chore: Upgrade Python requirements

[edx-requirements-bot]

Python requirements update. Please review the changelogs for the upgraded packages.

[edx-requirements-bot]

List of packages in the PR without any issue.

• anyio changes from 4.9.0 to 4.10.0
• boto3 changes from 1.39.16 to 1.40.6
• botocore changes from 1.39.16 to 1.40.6
• build changes from 1.2.2.post1 to 1.3.0
• certifi changes from 2025.7.14 to 2025.8.3
• coverage changes from 7.10.1 to 7.10.2
• coverage[toml] changes from 7.10.1 to 7.10.2
• cryptography changes from 45.0.5 to 45.0.6
• django-simple-history changes from 3.1.1 to 3.8.0
• django-user-tasks changes from 3.4.2 to 3.4.3
• edx-organizations changes from 7.1.0 to 7.2.1
• fastavro changes from 1.11.1 to 1.12.0
• firebase-admin changes from 7.0.0 to 7.1.0
• freezegun changes from 1.5.3 to 1.5.4
• google-api-python-client changes from 2.177.0 to 2.178.0
• lti-consumer-xblock changes from 9.14.0 to 9.14.2
• mypy changes from 1.17.0 to 1.17.1
• pip-tools changes from 7.4.1 to 7.5.0
• redis changes from 6.2.0 to 6.4.0
• regex changes from 2025.7.31 to 2025.7.34
• responses changes from 0.25.7 to 0.25.8
• rpds-py changes from 0.26.0 to 0.27.0
• semgrep changes from 1.130.0 to 1.131.0
• virtualenv changes from 20.32.0 to 20.33.1

[edx-requirements-bot]

These Packages need manual review..

• [NEW] invoke (2.2.0) added to the requirements
• [MAJOR] paramiko changes from 3.5.1 to 4.0.0

[robrap]

@feanil: Does the install work for you? On a sandbox or somewhere? I'm not sure what changed that caused this change, but it is causing our pipeline to break with:

WARNING: lxml 5.3.2 does not provide the extra 'html_clean'
...
AssertionError: Internal issue: Candidate is not for this requirement lxml[html-clean,html-clean] vs lxml[html-clean]

Not sure if this is a 2U issue, but I'm guessing not. Not sure how to correct this. I'm trying some things, but if it doesn't work for you, it might be good to revert first.

[robrap]

• I just realized that pip-tools.txt changed. Maybe that is causing the issues?
• I created a revert PR here: Revert "chore: Upgrade Python requirements" #37173
• I don't have time to get to the bottom of this at this very moment.

[robrap]

[inform] I constrained pip-tools, rather than reverting:

• fix: constrain pip-tools<7.5.0 to fix lxml[html_clean] issue #37174

[robrap]

@feanil: I'm still not sure:

1. Why this didn't break until our pipeline, and whether it would have broken for a sandbox or in Tutor dev, etc.
2. This took me several hours of work, and wondering if I should have just reverted. However, reverting would have just been a temporary fix because any make upgrade would have broken things again.

• I know once 2U is deploying off named releases, this would no longer affect us. But when and where would it affect the community, and is there a process I could kick off sooner so this doesn't fall in 2U while still deploying off master?

[kdmccormick]

@robrap

1--
I'm also surprised this didn't break until your pipeline. I thought that some unit tests installed edx-sandbox requirements, I guess not?

2--
Sorry to hear you spent so much time figuring out whether to revert. IMO you were justified to revert as soon as you felt this way:

Not sure if this is a 2U issue, but I'm guessing not. Not sure how to correct this.

The idea is that we want 2U engineers to make a good faith judgement call that the PR is a general problem before reverting, rather than just reverting anything at all that broke on edx.org. Given your edx-platform experience level, I trust you to make the call to revert even if it's just "based on this error log and my understanding of how pip works, this is very likely not a 2U problem". I tried to capture that on this page but if you think it could be clearer, edits are welcome.

[robrap]

Thanks @kdmccormick. I wasn't actually clear what was going wrong and why it didn't break until our pipeline, and feared we might be caching something strange.

In any case, maybe getting a simple reminder that I can still free to revert under these types of situations. That still would mean that one of us would have to get to the bottom of this, but we'd have an extra couple of days.

[feanil]

@robrap sorry about that, this lxml[html-clean] vs lxml[html_clean] issue has been the bane of upgrade management. If some of your added dependencies are not sufficiently up-to date with their dependency on lxml[html-clean] I've seen this happen. When you have a sec if you could post a more full stack-trace and ideally the command you ran that produced the error that would be helpful in hopefully re-producing this before this sort of thing merges.

[robrap]

@feanil: pip-tools thinks the problem lies with us. I added more details to the remove constraint issue:

• Fix issue with removal of lxml[html_clean] (with underscore) #37168

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX staging environment in preparation for a release to production.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.

[edx-pipeline-bot]

2U Release Notice: This PR has been deployed to the edX production environment.