Donate to Postulo/postulo

• https://buymeacoffee.com/tiagoagueda

---

See the documentation for more details on donation links.

Upgrade the locked dependencies, adapting to allauth 65.21 and cotton 2.8 #1221

Merged

tiagoagueda merged 5 commits from deps-2026-11 into main 2026-11-06 04:18:52 +00:00

Conversation 0 Commits 5 Files changed 11 +1018 -914

tiagoagueda commented 2026-11-05 21:10:53 +00:00

Owner

• Copy link
• Copy Markdown

This month's uv lock --upgrade, which the scheduled job (run 1856) could not propose because its check failed. It moves 52 packages and adapts Postulo to the two that broke.

The fixes

• django-allauth 65.20 → 65.21
  • Rate-limit calls: ratelimit.consume()/clear() require app=. The sign-in counts (#744) pass "allauth.account", so they share keys with allauth's own.
  • Authentication records: they are now per account and read as empty without a user. accounts/stages.py (single sign-on as a second factor) and accounts/reauth.py (recent sign-in, #741) now ask for the person signing in. Without this, both would have silently seen no sign-in.
  • Tests: the helpers write the records with their owner, through one write_records() in tests/recently.py. A new test checks that one account's records say nothing about another.
• django-cotton 2.7 → 2.8: context isolation is now COTTON_ISOLATE_BY_DEFAULT and no longer reruns the context processors per component. test_components.py pins that. Isolation stays off.

Ruff's pre-commit rev follows the lock (v0.17.4), as the job does. Majors that moved without breaking anything: python-dateutil 2.9 → 4.0 (not used directly), pyee 13 → 14 (Playwright's), python-slugify 8 → 9.

Checked locally

The job's own quick check: ruff, format, makemigrations --check, catalogues compile, and the whole suite on Python 3.14. The previously failing files all pass. The one other failure in the parallel run, test_slow_work's report draft, passes alone on this branch and on main, so it is a parallel-order flake.

Closes #1220

🤖 Generated with Claude Code

This month's `uv lock --upgrade`, which the scheduled job (run 1856) could not propose because its check failed. It moves 52 packages and adapts Postulo to the two that broke. ## The fixes - **django-allauth 65.20 → 65.21** - **Rate-limit calls:** `ratelimit.consume()`/`clear()` require `app=`. The sign-in counts (#744) pass `"allauth.account"`, so they share keys with allauth's own. - **Authentication records:** they are now per account and read as empty without a user. `accounts/stages.py` (single sign-on as a second factor) and `accounts/reauth.py` (recent sign-in, #741) now ask for the person signing in. Without this, both would have silently seen no sign-in. - **Tests:** the helpers write the records with their owner, through one `write_records()` in `tests/recently.py`. A new test checks that one account's records say nothing about another. - **django-cotton 2.7 → 2.8:** context isolation is now `COTTON_ISOLATE_BY_DEFAULT` and no longer reruns the context processors per component. `test_components.py` pins that. Isolation stays off. Ruff's pre-commit `rev` follows the lock (v0.17.4), as the job does. Majors that moved without breaking anything: python-dateutil 2.9 → 4.0 (not used directly), pyee 13 → 14 (Playwright's), python-slugify 8 → 9. ## Checked locally The job's own quick check: ruff, format, `makemigrations --check`, catalogues compile, and the whole suite on Python 3.14. The previously failing files all pass. The one other failure in the parallel run, `test_slow_work`'s report draft, passes alone on this branch and on `main`, so it is a parallel-order flake. Closes #1220 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 1 commit 2026-11-05 21:10:53 +00:00

Upgrade the locked dependencies, adapting to allauth 65.21 and cotton 2.8 ... 006bcc732b

The monthly upgrade (run 1856) stopped on 87 failures and 10 errors:

- allauth's internal ratelimit consume()/clear() now require app=. The
  sign-in counts in accounts/adapter.py pass "allauth.account", the app
  allauth's own sign-in counts under, so both share keys.
- allauth's authentication records now belong to one account, and read
  without a user they are empty. accounts/stages.py and accounts/reauth.py
  ask for the person signing in, as allauth's own stage does; without that
  the SSO-as-second-factor rule and the recent-sign-in check would have
  seen no sign-in at all.
- The test helpers write the records the way allauth now reads them,
  through one write_records() in tests/recently.py, and a test says that
  one account's records say nothing about another.
- cotton 2.8 renamed context isolation to COTTON_ISOLATE_BY_DEFAULT and no
  longer reruns the context processors per component; test_components.py
  pins the new cost. Isolation stays off.

Ruff's pre-commit pin follows the lock, as the job does. The job's quick
check (ruff, migrations, catalogues, the whole suite on 3.14) passes.

Closes #1220

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit 2026-11-05 23:55:11 +00:00

Give the browser suite its own base_url fixture ... ce19b40429

pytest-playwright 0.10 replaced pytest-base-url with a fallback fixture
defined as a session fixture on an instance, which pytest 9.2 deprecates.
With warnings as errors, it failed every browser test at setup.

Refs #1220

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit 2026-11-06 01:26:31 +00:00

Run CI again on an idle runner ... c69bc5ca96

The browser job hit its 45-minute step limit under load.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit 2026-11-06 02:27:38 +00:00

Keep Playwright at 1.62 and pytest-playwright at 0.9 for now ... d66bc80f5d

With Playwright 1.64.1 (Chrome 156) and pytest-playwright 0.10, the browser
job ran 2.3 times slower file for file than main's last green run, filled
the runner's swap and was cut off at its 45-minute limit twice, at 82%.
Main's own code ran the suite in 29 minutes on the same host between those
two runs. Everything else in the upgrade stays.

Refs #1220

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit 2026-11-06 03:30:44 +00:00

Bring Playwright 1.64 and pytest-playwright 0.10 back ... d9deee33af

They were not the cause: with them pinned back, the browser job reached
only 47% and the unit job timed out too. The runner host was loaded by
other services (Nextcloud restarting, swap full), not by the upgrade.

This reverts commit d66bc80f5.

Refs #1220

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda merged commit f903e822b4 into main 2026-11-06 04:18:52 +00:00

tiagoagueda deleted branch deps-2026-11 2026-11-06 04:18:53 +00:00

tiagoagueda referenced this pull request from a commit 2026-11-06 04:18:54 +00:00

Upgrade the locked dependencies, adapting to allauth 65.21 and cotton 2.8 (#1221)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

accessibility

Usable by everyone, including people with disabilities: one of the project's stated missions

  

authentication

Signing in, and proving who you are

  

breaking change

Changes behaviour or data in a way operators must act on

  

bug

Something does not do what it says it does

  

documentation

The wiki, the docs, or the words in the interface

  

enhancement

An improvement or a new capability

  

interface

The shape of the pages: what is where, and how it reads

  

internationalisation

Languages, regions, and the formats and symbols that go with them

  

observability

What an operator can see about a running instance: metrics, logs, health

  

performance

Uses fewer resources, or is more reliable, with no loss of features or accessibility

  

security

Keeping the code and the data secure: one of the project's stated missions

  

tier

1

Easy: small, self-contained, no prerequisites

  

tier

2

High-severity security: account access, personal data, the boundaries

  

tier

3

Foundations: prerequisite work that unblocks other issues

  

tier/4

Later: large features and long-horizon work

No labels

accessibility

authentication

breaking change

bug

documentation

enhancement

interface

internationalisation

observability

performance

security

tier

1

tier

2

tier

3

tier/4

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Postulo/postulo!1221

No description provided.