Repository navigation
build: Pin setuptools & upgrade certifi, pip, and pip-tools [ulmo] - #4745
Merged
Merged
Conversation
Upgrades certifi from 2025.8.3 to 2026.10.19 and pip-tools from 7.5.0 to 7.6.2. certifi older than 2026.10.19 trusts the compromised emSign intermediate CAs. Generated with `make upgrade` limited to --upgrade-package for those packages. Part of: openedx/public-engineering#574 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
kdmccormick
requested review from
UsamaSadiq
and removed request for
UsamaSadiq
October 23, 2026 15:36
Removes the `pip<24.3` constraint from requirements/common_constraints.txt, which was only needed until pip-tools supported newer pip (pip-tools 7.6.2 does), and upgrades pip from 24.2 to 26.2.2. pip older than 26.2.2 trusts the compromised emSign intermediate CAs. Generated with `make upgrade` limited to --upgrade-package for pip and pip-tools. Part of: openedx/public-engineering#574 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
kdmccormick
changed the title
The ulmo Dockerfile is based on ubuntu:focal and installs Python 3.12 from the deadsnakes PPA, which no longer publishes for focal, so the CI image build failed (`Unable to locate package python3.12-dev`). Use the pre-built edxops/discovery-dev image for CI, as verawood does. The CI scripts still run `make requirements` inside the container, so tests use this branch's own requirements. This backports only the .ci/docker-compose-ci.yml part of e519c28 (#4697) and leaves the Dockerfile in place. Part of: openedx/public-engineering#574 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The migrations check installed requirements/local.txt directly, which doesn't pin setuptools, so it got the latest setuptools (84.2.1). That release no longer ships pkg_resources, which django-choices imports, so the check failed with `No module named 'pkg_resources'`. Install requirements/pip.txt first so setuptools stays at its pinned 80.9.0. Part of: openedx/public-engineering#574 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
django-choices imports pkg_resources at runtime, and setuptools 82.0.0 removed pkg_resources. setuptools wasn't pinned in the compiled requirements, so any fresh environment got the latest setuptools and course-discovery failed on startup with `No module named 'pkg_resources'`. Adds a `setuptools<82` constraint and compiles base, test, local and production requirements with --allow-unsafe, so setuptools is pinned (at 80.9.0, the version already in requirements/pip.txt). Generated with `make upgrade` limited to --upgrade-package setuptools==80.9.0. Part of: openedx/public-engineering#574 Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
kdmccormick
commented
Oct 23, 2026
Comment on lines
+32
to
+36
| # build: | ||
| # context: ../. | ||
| # target: dev | ||
| # args: | ||
| # PYTHON_VERSION: "${PYTHON_VERSION}" |
Member
Author
There was a problem hiding this comment.
Suggested change
| # build: | |
| # context: ../. | |
| # target: dev | |
| # args: | |
| # PYTHON_VERSION: "${PYTHON_VERSION}" |
no need to leave commented-out CI code behind
kdmccormick
marked this pull request as ready for review
October 23, 2026 16:25
kdmccormick
changed the title
Member
Author
|
Oops, I meant to enable Auto-Merge, but I actually just merged. |
Member
Author
|
@farhaanbukhsh could you retroactively review this one, and let me know if you have any concerns that should be addressed? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is both a security fix and a functional fix for the ulmo release.
Security: upgrades certifi from 2025.8.3 to 2026.10.19, pip from 24.2 to
26.2.2, and pip-tools from 7.5.0 to 7.6.2. certifi older than 2026.10.19
and pip older than 26.2.2 trust the compromised emSign intermediate CAs.
Also removes the
pip<24.3constraint fromrequirements/common_constraints.txt, which was only needed until
pip-tools supported newer pip (pip-tools 7.6.2 does).
Functional: pins setuptools below 82 so course-discovery can start.
django-choices imports pkg_resources at runtime, and setuptools 82.0.0
removed it. setuptools wasn't pinned in the compiled requirements, so a
fresh ulmo environment got the latest setuptools and failed with
No module named 'pkg_resources'. This adds asetuptools<82constraintand compiles base, test, local and production requirements with
--allow-unsafe, so setuptools is pinned at 80.9.0.
Also includes two CI fixes needed for checks to pass on this branch:
building the Dockerfile, which is based on ubuntu:focal and can no
longer install Python 3.12 from the deadsnakes PPA. This backports
only the .ci/docker-compose-ci.yml part of e519c28 (fix: use pre-built image instead of building from Dockerfile #4697).
setuptools stays at its pinned version.
Requirements changes were generated with
make upgradelimited to--upgrade-package for certifi, pip, pip-tools and setuptools.
Part of: openedx/public-engineering#574
Co-authored-by: Claude Opus 5.5 noreply@anthropic.com