…38437)

* chore: bump openedx-core to 0.46.0
* feat: update content libraries API to use events from openedx_content
* fix: better dispatching/waiting for async library event handlers

Now, the search index (and anything else that listens for events) will stay up to date regardless of whether one uses the content_libraries high-level API or the low-level openedx_content APIs to make changes to content.

Co-Authored-By: Claude <noreply@anthropic.com>

This action runs quarterly to nudge the openedx-platform on-call into
review the platform constraints and pushing forward any that can be
moved.

chore: Create constraint audit issue job

**Publish history groups: Pre-Verawood vs Post-Verawood**

The `openedx-content` library added a `direct` field to `PublishLogRecord` starting in the Verawood release (openedx/openedx-core#539). This field changes how publish history groups are structured, so the endpoint handles both eras:

**Pre-Verawood** (`PublishLogRecord.direct is None`): When a container and its components are published together, each entity produces its own independent group, even though they share the same `publish_log_uuid`. For example, publishing a Unit with 3 components creates 4 separate groups. Each group has `scope_entity_key` set to that specific entity's key, which the frontend must pass to the entries endpoint to fetch that entity's individual changes.

**Post-Verawood** (`PublishLogRecord.direct is not None`): The `direct` field marks which entities the user explicitly clicked "Publish" on (`direct=True`) vs. which were pulled in as side effects (`direct=False`, e.g. a shared component published from a sibling container). In this era, all entities from the same `PublishLog` are merged into a single group, and `direct_published_entities` lists only the explicitly published items. The `scope_entity_key` is `null` — the frontend uses the current container key to fetch entries.

This design means the frontend does not need era awareness: it always uses `group.scope_entity_key ?? currentContainerKey` when calling the entries endpoint.

**Functions**

- Implements python api and REST_API functions to get the history log for a component:
    - `get_library_component_draft_history`: Return the draft change history for a library component since its last publication.
    - `get_library_component_publish_history`: Return the publish history of a library component as a list of groups.
    - `get_library_component_publish_history_entries`: Return the individual draft change entries for a specific publish event.
    - `get_library_component_creation_entry`: Return the creation entry (who created it and when).
- Implements python api and REST_API functions to get the history log for containers:
    - `get_library_container_draft_history`: Return the combined draft history for a container and all of its descendant components.
    - `get_library_container_publish_history`: Return the publish history of a container as a list of groups.
    - `get_library_container_publish_history_entries`: Return the individual draft change entries for the container entity in a specific publish event.
    - `get_library_container_creation_entry`: Return the creation entry for a container.

Note: This used Claude's help to write the separation of the Post and Pre-Verawood eras

Whenever possible, we should treat ComponentVersions as immutable,
and not append data to them after they're created.

This is necessary to update to v0.47.0 of openedx-core.

Fix clipboard paste crash in upstream-link setup when pasted block does not expose `xml_attributes`.

Before change, paste flow always read `temp_xblock.xml_attributes["downstream_customized"]`. Blocks like `DragAndDropBlockWithMixins` do not have `xml_attributes`, so Studio raised `AttributeError` and paste failed.

Change now:
- Read `downstream_customized` from parsed block field first (`getattr(temp_xblock, "downstream_customized", [])`).
- Read `xml_attributes` only when block exposes it.
- Set `downstream_customized` only when block has field.

…ySQL API (#38454)

* chore: remove mongodb usage

The latest version of snowflake-connector-python claims to fix the
underlying issue that caused us to pin cryptography so unpin both of
these and re-build dependencies to see if the issues are resolved.

pact-python 3.x (released after the 1.x series) ships a new Rust FFI-based
verifier that breaks backward compatibility with the old Ruby-based verifier.

