chore: Upgrade Python requirements

requirements/base.txt

@@ -16,15 +16,15 @@ billiard==4.2.4
     # via celery
 celery==5.6.3
     # via event-tracking
-certifi==2026.5.20
+certifi==2026.6.17
     # via requests
 cffi==2.0.0
     # via
     #   cryptography
     #   pynacl
 charset-normalizer==3.4.7
     # via requests
-click==8.4.1
+click==8.4.2
     # via
     #   celery
     #   click-didyoumean
@@ -40,9 +40,9 @@ click-repl==0.3.0
     # via celery
 code-annotations==3.0.0
     # via edx-toggles
-cryptography==48.0.0
+cryptography==49.0.0
     # via pyjwt
-django==5.2.14
+django==5.2.15
     # via
     #   -c requirements/common_constraints.txt
     #   -r requirements/base.in
@@ -92,6 +92,7 @@ edx-opaque-keys[django]==4.0.0
     #   edx-ccx-keys
     #   edx-drf-extensions
     #   openedx-events
+    #   xblock
 edx-toggles==6.0.0
     # via
     #   -r requirements/base.in
@@ -177,7 +178,7 @@ typing-extensions==4.15.0
     # via edx-opaque-keys
 tzdata==2026.2
     # via kombu
-tzlocal==5.3.1
+tzlocal==5.4.4
     # via celery
 urllib3==2.7.0
     # via requests
@@ -186,13 +187,11 @@ vine==5.1.0
     #   amqp
     #   celery
     #   kombu
-wcwidth==0.7.0
+wcwidth==0.8.2
     # via prompt-toolkit
-web-fragments==4.0.0
-    # via xblock
-webob==1.8.9
+webob==1.8.10
     # via xblock
-xblock==6.1.0
+xblock==6.3.0
     # via -r requirements/base.in
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/ci.txt

@@ -8,9 +8,9 @@ cachetools==7.1.4
     # via tox
 colorama==0.4.6
     # via tox
-distlib==0.4.1
+distlib==0.4.3
     # via virtualenv
-filelock==3.29.0
+filelock==3.29.4
     # via
     #   python-discovery
     #   tox
@@ -30,13 +30,13 @@ pluggy==1.6.0
     # via tox
 pyproject-api==1.10.1
     # via tox
-python-discovery==1.4.0
+python-discovery==1.4.2
     # via
     #   tox
     #   virtualenv
 tomli-w==1.2.0
     # via tox
-tox==4.55.0
+tox==4.56.1
     # via -r requirements/ci.in
-virtualenv==21.4.2
+virtualenv==21.5.1
     # via tox

requirements/dev.txt

@@ -24,7 +24,7 @@ cachetools==7.1.4
     # via tox
 celery==5.6.3
     # via event-tracking
-certifi==2026.5.20
+certifi==2026.6.17
     # via requests
 cffi==2.0.0
     # via
@@ -34,7 +34,7 @@ chardet==7.4.3
     # via diff-cover
 charset-normalizer==3.4.7
     # via requests
-click==8.4.1
+click==8.4.2
     # via
     #   celery
     #   click-didyoumean
@@ -59,9 +59,9 @@ code-annotations==3.0.0
     #   edx-toggles
 colorama==0.4.6
     # via tox
-coverage[toml]==7.14.1
+coverage[toml]==7.14.3
     # via pytest-cov
-cryptography==48.0.0
+cryptography==49.0.0
     # via
     #   pyjwt
     #   secretstorage
@@ -71,9 +71,9 @@ diff-cover==10.3.0
     # via -r requirements/dev.in
 dill==0.4.1
     # via pylint
-distlib==0.4.1
+distlib==0.4.3
     # via virtualenv
-django==5.2.14
+django==5.2.15
     # via
     #   -c requirements/common_constraints.txt
     #   -r requirements/base.in
@@ -132,6 +132,7 @@ edx-opaque-keys[django]==4.0.0
     #   edx-ccx-keys
     #   edx-drf-extensions
     #   openedx-events
+    #   xblock
 edx-toggles==6.0.0
     # via
     #   -r requirements/base.in
@@ -140,11 +141,11 @@ event-tracking==4.0.2
     # via -r requirements/base.in
 factory-boy==3.3.3
     # via -r requirements/test.in
-faker==40.20.0
+faker==40.25.0
     # via factory-boy
 fastavro==1.12.2
     # via openedx-events
-filelock==3.29.0
+filelock==3.29.4
     # via
     #   python-discovery
     #   tox
@@ -207,7 +208,7 @@ more-itertools==11.1.0
     # via
     #   jaraco-classes
     #   jaraco-functools
-nh3==0.3.5
+nh3==0.3.6
     # via readme-renderer
 openedx-events==11.2.0
     # via event-tracking
@@ -258,7 +259,7 @@ pyjwt[crypto]==2.13.0
     # via
     #   drf-jwt
     #   edx-drf-extensions
-pylint==4.0.5
+pylint==4.0.6
     # via
     #   edx-lint
     #   pylint-celery
@@ -284,7 +285,7 @@ pyproject-hooks==1.2.0
     # via
     #   build
     #   pip-tools
-pytest==9.0.3
+pytest==9.1.1
     # via
     #   pytest-cov
     #   pytest-django
@@ -297,7 +298,7 @@ python-dateutil==2.9.0.post0
     #   celery
     #   freezegun
     #   xblock
-python-discovery==1.4.0
+python-discovery==1.4.2
     # via
     #   tox
     #   virtualenv
@@ -313,7 +314,7 @@ pyyaml==6.0.3
     #   code-annotations
     #   edx-i18n-tools
     #   xblock
-readme-renderer==44.0
+readme-renderer==45.0
     # via twine
 requests==2.34.2
     # via
@@ -339,7 +340,7 @@ six==1.17.0
     #   event-tracking
     #   fs
     #   python-dateutil
-snowballstemmer==3.1.0
+snowballstemmer==3.1.1
     # via pydocstyle
 sqlparse==0.5.5
     # via django
@@ -356,15 +357,15 @@ tomlkit==0.15.0
     # via
     #   edx-lint
     #   pylint
-tox==4.55.0
+tox==4.56.1
     # via -r requirements/dev.in
 twine==6.2.0
     # via -r requirements/quality.in
 typing-extensions==4.15.0
     # via edx-opaque-keys
 tzdata==2026.2
     # via kombu
-tzlocal==5.3.1
+tzlocal==5.4.4
     # via celery
 urllib3==2.7.0
     # via
@@ -376,19 +377,17 @@ vine==5.1.0
     #   amqp
     #   celery
     #   kombu
-virtualenv==21.4.2
+virtualenv==21.5.1
     # via tox
-wcwidth==0.7.0
+wcwidth==0.8.2
     # via prompt-toolkit
-web-fragments==4.0.0
-    # via xblock
-webob==1.8.9
+webob==1.8.10
     # via xblock
 wheel==0.47.0
     # via
     #   -r requirements/quality.in
     #   pip-tools
-xblock==6.1.0
+xblock==6.3.0
     # via -r requirements/base.in
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/doc.txt

