chore: Upgrade Python requirements

playbooks/roles/aws/templates/requirements.txt.j2

@@ -4,29 +4,30 @@
 #
 #    make upgrade
 #
-awscli==1.38.8
+awscli==1.46.0
     # via -r requirements/aws.in
 boto==2.49.0
     # via -r requirements/aws.in
-boto3==1.37.8
+boto3==1.43.72
     # via -r requirements/aws.in
-botocore==1.37.8
+botocore==1.43.72
     # via
-    #   awscli
     #   boto3
     #   s3transfer
 colorama==0.4.6
     # via awscli
-docutils==0.16
+docutils==0.19
     # via awscli
-jmespath==1.0.1
+jmespath==1.1.0
     # via
+    #   awscli
     #   boto3
     #   botocore
-pyasn1==0.6.1
+pyasn1==0.6.4
     # via rsa
 python-dateutil==2.9.0.post0
     # via
+    #   awscli
     #   botocore
     #   s3cmd
 python-magic==0.4.27
@@ -39,13 +40,12 @@ rsa==4.7.2
     # via awscli
 s3cmd==2.4.0
     # via -r requirements/aws.in
-s3transfer==0.11.4
-    # via
-    #   awscli
-    #   boto3
+s3transfer==0.19.2
+    # via boto3
 six==1.17.0
     # via python-dateutil
 urllib3==1.26.18
     # via
     #   -r requirements/aws.in
+    #   awscli
     #   botocore

requirements.txt

@@ -8,56 +8,56 @@ ansible==2.10.7
     # via -r requirements/base.in
 ansible-base==2.10.17
     # via ansible
-awscli==1.38.8
+awscli==1.46.0
     # via -r requirements/base.in
 bcrypt==3.1.7
     # via
     #   -c requirements/constraints.txt
     #   paramiko
 boto==2.49.0
     # via -r requirements/base.in
-boto3==1.37.8
+boto3==1.43.72
     # via -r requirements/base.in
-botocore==1.37.8
+botocore==1.43.72
     # via
-    #   awscli
     #   boto3
     #   s3transfer
-certifi==2025.1.31
+certifi==2026.7.22
     # via requests
-cffi==1.17.1
+cffi==2.1.1
     # via
     #   bcrypt
     #   cryptography
     #   pynacl
-charset-normalizer==3.4.1
+charset-normalizer==3.5.1
     # via requests
 colorama==0.4.6
     # via awscli
-cryptography==44.0.2
+cryptography==50.0.0
     # via
     #   ansible-base
     #   paramiko
 datadog==0.8.0
     # via -r requirements/base.in
-decorator==5.2.1
+decorator==5.3.1
     # via
     #   datadog
     #   networkx
 docopt==0.6.2
     # via -r requirements/base.in
-docutils==0.16
+docutils==0.19
     # via awscli
 ecdsa==0.13.3
     # via -r requirements/base.in
-idna==3.10
+idna==3.18
     # via requests
 jinja2==2.8
     # via
     #   -r requirements/base.in
     #   ansible-base
-jmespath==1.0.1
+jmespath==1.1.0
     # via
+    #   awscli
     #   boto3
     #   botocore
 markupsafe==2.0.1
@@ -68,51 +68,51 @@ mysqlclient==1.4.6
     # via -r requirements/base.in
 networkx==1.11
     # via -r requirements/base.in
-packaging==24.2
+packaging==26.3
     # via ansible-base
 paramiko==2.4.2
     # via -r requirements/base.in
 pathlib2==2.3.0
     # via -r requirements/base.in
 prettytable==0.7.2
     # via -r requirements/base.in
-pyasn1==0.6.1
+pyasn1==0.6.4
     # via
     #   paramiko
     #   rsa
-pycparser==2.22
+pycparser==3.0
     # via cffi
-pycryptodome==3.21.0
+pycryptodome==3.23.0
     # via -r requirements/base.in
 pymongo==3.9.0
     # via -r requirements/base.in
-pynacl==1.5.0
+pynacl==1.6.2
     # via paramiko
 python-dateutil==2.9.0.post0
-    # via botocore
-pyyaml==6.0.2
+    # via
+    #   awscli
+    #   botocore
+pyyaml==6.0.3
     # via
     #   -r requirements/base.in
     #   ansible-base
     #   awscli
-requests==2.32.3
+requests==2.34.2
     # via
     #   -r requirements/base.in
     #   datadog
 rsa==4.7.2
     # via awscli
-s3transfer==0.11.4
-    # via
-    #   awscli
-    #   boto3
+s3transfer==0.19.2
+    # via boto3
 six==1.17.0
     # via
     #   bcrypt
     #   pathlib2
     #   python-dateutil
 urllib3==1.26.18
     # via
-    #   -c requirements/common_constraints.txt
     #   -r requirements/base.in
+    #   awscli
     #   botocore
     #   requests

