feat!: upgrade pyjwt to version 2.1.0 (#933)

BREAKING CHANGE: Upgraded dependency pyjwt[crypto] to 2.1.0, which introduces its own breaking changes that may affect consumers of this library. Pay careful attention to the 2.0.0 breaking changes documented in https://pyjwt.readthedocs.io/en/stable/changelog.html#v2-0-0.
openedx · Sep 16, 2021 · 4487344 · 4487344
1 parent d75a8f6
commit 4487344
Show file tree

Hide file tree

Showing 12 changed files with 90 additions and 18 deletions.
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -14,7 +14,14 @@ Change Log
 Unreleased
 ~~~~~~~~~~
 
+[4.0.0] - 2021-08-25
+~~~~~~~~~~~~~~~~~~~~~
+**BREAKING CHANGES:**
+
+* BREAKING CHANGE: Upgraded dependency pyjwt[crypto] to 2.1.0, which introduces its own breaking changes that may affect consumers of this library. Pay careful attention to the 2.0.0 breaking changes documented in https://pyjwt.readthedocs.io/en/stable/changelog.html#v2-0-0.
+
 [3.24.6] - 2021-09-03
+~~~~~~~~~~~~~~~~~~~~~
 * Upgrade edx-lint for linting
 * Update code style
 * Handler test refactor

diff --git a/Makefile b/Makefile
@@ -27,8 +27,25 @@ clean: ## remove generated byte code, coverage reports, and build artifacts
 	rm -fr build/ dist/ *.egg-info
 	rm -rf pii_report
 
+define COMMON_CONSTRAINTS_TEMP_COMMENT
+# This is a temporary solution to override the real common_constraints.txt\n# In edx-lint, until the pyjwt constraint in edx-lint has been removed.\n# See BOM-2721 for more details.\n# Below is the copied and edited version of common_constraints\n
+endef
+
+COMMON_CONSTRAINTS_TXT=requirements/common_constraints.txt
+.PHONY: $(COMMON_CONSTRAINTS_TXT)
+$(COMMON_CONSTRAINTS_TXT):
+	wget -O "$(@)" https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt || touch "$(@)"
+	echo "$(COMMON_CONSTRAINTS_TEMP_COMMENT)" | cat - $(@) > temp && mv temp $(@)
+
 upgrade: export CUSTOM_COMPILE_COMMAND=make upgrade
-upgrade: ## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
+upgrade: $(COMMON_CONSTRAINTS_TXT)	## update the requirements/*.txt files with the latest packages satisfying requirements/*.in
+	# This is a temporary solution to override the real common_constraints.txt
+	# In edx-lint, until the pyjwt constraint in edx-lint has been removed.
+	# See BOM-271 for more details.
+	sed 's/pyjwt\[crypto\]<2.0.0//g' requirements/common_constraints.txt > requirements/common_constraints.tmp
+	mv requirements/common_constraints.tmp requirements/common_constraints.txt
+	sed 's/edx-drf-extensions<7.0.0//g' requirements/common_constraints.txt > requirements/common_constraints.tmp
+	mv requirements/common_constraints.tmp requirements/common_constraints.txt
 	pip install -q pip-tools
 	pip-compile --rebuild --upgrade -o requirements/base.txt requirements/base.in
 	pip-compile --rebuild --upgrade -o requirements/ci.txt requirements/ci.in

diff --git a/edx_proctoring/__init__.py b/edx_proctoring/__init__.py
@@ -3,6 +3,6 @@
 """
 
 # Be sure to update the version number in edx_proctoring/package.json
-__version__ = '3.24.6'
+__version__ = '4.0.0'
 
 default_app_config = 'edx_proctoring.apps.EdxProctoringConfig'  # pylint: disable=invalid-name
diff --git a/edx_proctoring/backends/rest.py b/edx_proctoring/backends/rest.py
@@ -313,7 +313,7 @@ def get_instructor_url(self, course_id, user, exam_id=None, attempt_id=None, sho
                 token['config'] = True
             if attempt_id:
                 token['attempt_id'] = attempt_id
-        encoded = jwt.encode(token, self.client_secret).decode('utf-8')
+        encoded = jwt.encode(token, self.client_secret)
         url = self.instructor_url.format(client_id=self.client_id, jwt=encoded)
 
         log.debug(

diff --git a/package.json b/package.json
@@ -1,7 +1,7 @@
 {
   "name": "@edx/edx-proctoring",
   "//": "Note that the version format is slightly different than that of the Python version when using prereleases.",
-  "version": "3.24.6",
+  "version": "4.0.0",
   "main": "edx_proctoring/static/index.js",
   "scripts": {
     "test": "gulp test"

diff --git a/requirements/base.in b/requirements/base.in
@@ -7,7 +7,7 @@ django-model-utils
 djangorestframework
 django-ipware>=1.1.0
 jsonfield2
-pyjwt<2.0.0 # Used for encoding JWTs when communicating with proctoring provider backends
+pyjwt[crypto]>=2.1.0		# Used for encoding JWTs when communicating with proctoring provider backends
 pytz>=2018
 pycryptodomex>=3.4.7
 django-crum

diff --git a/requirements/base.txt b/requirements/base.txt
@@ -37,7 +37,7 @@ cryptography==3.4.8
     # via pyjwt
 django==2.2.24
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+    #   -c requirements/common_constraints.txt
     #   -r requirements/base.in
     #   django-crum
     #   django-model-utils
@@ -78,14 +78,14 @@ djangorestframework==3.12.4
     #   rest-condition
 drf-jwt==1.19.0
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+    #   -c requirements/common_constraints.txt
     #   edx-drf-extensions
