Monthly dependency upgrade of 2026-11: allauth 65.21 and cotton 2.8 break the suite #1220

New issue

Closed

opened 2026-11-05 21:09:39 +00:00 by tiagoagueda · 0 comments

tiagoagueda commented

2026-11-05 21:09:39 +00:00

Owner

The scheduled dependency upgrade of 2026-11-03 (Actions run 1856) did not propose its pull request: its quick check failed with 87 failed, 10 errors out of about 21,250 tests. Two packages caused it.

django-allauth 65.20 → 65.21
- allauth.core.internal.ratelimit.consume() and clear() now require app=. accounts/adapter.py calls both for the sign-in counts (#744), so every password sign-in raised a TypeError.
- The session's authentication records now belong to one account. get_authentication_records(request) without a user returns an empty list. accounts/stages.py (the operator's single-sign-on rule) and accounts/reauth.py (the recent-sign-in check, #741) call it that way. Both would silently see no sign-in.
- The test helpers that write the records by hand don't write the owner key allauth now checks.
django-cotton 2.7 → 2.8: COTTON_ENABLE_CONTEXT_ISOLATION is deprecated for COTTON_ISOLATE_BY_DEFAULT, and isolation no longer runs the context processors once per component. test_components.py pins the old cost.

Everything else moved cleanly, including python-dateutil 2.9 → 4.0, which Postulo does not use directly.

🤖 Generated with Claude Code

The scheduled dependency upgrade of 2026-11-03 (Actions run 1856) did not propose its pull request: its quick check failed with **87 failed, 10 errors** out of about 21,250 tests. Two packages caused it. - **django-allauth 65.20 → 65.21** - `allauth.core.internal.ratelimit.consume()` and `clear()` now require `app=`. `accounts/adapter.py` calls both for the sign-in counts (#744), so every password sign-in raised a `TypeError`. - The session's authentication records now belong to one account. `get_authentication_records(request)` without a user returns **an empty list**. `accounts/stages.py` (the operator's single-sign-on rule) and `accounts/reauth.py` (the recent-sign-in check, #741) call it that way. Both would silently see no sign-in. - The test helpers that write the records by hand don't write the owner key allauth now checks. - **django-cotton 2.7 → 2.8**: `COTTON_ENABLE_CONTEXT_ISOLATION` is deprecated for `COTTON_ISOLATE_BY_DEFAULT`, and isolation no longer runs the context processors once per component. `test_components.py` pins the old cost. Everything else moved cleanly, including python-dateutil 2.9 → 4.0, which Postulo does not use directly. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda referenced this issue from a commit

2026-11-05 21:10:42 +00:00

Upgrade the locked dependencies, adapting to allauth 65.21 and cotton 2.8

tiagoagueda referenced this issue from a pull request that will close it,

2026-11-05 21:10:53 +00:00

Upgrade the locked dependencies, adapting to allauth 65.21 and cotton 2.8 #1221

tiagoagueda referenced this issue from a commit

2026-11-05 23:55:11 +00:00

Give the browser suite its own base_url fixture

tiagoagueda referenced this issue from a commit

2026-11-06 02:27:37 +00:00

Keep Playwright at 1.62 and pytest-playwright at 0.9 for now