chore: Upgrade Python requirements

[edx-requirements-bot]

Python requirements update. Please review the changelogs for the upgraded packages.

---

Additional fix: pin nltk<3.10.1

nltk 3.10.1 (released 2026-08-01) introduced an inisec.py security module that blocks imports of packages located in subdirectories of the current working directory. This caused a false-positive failure when pytest runs from the repo root: packages installed in .tox or .venv subdirectories are wrongly treated as CWD imports, breaking all tests that transitively import nltk (via chem -> nltk -> regex).

Steps taken:

• Added nltk<3.10.1 to [tool.edx_lint].uv_constraints — the repo-specific editable source for constraints
• Ran edx_lint write_uv_constraints to auto-generate the entry in [tool.uv].constraint-dependencies (that section is not edited directly)
• Ran uv lock to regenerate uv.lock with the pinned version

The constraint will persist through future make upgrade runs because it lives in uv_constraints, which is the source edx_lint write_uv_constraints reads each time.

[edx-requirements-bot]

List of packages in the PR without any issue.

• cachetools changes from 7.1.6 to 7.1.7
• coverage changes from 7.15.2 to 7.15.3
• edx-submissions changes from 4.0.1 to 4.0.2
• filelock changes from 3.32.0 to 3.32.2
• nltk changes from 3.10.0 to 3.10.1
• python-discovery changes from 1.5.0 to 1.5.1
• ruff changes from 0.16.0 to 0.16.1
• tqdm changes from 4.69.1 to 4.70.0
• uv changes from 0.11.32 to 0.12.1
• virtualenv changes from 21.7.0 to 21.7.1
• webob changes from 1.8.10 to 1.8.11
• wrapt changes from 2.2.2 to 2.3.0

[edx-requirements-bot]

These Packages need manual review..

• [MAJOR] cryptography changes from 49.0.0 to 50.0.0

[irfanuddinahmad]

Reviewed the flagged cryptography 49.0.0 → 50.0.0 major bump before signing off on this routine upgrade PR — looks safe to merge as-is.

Why:

• Zero direct import cryptography anywhere in xblocks-core. It's transitive-only, via pyjwt[crypto] (required by drf-jwt/edx-drf-extensions for JWT signing/verification) — a narrow, well-trodden usage path.
• 50.0.0's changelog is mostly additive (post-quantum/ML-DSA additions, stabilized X.509 verification API) plus one security hardening fix (Bleichenbacher oracle in PKCS7). The only deprecation (finite-field Diffie-Hellman) is deprecated-not-removed and isn't used here anyway. No dropped Python support, no removed public APIs relevant to JWT signing.
• CI is green on this exact PR head across the full matrix (django42, django52, quality, docs, CodeQL, JS tests, codecov) — real evidence this version works in practice, not just in theory.

One thing worth flagging about the bot's own categorization, for awareness rather than as a blocker on this PR: its first comment listed nltk as upgrading "without any issue," but 3.10.1 actually shipped a change that broke pytest collection here — already caught and fixed within this same PR (nltk<3.10.1 pin added in a follow-up commit, confirmed the final diff leaves nltk untouched at 3.10.0). Good case for not rubber-stamping the bot's "no issue" list on these routine upgrade PRs, even when — as here — it turns out fine.