Skip to content

Conversation

@edx-pipeline-bot
Copy link

Merges private security fixes back to the public repo.

This PR should be automatically merged by the bot once tests pass. If this needs to be merged manually, please do not squash or rebase; the commits must remain intact, via a merge commit.

kyrylo-kh and others added 30 commits May 21, 2025 19:32
Removed Django version '5.2' from the workflow.
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 4 to 5.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v4...v5)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '5'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
This error was occurring because the way the redirect URL was constructed caused the entire base path to be removed. This commit updates the URL construction method to correctly preserve the MFE's path.
Commit generated by workflow `openedx/edx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`
…rprise-integrated-channels-904b6c1

feat: Upgrade Python dependency enterprise-integrated-channels
- Move Video Block JS files from xmodule/js/src/video/ to xmodule/assets/video/public/js/ 
- Update JavaScript files from  RequireJS to ES6 import/export
- test: Enable and fix Karma Js tests for Video XBlock (openedx#37351)

---------

Co-authored-by: salmannawaz <salman.nawaz@arbisoft.com>
fix: Profile MFE redirection issue (URL path override)
This helps us avoid additional API calls just to fetch display name of
the container block that is being previewed.
…vel organization name (openedx#37331)

By adjusting social media sharing settings(specifically linkedin) certificate parameters are autopopulated to LinkedIn API. Additional setting parameters(such as CERTIFICATE_LINKEDIN_DEFAULTS_TO_COURSE_ORGANIZATION_NAME) are introduced to override existing(platform level parameter for organization name) parameters for an operator to configure course level organization name. This will enable learners to share certificate in to LinkedIn with an option for course associated organization to be autopopulated.
…eOverview sync (openedx#37339)

* fix: prevent None entrance_exam_minimum_score_pct from breaking CourseOverview sync

When entrance exams are disabled in Studio, the field
`entrance_exam_minimum_score_pct` was set to `None`. This caused silent failures
when saving `CourseOverview` because the database column requires a float (NOT NULL).

This patch ensures that:
- CourseOverview sanitizes None values by falling back to
  `settings.ENTRANCE_EXAM_MIN_SCORE_PCT` (default=50).
- Studio avoids writing `None` and instead applies the configured default.

Impact:
- Prevents IntegrityErrors and silent failures when updating course settings.
- Restores proper syncing between modulestore (Mongo) and CourseOverview (MySQL).
- Fixes reported issues such as display name changes not persisting and course
  start dates not syncing.

Closes: openedx#37319

* refactor: clean up entrance_exam_minimum_score_pct handling

- Consolidate logic to avoid repeated assignments
- Centralize None fallback and int/float normalization
- Improve readability with inline comment and consistency with Open edX style

* test: update entrance exam deletion test to expect default min score

- Adjusted `test_entrance_exam_created_updated_and_deleted_successfully` to check for
  `settings.ENTRANCE_EXAM_MIN_SCORE_PCT` instead of `None` after exam deletion
- Added handling for both int and float defaults (`/100` for integer case)
This removes the last remaining code that called out to the
cs_comments_service. All forums backend logic now uses the v2 API from
the forum repo (https://github.com/openedx/forum). This does NOT remove
MongoDB support.

This also implements the endpoint to retrieve all comments for a user
using the new forum backend. This is not actually called from any known
frontend code, but it has not been formally deprecated as an endpoint,
and therefore needs to be supported.

As part of the cleanup, the ENABLE_FORUM_V2 course waffle flag has also
been removed, along with all remaining switching logic that used to
route between the Python API in the forum repo and service calls to the
cs_comments_service Ruby service.

Other endpoints affected (switching logic removed):

* get course commentable counts
* get/update course user stats
* update comment/thread/user
* delete thread (implementation moved to forum repo)
* follow
* retire user

This is part of the following overall DEPR ticket:
  https://github.com/openedx/cs_comments_service/issues/437
…ng-all-past-due-dates

feat: api for shifting all relative past due dates
…downstream_parent_key (openedx#37448)

* refactor!: use String field instead of Dict field to store top_level_downstream_parent_key

Since this is a new field no production instance should have this field
yet. Developers need to delete their old courses as this change will
raise error in all course pages.

* chore: add `top_level_parent` field in ComponentLink and ContainerLink admin

* refactor: use ":" as separator

* refactor: block key parsing and tests
feanil and others added 25 commits October 20, 2025 10:26
This page has been replaced with an equivalent page in the authoring MFE
which has been on by default since Teak.  This change removes the
ability to fallback to the old page using waffle flags.

