chore: use constraints in requirements

* use common_constraints.txt in constraints.txt
* use constraints.txt in pip-tools.in
* make upgrade

requirements/base.txt

@@ -10,11 +10,11 @@ asgiref==3.8.1
     # via django
 attrs==24.2.0
     # via openedx-events
-bleach==6.1.0
+bleach==6.2.0
     # via -r requirements/base.in
-boto3==1.35.43
+boto3==1.35.52
     # via -r requirements/base.in
-botocore==1.35.43
+botocore==1.35.52
     # via
     #   boto3
     #   s3transfer
@@ -34,6 +34,7 @@ defusedxml==0.7.1
     # via -r requirements/base.in
 django==4.2.16
     # via
+    #   -c requirements/common_constraints.txt
     #   -c requirements/constraints.txt
     #   -r requirements/base.in
     #   django-crum
@@ -86,7 +87,7 @@ edx-opaque-keys[django]==2.11.0
     #   -r requirements/base.in
     #   edx-ccx-keys
     #   openedx-events
-edx-submissions==3.8.2
+edx-submissions==3.8.3
     # via -r requirements/base.in
 edx-toggles==5.2.0
     # via -r requirements/base.in
@@ -126,7 +127,7 @@ lxml[html-clean]==5.3.0
     #   xblock
 lxml-html-clean==0.3.1
     # via lxml
-mako==1.3.5
+mako==1.3.6
     # via xblock
 markupsafe==3.0.2
     # via
@@ -189,7 +190,6 @@ simplejson==3.19.3
     # via xblock
 six==1.16.0
     # via
-    #   bleach
     #   edx-ccx-keys
     #   edx-django-release-util
     #   fs
@@ -221,10 +221,11 @@ webencodings==0.5.1
     # via
     #   bleach
     #   html5lib
-webob==1.8.8
+webob==1.8.9
     # via xblock
 xblock==5.1.0
     # via -r requirements/base.in
 
 # The following packages are considered to be unsafe in a requirements file:
-# setuptools
+setuptools==75.3.0
+    # via fs

requirements/ci.in

@@ -1,4 +1,5 @@
 -c constraints.txt
 -r tox.txt
 
-coveralls
+coveralls
+setuptools

requirements/ci.txt

@@ -20,7 +20,7 @@ colorama==0.4.6
     # via
     #   -r requirements/tox.txt
     #   tox
-coverage[toml]==7.6.3
+coverage[toml]==7.6.4
     # via coveralls
 coveralls==4.0.1
     # via -r requirements/ci.in
@@ -59,11 +59,15 @@ pyproject-api==1.8.0
     #   tox
 requests==2.32.3
     # via coveralls
-tox==4.23.0
+tox==4.23.2
     # via -r requirements/tox.txt
 urllib3==2.2.3
     # via requests
-virtualenv==20.27.0
+virtualenv==20.27.1
     # via
     #   -r requirements/tox.txt
     #   tox
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==75.3.0
+    # via -r requirements/ci.in

requirements/common_constraints.txt

@@ -30,3 +30,7 @@ elasticsearch<7.14.0
 # This can be unpinned once https://github.com/openedx/edx-platform/issues/34586
 # has been resolved and edx-platform is running with pymongo>=4.4.0
 event-tracking<2.4.1
+
+# Cause: https://github.com/openedx/edx-lint/issues/458
+# This can be unpinned once https://github.com/openedx/edx-lint/issues/459 has been resolved.
+pip<24.3

requirements/constraints.txt

@@ -1,5 +1,7 @@
 # Version constraints for pip-installation.
 
+-c common_constraints.txt
+
 # Base dependencies
 Django<4.3                         # Stay on the latest LTS release of Django
 fs<=2.0.18                         # Constrained by edx-platform
@@ -21,13 +23,6 @@ moto<5.0
 # path 13.2.0 drops support for Python 3.5
 path<13.2.0
 
-# Needed to resolve requirements between path and tox
-# path only requires >=0.5 but tox requires <2
-# path is defined in base.in so it compiles to the most recent version in base.txt,
-#     and tox comes in in test.in
-importlib-metadata<2
-setuptools<60.0
-
 # incremental upgrade plan.
 django-simple-history<=3.1.1
 

requirements/docs.txt

@@ -44,10 +44,8 @@ jinja2==3.1.4
 markupsafe==3.0.2
     # via jinja2
 packaging==24.1
-    # via
-    #   pydata-sphinx-theme
-    #   sphinx
-pydata-sphinx-theme==0.15.4
+    # via sphinx
+pydata-sphinx-theme==0.16.0
     # via sphinx-book-theme
 pygments==2.18.0
     # via
@@ -95,7 +93,7 @@ sphinxcontrib-qthelp==2.0.0
     # via sphinx
 sphinxcontrib-serializinghtml==2.0.0
     # via sphinx
-starlette==0.41.0
+starlette==0.41.2
     # via sphinx-autobuild
 typing-extensions==4.12.2
     # via pydata-sphinx-theme

requirements/pip-tools.in

@@ -2,4 +2,6 @@
 # them deterministically with `pip-sync`.
 # `pip-compile` itself is used to generate pip-tools.txt.
 