@@ -20,21 +20,21 @@ babel==2.18.0
     # via
     #   pydata-sphinx-theme
     #   sphinx
-beautifulsoup4==4.14.3
+beautifulsoup4==4.15.0
     # via pydata-sphinx-theme
 billiard==4.2.4
     # via celery
 celery==5.6.3
     # via event-tracking
-certifi==2026.5.20
+certifi==2026.6.17
     # via requests
 cffi==2.0.0
     # via
     #   cryptography
     #   pynacl
 charset-normalizer==3.4.7
     # via requests
-click==8.4.1
+click==8.4.2
     # via
     #   celery
     #   click-didyoumean
@@ -50,13 +50,13 @@ click-repl==0.3.0
     # via celery
 code-annotations==3.0.0
     # via edx-toggles
-coverage[toml]==7.14.1
+coverage[toml]==7.14.3
     # via pytest-cov
-cryptography==48.0.0
+cryptography==49.0.0
     # via pyjwt
 ddt==1.7.2
     # via -r requirements/test.in
-django==5.2.14
+django==5.2.15
     # via
     #   -c requirements/common_constraints.txt
     #   -r requirements/base.in
@@ -114,6 +114,7 @@ edx-opaque-keys[django]==4.0.0
     #   edx-ccx-keys
     #   edx-drf-extensions
     #   openedx-events
+    #   xblock
 edx-toggles==6.0.0
     # via
     #   -r requirements/base.in
@@ -122,7 +123,7 @@ event-tracking==4.0.2
     # via -r requirements/base.in
 factory-boy==3.3.3
     # via -r requirements/test.in
-faker==40.20.0
+faker==40.25.0
     # via factory-boy
 fastavro==1.12.2
     # via openedx-events
@@ -189,7 +190,7 @@ pymongo==4.17.0
     #   event-tracking
 pynacl==1.6.2
     # via edx-django-utils
-pytest==9.0.3
+pytest==9.1.1
     # via
     #   pytest-cov
     #   pytest-django
@@ -231,7 +232,7 @@ six==1.17.0
     #   event-tracking
     #   fs
     #   python-dateutil
-snowballstemmer==3.1.0
+snowballstemmer==3.1.1
     # via sphinx
 soupsieve==2.8.4
     # via beautifulsoup4
@@ -271,7 +272,7 @@ typing-extensions==4.15.0
     #   pydata-sphinx-theme
 tzdata==2026.2
     # via kombu
-tzlocal==5.3.1
+tzlocal==5.4.4
     # via celery
 urllib3==2.7.0
     # via requests
@@ -280,13 +281,11 @@ vine==5.1.0
     #   amqp
     #   celery
     #   kombu
-wcwidth==0.7.0
+wcwidth==0.8.2
     # via prompt-toolkit
-web-fragments==4.0.0
-    # via xblock
-webob==1.8.9
+webob==1.8.10
     # via xblock
-xblock==6.1.0
+xblock==6.3.0
     # via -r requirements/base.in
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/pip-tools.txt

@@ -6,7 +6,7 @@
 #
 build==1.5.0
     # via pip-tools
-click==8.4.1
+click==8.4.2
     # via pip-tools
 packaging==26.2
     # via