Upgrade stripe from 5.5.0 to 16 #6374

❌ This issue is not open for contribution. Visit Contributing guidelines to learn about the contributing process and how to find suitable issues.

Overview

Dependabot PR #6370 bumped stripe from 5.5.0 to 16.0.0 and was closed unmerged: on stripe ≥15 every Stripe webhook Studio receives is dropped. The upgrade needs a code change in stripe_webhook and tests that build real Stripe objects.

Complexity: Low
Target branch: unstable

Context

• stripe 15.0.0 (stripe-python#1762) made StripeObject stop subclassing dict.
• stripe_webhook (contentcuration/contentcuration/views/subscription.py) passes event["data"]["object"] to the DRF serializers for checkout.session.completed, customer.subscription.updated and customer.subscription.deleted.
• On 16.0.0 with DRF 3.15.1, a serializer fed a stripe.Event.construct_from(...) data object fails validation; the same probe passes on 5.5.0:

  valid: False {'non_field_errors': [... 'Invalid data. Expected a dictionary, but got Subscription.']}
  

• The view then logs a warning and returns 200, so Stripe does not retry: paid checkouts never grant storage and cancellations never revoke it.
• CI passed on build(deps): Bump stripe from 5.5.0 to 16.0.0 #6370 because tests/views/test_subscription.py mocks construct_event with plain dicts.
• No other 6–16 breaking change touches Studio: stripe.error.*, stripe.api_key and stripe.api_version remain; StripeObject.request() and stripe.Reversal are unused.

The Change

• All three webhook handlers should process real Stripe events on stripe 16.

Acceptance Criteria

• requirements.txt pins stripe==16.x.
• A test per handled event type builds the event with stripe.Event.construct_from(...) and asserts the UserSubscription change; each fails on stripe 16 without the view fix.
• Those tests pass on stripe 16.

AI usage

Drafted by rtibblesbot (Claude Code) from its review of #6370; the construct_from probe output is from that review.

Filed from #6370's review.