) social-auth-core 5.0.2 fixes session fixation and login CSRF issues but requires cryptography>=46.0.7 and requests>=2.34, so those are bumped and the cryptography<46.0.0 cap is removed (snowflake-connector-python 4.0.0 is installed). The upgrade makes 12 third_party_auth pipeline tests fail because partial pipeline resume now redirects to / instead of the complete URL. Same as upstream openedx#38841. * chore: sync requirements annotations with the compiled output The Consistent Python dependencies check recompiles the requirement files. With social-auth-core 5.0.2 depending on cryptography and the cryptography cap removed from constraints.txt, social-auth-core is added to the cryptography via list and the constraints.txt via entry is dropped from the sandbox and user retirement files. No versions change.
Faraz32123
approved these changes
Oct 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Brings the six security dependency fixes from
ulmo/rwaq-devinto the prod lineulmo/rwaq. Earlier releases (#770, #772) used the same dev-to-prod PR. Merge with a merge commit, not squash, then tag theulmo/rwaqtiprwaq_release_v1.3.1for the prod pin in rwaq-configurations#72.cryptography<46.0.0cap removedTicket: EDLYCSRWAQ-354.
What is in this diff
Before these fixes
ulmo/rwaqandulmo/rwaq-devhad identical file content (only the history differed). The comparison now shows 10 files changed: the requirement files (requirements/edx/{base,development,testing,doc}.txt,requirements/edx-sandbox/base.txt,scripts/user_retirement/requirements/base.txt),requirements/constraints.txt, and three test files with updated expectations (openedx/core/lib/tests/test_jwt.py,openedx/core/djangoapps/oauth_dispatch/tests/test_views.py,openedx/core/djangoapps/user_api/accounts/tests/test_views.py). No code outside tests changes.Known test failures
12
third_party_authprovider pipeline tests (Azure AD, Google, LinkedIn, Twitter) fail on social-auth-core 5.x. They are left failing on purpose. Rwaq prod has no social provider configured (checked read-only on 2026-10-26). Upstream has the same failures (openedx#38841).Verification
Each PR was tested locally and described in its own PR. The dev line is deployed to stage first from rwaq-configurations#71 (
rwaq_release_v1.3.1-rc1, same content as this PR) and checked with the stage checklist (S1 to S17) before prod.Stage first
The same content is checked on stage from rwaq-configurations#71, including the Rwaq specific cases W1 to W4 (WordPress purchase with a test card, enrollment API, Orders and Payments CSV, program bulk enroll). Merge this after stage passes.
Release
After merge: tag
rwaq_release_v1.3.1on theulmo/rwaqtip, then take rwaq-configurations#72 out of draft. No migrations.