[kdmccormick]

Needs attention: The diff is noisy because the committed requirements on release/verawood had 17 packages pinned twice with identical lines (probably from a merge), and recompiling removes the duplicates. No versions change except certifi (2026.1.4 → 2026.10.19), pip (25.3 → 26.2.2) and pip-tools (7.5.2 → 7.6.2).

Commits after the first:

• Cherry-picks fix: use PEP 508 syntax for credentials-themes requirement #3004 from master (PEP 508 syntax for credentials-themes). pip 26 rejects the old #egg=edx_credentials_themes==0.5.6 fragment, which made make upgrade crash.
• Removes the pip<26.0 cap from requirements/common_constraints.txt and upgrades pip to 26.2.2.

Upgrades certifi from 2026.1.4 to 2026.10.19 and pip-tools from 7.5.2 to
7.6.2. certifi older than 2026.10.19 trusts the compromised emSign
intermediate CAs. Generated with make upgrade limited to
--upgrade-package for those packages.

Part of: openedx/public-engineering#574

🤖 Generated with Claude Code

[kdmccormick]

🤖 This comment was written by Claude (Claude Code), on behalf of @kdmccormick.

Review of the requirements diff against release/verawood. I found no concerns for a security patch to a stable release.

Only three packages change version:

• certifi: 2026.1.4 → 2026.10.19. This is the security fix.
• pip: 25.3 → 26.2.2. This is also the security fix. pip older than 26.2.2 trusts the compromised emSign intermediate CAs.
• pip-tools: 7.5.2 → 7.6.2. This is a minor bump, needed because older pip-tools doesn't work with pip 26.2+. pip-tools only compiles requirements and isn't used at runtime.

The rest of the diff is noise that doesn't change what gets installed:

• Duplicate pins removed. The committed requirements files on release/verawood listed 17 packages twice at identical versions, probably from a merge. Examples are bleach 6.3.0, click 8.3.1, grpcio 1.76.0, redis 7.1.0 and edx-auth-backends 4.6.2. Recompiling keeps one copy of each, at the same version.
• openedx-didkit 0.3.5 is removed and re-added at the same version, just in a different place.
• The pip<26.0 cap is removed from requirements/common_constraints.txt, since pip-tools 7.6.2 supports pip 26.
• The cherry-picked fix: use PEP 508 syntax for credentials-themes requirement #3004 changes base.in from the #egg=edx_credentials_themes==0.5.6 form to edx_credentials_themes @ git+…@0.5.6, because pip 26 rejects the old egg fragment. The compiled .txt files already used the @ form, so their credentials-themes lines are unchanged.
• The rest is # via comment changes.

There are no major version bumps, no newly added packages and no other changes to installed versions.

[farhaanbukhsh]

👍

✅ I tested this: this only requirement update so checked for compatibility
✅ I read through the code
❌ I checked for accessibility issues
❌ Includes documentation