requirements/common_constraints.txt

@@ -12,27 +12,32 @@
 #  this file from Github directly. It does not require packaging in edx-lint.
 
 # using LTS django version
-Django<5.0
+Django<6.0
 
 # elasticsearch>=7.14.0 includes breaking changes in it which caused issues in discovery upgrade process.
 # elastic search changelog: https://www.elastic.co/guide/en/enterprise-search/master/release-notes-7.14.0.html
 # See https://github.com/openedx/edx-platform/issues/35126 for more info
 elasticsearch<7.14.0
 
-# django-simple-history>3.0.0 adds indexing and causes a lot of migrations to be affected
-django-simple-history==3.0.0
+# 2026-07-06: Constrain social-auth-* packages to the latest version compatible with
+# edx-drf-extensions<=10.6.0. (Newer versions require a POST instead of a GET.)
+# Tracking issue: https://github.com/openedx/edx-drf-extensions/issues/561
+social-auth-app-django<6.0.0
+social-auth-core<5.0.0
 
-# Cause: https://github.com/openedx/event-tracking/pull/290
-# event-tracking 2.4.1 upgrades to pymongo 4.4.0 which is not supported on edx-platform.
-# We will pin event-tracking to do not break existing installations
-# This can be unpinned once https://github.com/openedx/edx-platform/issues/34586
-# has been resolved and edx-platform is running with pymongo>=4.4.0
-event-tracking<2.4.1
-
-# Cause: https://github.com/openedx/edx-lint/issues/458
-# This can be unpinned once https://github.com/openedx/edx-lint/issues/459 has been resolved.
-pip<24.3
-
-# Cause: https://github.com/openedx/edx-lint/issues/475
-# This can be unpinned once https://github.com/openedx/edx-lint/issues/476 has been resolved.
-urllib3<2.3.0
+# 2026-08-11: pip-tools is only tested against the latest pip released at the time
+# pip-tools was released; also, pip-tools package dependencies are extremely permissive
+# about the pip version required, so the dependency resolver will not prevent an unwanted
+# pip upgrade which would break pip-tools. The end result is that pip MUST be constrained
+# by all pip-tools users in order to avoid potentially weeks-long lapses in pip <->
+# pip-tools compatibility.  We've constrained pip here in common_constraints.txt in the
+# past, but always removed it once the issue was "fixed". Removing this constraint was
+# always a mistake.
+#
+# This is a semi-permanent constraint and should be manually bumped after each pip-tools
+# release.
+#
+# Exceptional conditions for removal:
+# - We stop using pip-tools, OR
+# - We migrate to the proposed `pip-tools[stable]` extra: https://github.com/jazzband/pip-tools/pull/2257
+pip<26.2.1  # Known to work with pip-tools==7.6.1

requirements/pip-tools.txt

@@ -4,19 +4,21 @@
 #
 #    make upgrade
 #
-build==1.2.2.post1
+build==1.5.0
     # via pip-tools
-click==8.1.8
+click==8.4.2
     # via pip-tools
-packaging==24.2
-    # via build
-pip-tools==7.4.1
+packaging==26.3
+    # via
+    #   build
+    #   wheel
+pip-tools==7.6.1
     # via -r requirements/pip-tools.in
 pyproject-hooks==1.2.0
     # via
     #   build
     #   pip-tools
-wheel==0.45.1
+wheel==0.48.0
     # via pip-tools
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/pip.txt

@@ -8,7 +8,7 @@ wheel==0.44.0
     # via -r requirements/pip.in
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==24.2
+pip==26.2
     # via
     #   -c requirements/common_constraints.txt
     #   -r requirements/pip.in