BREAKING CHANGE: The `legacy_studio.course_outline` waffle flag will be removed
and the code will behave as if it's always set to `False`. Preventing
you from falling back to the old Course Outline page.
The tests were testing a set of menu items that were specifically
available on the old course_outline page.  Since the page is never
rendered we don't need to test to see if those header items are actually
rendered.

As we finish the rest of the studio frontend cleanup, the header itself
should be removed but just removing these tests since they relied on
conditional bits of the header for when it was showing a course outline.
The removed tests either needed to check things on the outline page
which makes them not relevant tests, or they just needed data from the
course_handler which they can get from json now.
Co-authored-by: Kyle McCormick <kyle@axim.org>
The behavior of the MariaDB backend has changed behavior for UUIDField
from a `CharField(32)` to an actual `uuid` type. This is not converted
automatically, which results in all writes to the affected columns to
error with a message about the data being too long. This is because the
actual tring being written is a UUID with the `-` included, resulting in
a 36 character value which can't be inserted into a 32 character column.
The ContentLibraryMetadata used to hold a version field that was meant
to represent the version of the library as a whole. This is a holdover
from v1 libraries, where all changes to the library resulted in a new
version of the content, and that version indicator was used by courses
to know whether or not an update was available.

This maps poorly to Learning Core backed libraries for a number of
reasons:

1. LC-backed libraries have Draft and Published branches, meaning that
   a global "version" may be ambiguous.
2. LC-backed libraries have things like tagging and collections, where
   modifications are explicitly *not* versioned at all, and do not show
   up in either the publish log or the draft change log.
3. Courses that borrow content from LC-backed libraries track
   versioning at the level of the individual thing being borrowed, e.g.
   a single Component. This is in keeping with the goal to have very
   large libraries with many small bits of content to search and use.

This commit removes the notion of a Library-global version entirely for
v2 (LC-backed) libraries. This does not affect legacy v1 libraries that
are backed by ModuleStore.
feat!: Drop the legacy studio course home page
feat!: Drop the legacy course_outline page.
The assets page and related tests and settings flags will be removed.
They have been replaced with a new implementation in the
frontend-app-authoring MFE.

BREAKING CHANGE: The legacy_studio.files_uploads flag has been removed
and will no longer allow operators to fall back to the legacy files and
uploads view.  The new MFE version is now the only available veiew.
This check was previously only running on PRs to master, which makes it annoying to stack PRs and have all the checks run.  Update it so that the check runs on all PRs and on pushes to master.
…ggers

build: Fix workflow triggers for the Dunder init check.
…files

feat!: Drop the legacy files and uploads page.
The dependencies on this package via studio should all be removed now
and so we no longer need to install this package to pickup any
components from it.

This work is part of:
* openedx#36275
* openedx#36108
Drop tooling to load studio-frontend components into mako templates and
XSS testing features related to it.
…tend_dependency

build: Don't install @edx/studio-frontend
…saction [FC-0097] (openedx#37485)

- `handle_update_xblock_upstream_link` is called asynchronously with celery. In `update_upstream_downstream_link_handler`, the xblock has the updated version, but when calling `handle_update_xblock_upstream_link` inside Celery, the xblock is outdated in a previous version, which is why the error occurs. This happens because `on_commit_changes_to` is executed before the MySQL transaction ends.
- Added `ImmediateOnCommitMixin` to be used in tests that need to call `on_commit_changes_to`. See openedx#37485 (comment)  for more info
…edx#37508)

The 'url' field on the GET /api/libraries/v2/{library_id}/backup/?task_id={task_id}
endpoint was returning realtive paths when the file was stored on the default
FileSystemStorage backend, which makes it inconsistent with other storage
backends and semantically incorrect.

This commit addresses this making sure it always returns an absolute url.
chore: sync upgrade django 5.2
- when copying a component that has image in it, and we try to paste it. Image URL appends `static_None`. Result in crash or image not found error.
  - In this commit we have fixed this scenario, copy paste is working for components containing images.
…_edx

fix: pasting a component with image isn't working
…or_edx

fix: copy paste component from one course to another
@github-actions
Copy link

Thank you for your pull request! Congratulations on completing the Open edX tutorial! A team member will be by to take a look shortly.
To those watching community pull requests: No need to worry about this one, a tCRIL team member will be taking care of it.
For this PR's author: If this is a PR that is NOT coming from the Open edX tutorial, please comment and let us know to disregard this message.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.