Upgrade pydantic to 2.14.1 with a recompiled requirements-dev.txt #6373

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

Dependabot PR #6371 bumped pydantic from 2.13.4 to 2.14.1, but its dependency install failed and it was closed unmerged. That PR regenerated only requirements.txt. requirements-dev.txt still pins the old typing-extensions, so the two lock files conflict.

Complexity: Low
Target branch: unstable

Context

• requirements-dev.in starts with -c requirements.txt, so requirements-dev.txt must match requirements.txt on every package they share. Dependabot regenerates only requirements.txt.
• These four packages move together in requirements.txt, so they have to be upgraded as a set:
  • pydantic 2.13.4 → 2.14.1
  • pydantic-core 2.46.4 → 2.50.1 (pydantic pins it exactly)
  • typing-extensions 4.15.0 → 4.16.0
  • typing-inspection 0.4.2 → 0.4.4
• requirements-dev.txt pins typing-extensions==4.15.0 (via exceptiongroup, virtualenv), which conflicts with the 4.16.0 that requirements.txt needs.
• pydantic is a production dependency. The QTI models in contentcuration/contentcuration/utils/assessment/qti/ are built on it, and publishing converts exercises to QTI with them.
• The 2.14 release lists two behaviour changes that can affect those models:
  • Enum constructors now run in both validation modes. Enum-typed fields are in constants.py, mathml/fields.py and html/*.py.
  • model_config is no longer mutated. XMLElement in base.py sets extra="forbid", validate_assignment=True and frozen=True.
• The 2.14 security advisories (GHSA-gj4f-r7mf-jjxh, Fraction exponents; GHSA-955g-x97g-8mcp, multi-host URLs) don't affect Studio. Its pydantic models use no Fraction and no multi-host URL types.

The Change

• requirements.in should pin pydantic==2.14.1.
• requirements.txt and requirements-dev.txt should both be recompiled with uv pip compile (the command is in each file's header), so they agree on typing-extensions and every other shared package.

Acceptance Criteria

• uv pip sync requirements.txt requirements-dev.txt succeeds on Python 3.10.
• requirements.txt pins pydantic==2.14.1, pydantic-core==2.50.1, typing-extensions==4.16.0 and typing-inspection==0.4.4.
• requirements-dev.txt pins the same typing-extensions version as requirements.txt.
• pytest contentcuration/contentcuration/tests/utils/qti/ passes.
• The full Python CI job runs and passes.

References

• Closed PR: build(deps): Bump pydantic from 2.13.4 to 2.14.1 #6371
• Release notes: https://github.com/pydantic/pydantic/releases/tag/v2.14.0, https://github.com/pydantic/pydantic/releases/tag/v2.14.1

AI usage

rtibblesbot (Claude Code) reviewed #6371, recommended closing it, and drafted this issue from that review and the lock files.

Filed from #6371's review.