-pip-tools
+-c constraints.txt
+
+pip-tools

requirements/pip.txt

@@ -9,8 +9,8 @@ wheel==0.44.0
 
 # The following packages are considered to be unsafe in a requirements file:
 pip==24.2
-    # via -r requirements/pip.in
-setuptools==59.8.0
     # via
-    #   -c requirements/constraints.txt
+    #   -c requirements/common_constraints.txt
     #   -r requirements/pip.in
+setuptools==75.3.0
+    # via -r requirements/pip.in

requirements/quality.txt

@@ -36,14 +36,14 @@ binaryornot==0.4.4
     # via
     #   -r requirements/test.txt
     #   cookiecutter
-bleach==6.1.0
+bleach==6.2.0
     # via -r requirements/test.txt
-boto3==1.35.43
+boto3==1.35.52
     # via
     #   -r requirements/test.txt
     #   fs-s3fs
     #   moto
-botocore==1.35.43
+botocore==1.35.52
     # via
     #   -r requirements/test.txt
     #   boto3
@@ -112,11 +112,11 @@ cookiecutter==2.6.0
     # via
     #   -r requirements/test.txt
     #   xblock-sdk
-coverage[toml]==7.6.3
+coverage[toml]==7.6.4
     # via
     #   -r requirements/test.txt
     #   pytest-cov
-cryptography==43.0.1
+cryptography==43.0.3
     # via
     #   -r requirements/test.txt
     #   moto
@@ -134,6 +134,7 @@ distlib==0.3.9
     #   virtualenv
 django==4.2.16
     # via
+    #   -c requirements/common_constraints.txt
     #   -c requirements/constraints.txt
     #   -r requirements/test.txt
     #   django-crum
@@ -190,20 +191,20 @@ edx-django-utils==7.0.0
     #   openedx-events
 edx-i18n-tools==1.6.3
     # via -r requirements/test.txt
-edx-lint==5.4.0
+edx-lint==5.4.1
     # via -r requirements/quality.in
 edx-opaque-keys[django]==2.11.0
     # via
     #   -r requirements/test.txt
     #   edx-ccx-keys
     #   openedx-events
-edx-submissions==3.8.2
+edx-submissions==3.8.3
     # via -r requirements/test.txt
 edx-toggles==5.2.0
     # via -r requirements/test.txt
 factory-boy==3.3.1
     # via -r requirements/test.txt
-faker==30.6.0
+faker==30.8.1
     # via
     #   -r requirements/test.txt
     #   factory-boy
@@ -280,7 +281,7 @@ lxml-html-clean==0.3.1
     # via
     #   -r requirements/test.txt
     #   lxml
-mako==1.3.5
+mako==1.3.6
     # via
     #   -r requirements/test.txt
     #   xblock
@@ -403,7 +404,7 @@ pytest==8.3.3
     #   -r requirements/test.txt
     #   pytest-cov
     #   pytest-django
-pytest-cov==5.0.0
+pytest-cov==6.0.0
     # via -r requirements/test.txt
 pytest-django==4.9.0
     # via -r requirements/test.txt
@@ -453,7 +454,7 @@ responses==0.25.3
     # via
     #   -r requirements/test.txt
     #   moto
-rich==13.9.2
+rich==13.9.3
     # via
     #   -r requirements/test.txt
     #   cookiecutter
@@ -469,7 +470,6 @@ simplejson==3.19.3
 six==1.16.0
     # via
     #   -r requirements/test.txt
-    #   bleach
     #   edx-ccx-keys
     #   edx-django-release-util
     #   edx-lint
@@ -497,7 +497,7 @@ text-unidecode==1.3
     #   python-slugify
 tomlkit==0.13.2
     # via pylint
-tox==4.23.0
+tox==4.23.2
     # via -r requirements/test.txt
 types-python-dateutil==2.9.0.20241003
     # via
@@ -525,7 +525,7 @@ vine==5.1.0
     #   amqp
     #   celery
     #   kombu
-virtualenv==20.27.0
+virtualenv==20.27.1
     # via
     #   -r requirements/test.txt
     #   tox
@@ -547,12 +547,12 @@ webencodings==0.5.1
     #   -r requirements/test.txt
     #   bleach
     #   html5lib
-webob==1.8.8
+webob==1.8.9
     # via
     #   -r requirements/test.txt
     #   xblock
     #   xblock-sdk
-werkzeug==3.0.4
+werkzeug==3.0.6
     # via
     #   -r requirements/test.txt
     #   moto
@@ -568,4 +568,5 @@ xmltodict==0.14.2
     #   moto
 
 # The following packages are considered to be unsafe in a requirements file:
-# setuptools
+setuptools==75.3.0
+    # via fs