chore: sync opencraft/ulmo with upstream/release/ulmo (security patches, BB-10886)#842

Merged

tecoholic merged 8 commits into

opencraft/ulmofrom

tecoholic/BB-10886-security-patches

Jun 18, 2026

Commits on Jun 1, 2026

fix: require Django staff to call set_course_mode_price endpoint

feanil
and
claude
committed

Commits on Jun 4, 2026

fix: implement OAuth nonce replay protection in LTI provider

feanil
and
claude
committed
style: fix pylint and ruff issues in LTI nonce replay test

feanil
and
claude
committed
style: fix E7670 pylint error for SAML_METADATA_URL_ALLOW_PRIVATE_IPS

feanil
and
claude
committed

Commits on Jun 8, 2026

fix: backport openedx-forum 0.4.1 to ulmo for thread sort bug

authored and
ormsbee
committed

Commits on Jun 12, 2026

fix: prevent SSRF in the Studio video download endpoint

feanil
and
claude
committed

Commits on Jun 15, 2026