chore: Upgrade Python requirements

cms/djangoapps/contentstore/views/tests/test_videos.py

@@ -787,7 +787,7 @@ def assert_video_status(self, url, edx_video_id, status):
                 return self.assertEqual(video['status'], status)  # noqa: PT009
 
         # Test should fail if video not found
-        self.assertEqual(True, False, 'Invalid edx_video_id')  # noqa: PT009
+        self.fail('Invalid edx_video_id')
 
     @patch('cms.djangoapps.contentstore.video_storage_handlers.LOGGER')
     def test_video_status_update_request(self, mock_logger):

pyproject.toml

@@ -291,6 +291,7 @@ constraint-dependencies = [
     "setuptools<82",
     "astroid==4.0.4",
     "edx-enterprise==8.9.4",
+    "djangorestframework<3.18",
 ]
 [tool.edx_lint]
 uv_constraints = [
@@ -407,6 +408,11 @@ uv_constraints = [
     # having it pulled in automatically. This is to allow them to better control its
     # deployment and to do it in a process that works better for them.
     "edx-enterprise==8.9.4",
+    # Date: 2026-08-31
+    # DRF 3.18.0 changes many=True validation errors from a list to a dict keyed by
+    # item index, which breaks the error response shape of several write endpoints.
+    # Issue for unpinning: https://github.com/openedx/openedx-platform/issues/39048
+    "djangorestframework<3.18",
 ]
 
 [tool.setuptools]

requirements/edx-sandbox/base.txt

@@ -3,29 +3,31 @@
 # directly instead of using uv. Source of truth: requirements/edx-sandbox/pyproject.toml / uv.lock.
 # This file was autogenerated by uv via the following command:
 #    uv export --frozen --no-hashes --no-emit-project
-cffi==2.0.0 ; platform_python_implementation != 'PyPy'
+cffi==2.1.1 ; platform_python_implementation != 'PyPy'
     # via cryptography
 chem==2.0.0
     # via edx-sandbox
-click==8.4.2
+click==8.5.0
     # via nltk
+cloudpickle==3.1.2
+    # via joblib
 codejail-includes==2.0.0
     # via edx-sandbox
 colorama==0.4.6 ; sys_platform == 'win32'
-    # via
-    #   click
-    #   tqdm
+    # via tqdm
 contourpy==1.3.3
     # via matplotlib
-cryptography==49.0.0
+cryptography==50.0.1
     # via edx-sandbox
 cycler==0.12.1
     # via matplotlib
-fonttools==4.63.0
+defusedxml==0.7.1
+    # via nltk
+fonttools==4.64.0
     # via matplotlib
-joblib==1.5.3
+joblib==1.6.0
     # via nltk
-kiwisolver==1.5.0
+kiwisolver==1.5.1
     # via matplotlib
 lxml==5.3.2
     # via
@@ -38,13 +40,13 @@ markupsafe==3.0.3
     # via
     #   chem
     #   openedx-calc
-matplotlib==3.11.0
+matplotlib==3.11.1
     # via edx-sandbox
 mpmath==1.3.0
     # via sympy
 networkx==3.6.1
     # via edx-sandbox
-nltk==3.9.4
+nltk==3.10.3
     # via
     #   chem
     #   edx-sandbox
@@ -57,9 +59,9 @@ numpy==1.26.4
     #   scipy
 openedx-calc==5.0.0
     # via edx-sandbox
-packaging==26.2
+packaging==26.3
     # via matplotlib
-pillow==12.2.0
+pillow==12.3.0
     # via matplotlib
 pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation != 'PyPy'
     # via cffi
@@ -73,7 +75,7 @@ python-dateutil==2.9.0.post0
     # via matplotlib
 random2==1.0.2
     # via edx-sandbox
-regex==2026.6.28
+regex==2026.8.31
     # via nltk
 scipy==1.17.1
     # via
@@ -85,5 +87,5 @@ sympy==1.14.0
     # via
     #   edx-sandbox
     #   openedx-calc
-tqdm==4.68.3
+tqdm==4.70.0
     # via nltk

requirements/edx/assets.txt

@@ -4,9 +4,7 @@
 # Source of truth: [dependency-groups].assets in pyproject.toml / uv.lock.
 # This file was autogenerated by uv via the following command:
 #    uv export --frozen --no-hashes --only-group assets --no-emit-project
-click==8.4.2
-colorama==0.4.6 ; sys_platform == 'win32'
-    # via click
+click==8.5.0
 libsass==0.10.0
 nodeenv==1.10.0
 six==1.17.0