The constructor and verification call both changed:

Old API (pact-python 1.x):
    verifier = Verifier(provider='lms', provider_base_url=url)
    output, _ = verifier.verify_pacts(pact_file, headers=[...], provider_states_setup_url=...)
    assert output == 0

New API (pact-python 3.x):
    Verifier(name='lms')
        .add_transport(url=url)
        .add_source(pact_file)
        .add_custom_header('Pact-Authentication', 'Allow')
        .state_handler(provider_states_setup_url, body=True)
        .verify()

Key differences:
- `provider` → `name`, `provider_base_url` → `.add_transport(url=...)`
- `verify_pacts()` is gone; replaced by fluent `.add_source()` + `.verify()`
- Headers are set individually via `.add_custom_header(name, value)` rather
  than as a list of `Key: Value` strings
- `provider_states_setup_url` becomes `.state_handler(url, body=True)`;
  `body=True` is required for URL-based handlers and matches what the
  provider state views already expect (they read from request.body)
- `verify()` raises RuntimeError on failure instead of returning a non-zero
  exit code, so the `assert output == 0` is no longer needed
- The verifier is now created fresh inside the test method rather than in
  setUpClass, because `add_source` and `add_custom_header` accumulate state
  on the underlying FFI handle — sharing a verifier across multiple test
  invocations would cause duplicate sources/headers on the second run

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: prevent .modal-fullscreen cascading flex boxes

* fix: fix fullscreen for word cloud and lti consumer

Bump edx-enterprise version to 8.0.2

Commit generated by workflow `openedx/openedx-platform/.github/workflows/upgrade-one-python-dependency.yml@refs/heads/master`

Co-authored-by: brobro10000 <82611798+brobro10000@users.noreply.github.com>

…8436)

* chore: change xblocks-contrib to 0.16.1

---------

Co-authored-by: Kyle D McCormick <kyle@axim.org>

Includes: openedx/openedx-core@v0.47.0...v1.0.1

…oints (#38458)

- Support ?ordering= query param on special exam allowances and
  attempts list endpoints via in-memory sort (edx-proctoring returns
  plain lists, not querysets; see openedx/edx-proctoring#1320)
- Add derived exam_type field (timed/proctored/practice) to special
  exam and attempt serializer responses
- Return authenticated user's username in course metadata response
- Make reason field optional and blank-safe on due date extension
  endpoint (BlockDueDateSerializerV2)

Production reads use getattr(settings, ...); tests use
@override_settings(ENABLE_CREATOR_GROUP=...). Mixed-flag patches keep the
other flag in patch.dict until its own migration.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Production reads use getattr(settings, ...); tests use
  @override_settings(CERTIFICATES_HTML_VIEW=...).
- Drop now-unused FEATURES_WITH_CERTS_ENABLED/_DISABLED helpers.
- FEATURES_WITH_CUSTOM_CERTS_ENABLED keeps CUSTOM_CERTIFICATE_TEMPLATES_ENABLED
  until that flag migrates.
- Mixed-flag patches keep the other flag in patch.dict.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- test_200_for_lti_provider's post-`with` modulestore assertions relied
  on a state leak (the old code aliased settings.FEATURES without
  .copy(), so the mutation persisted). They now run inside the
  with-block.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- Tests that previously had @patch.dict on setUp/setUpClass move the
  override to the class level. @override_settings as a setUp decorator
  conflicts with CacheIsolationMixin's own override_settings push/pop —
  the wrong layer gets popped on setUp exit, leaving settings.CACHES
  broken for subsequent test methods.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Running `pytest openedx/core/djangoapps/embargo/tests/` in isolation
fails one test because `test_redirect_if_blocked_courseware` mocks
`embargo.api.check_course_access`, and the mocked call triggers the
first-time import of `embargo.views`. views.py's `from .api import
check_course_access` captures the MagicMock as
`views.check_course_access` permanently. CI doesn't hit this because
earlier shard directories preload `embargo.views` before any mock
fires. Reproduces on master.

Calling via the module attribute resolves at call time, so future
mocks on the api function stay visible to the view.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…-dict

Default flips from raising KeyError (`settings.FEATURES['…']` direct
subscript, only safe inside an active patch) to False (`getattr` with
default) — the flag isn't defined in any env file.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…s-dict

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Flat setting was already being assigned to via the instructor plugin's
plugin_settings hook (settings.MAX_ENROLLMENT_INSTR_BUTTONS = 200) — only
the readers were still going through settings.FEATURES.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…as-dict

Flat setting was already being assigned in the instructor plugin's
plugin_settings hook — only the two readers were still going through
settings.FEATURES.get. Also fixes the annotation that read
FEATURES['ENABLE_CERTIFICATES_INSTRUCTOR_MANAGE] (missing closing quote,
wrong location).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

…dict

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>