 edx-django-utils==4.4.0
     # via
     #   edx-drf-extensions
     #   edx-rest-api-client
     #   edx-when
-edx-drf-extensions==6.6.0
+edx-drf-extensions==7.0.1
     # via
     #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
     #   -r requirements/base.in
@@ -133,11 +133,11 @@ pycryptodomex==3.10.1
     #   pyjwkest
 pyjwkest==1.4.2
     # via edx-drf-extensions
-pyjwt[crypto]==1.7.1
+pyjwt[crypto]==2.1.0
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
     #   -r requirements/base.in
     #   drf-jwt
+    #   edx-drf-extensions
     #   edx-rest-api-client
 pymongo==3.12.0
     # via

diff --git a/requirements/common_constraints.txt b/requirements/common_constraints.txt
@@ -0,0 +1,48 @@
+# This is a temporary solution to override the real common_constraints.txt
+# In edx-lint, until the pyjwt constraint in edx-lint has been removed.
+# See BOM-2721 for more details.
+# Below is the copied and edited version of common_constraints
+
+# A central location for most common version constraints
+# (across edx repos) for pip-installation.
+#
+# Similar to other constraint files this file doesn't install any packages.
+# It specifies version constraints that will be applied if a package is needed.
+# When pinning something here, please provide an explanation of why it is a good
+# idea to pin this package across all edx repos, Ideally, link to other information
+# that will help people in the future to remove the pin when possible.
+# Writing an issue against the offending project and linking to it here is good.
+#
+# Note: Changes to this file will automatically be used by other repos, referencing
+#  this file from Github directly. It does not require packaging in edx-lint.
+
+
+# using LTS django version
+Django<2.3
+
+# latest version is causing e2e failures in edx-platform.
+# See  comment.
+drf-jwt<1.19.1
+
+# 4.0.0 requires pyjwt[crypto] 2.1.0. See  comment.
+edx-auth-backends<4.0.0
+
+# 7.0.0 requires pyjwt[crypto] 2.1.0. See  comment.
+
+
+# PyJWT[crypto] 2.0.0 has a number of breaking changes that we are
+# actively working to fix. A number of the active constraints are all related
+# to this effort. Additionally, your IDA/service may also be affected directly
+# by these changes. You should not upgrade without knowing what you are doing.
+
+
+# 5.0.0+ of social-auth-app-django requires social-auth-core>=4.1.0
+social-auth-app-django<5.0.0
+
+# latest version requires PyJWT>=2.0.0 but drf-jwt requires PyJWT[crypto]<2.0.0,>=1.5.2.
+# See  comment.
+social-auth-core<4.0.3
+
+# elasticsearch>=7.14.0 includes breaking changes in it which caused issues in discovery upgrade process.
+# elastic search changelog: https://www.elastic.co/guide/en/enterprise-search/master/release-notes-7.14.0.html
+elasticsearch<7.14.0
diff --git a/requirements/constraints.txt b/requirements/constraints.txt
@@ -9,7 +9,7 @@
 # linking to it here is good.
 
 # Common constraints for edx repos
--c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+-c common_constraints.txt
 
 # jsonfield2 > 3.0.3 dropped support for python 3.5
 jsonfield2==3.0.3

diff --git a/requirements/dev.txt b/requirements/dev.txt
@@ -29,7 +29,7 @@ distlib==0.3.2
     # via virtualenv
 django==2.2.24
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+    #   -c requirements/common_constraints.txt
     #   -r requirements/dev.in
     #   -r requirements/quality.in
     #   edx-i18n-tools

diff --git a/requirements/quality.txt b/requirements/quality.txt
@@ -20,7 +20,7 @@ code-annotations==1.2.0
     # via edx-lint
 django==2.2.24
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+    #   -c requirements/common_constraints.txt
     #   -r requirements/quality.in
 docutils==0.17.1
     # via rstcheck

diff --git a/requirements/test.txt b/requirements/test.txt
@@ -41,7 +41,7 @@ cryptography==3.4.8
 ddt==1.4.2
     # via -r requirements/test.in
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+    #   -c requirements/common_constraints.txt
     #   -r requirements/base.in
     #   django-crum
     #   django-model-utils
@@ -82,14 +82,14 @@ django-webpack-loader==0.7.0
     #   rest-condition
 drf-jwt==1.19.0
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
+    #   -c requirements/common_constraints.txt
     #   edx-drf-extensions
 edx-django-utils==4.4.0
     # via
     #   edx-drf-extensions
     #   edx-rest-api-client
     #   edx-when
-edx-drf-extensions==6.6.0
+edx-drf-extensions==7.0.1
     # via
     #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
     #   -r requirements/base.in
@@ -171,11 +171,11 @@ pycryptodomex==3.10.1
     #   pyjwkest
 pyjwkest==1.4.2
     # via edx-drf-extensions
-pyjwt[crypto]==1.7.1
+pyjwt[crypto]==2.1.0
     # via
-    #   -c https://raw.githubusercontent.com/edx/edx-lint/master/edx_lint/files/common_constraints.txt
     #   -r requirements/base.in
     #   drf-jwt
+    #   edx-drf-extensions
     #   edx-rest-api-client
 pymongo==3.12.0
     # via