chore(deps): bump soupsieve from 2.8.3 to 2.8.4 in /envs/openapp_env

[dependabot]

Bumps soupsieve from 2.8.3 to 2.8.4.

Release notes

Sourced from soupsieve's releases.

2.8.4

• FIX: Fix another inefficient attribute pattern (@​mauriceng98).
• FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@​mauriceng98).

Commits

• 28108ab Limit excessive selectors
• ef18872 Fix test for Windows
• eb43976 Merge commit from fork
• 3a661b2 Fix typo in pseudo-classes.md (#294)
• 0cb533d Update hatchling version requirement in pyproject.toml (#290)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Patch-level transitive dependency bump with defensive parsing limits; no application code changes.

Overview
Updates envs/openapp_env/uv.lock so soupsieve moves from 2.8.3 to 2.8.4 (transitive dependency, e.g. via beautifulsoup4). The new release tightens selector handling—caps how many selectors are processed per pattern and fixes an inefficient attribute-matching path.

The same lock refresh also bumps the recorded fastapi lower bound in package metadata from >=0.115.0 to >=0.116.0, matching pyproject.toml; resolved fastapi in the lock remains 0.136.1.

^{Reviewed by Cursor Bugbot for commit 27a1f5e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Alignment Review Report

PR #939 — chore(deps): bump soupsieve 2.8.3 → 2.8.4 in /envs/openapp_env (dependabot, native dependabot/uv/... branch). Diff: envs/openapp_env/uv.lock only, +4/-4.

Automated Checks

• Lint: PASS (for this PR). .claude/hooks/lint.sh exits 1, but every flagged file is a pre-existing envs/** formatting nit (opencode_env ×8, chat_env, coding_tools_env, jupyter_env, repl_env, terminus_env, textarena_env, agent_world_model_env) — same set fails on a clean tree, none in openapp_env. This PR only edits uv.lock, which no linter touches.
• Debug code: CLEAN. .claude/hooks/check-debug.sh findings are all pre-existing src/ prints/TODOs; this is an env-only lockfile change (the hook only scans src/).

What actually changed (verified)

1. soupsieve 2.8.3 → 2.8.4 — transitive dep (via beautifulsoup4 4.14.2), correctly lock-only (not in pyproject.toml; dependabot marks it dependency-type: indirect). Wheel/sdist hashes + sizes match PyPI exactly (wheel e7e6…f65, 37304 B; sdist e121…28e, 121110 B). requires_python>=3.9 (env is >=3.11,<3.14) ✓, not yanked, no CVEs (not a security fix). Full package set unchanged: 162→162, 0 added/removed — soupsieve is the only version change.
2. fastapi requires-dist re-sync >=0.115.0 → >=0.116.0 (uv.lock:1831) — this is dependabot's re-lock repairing pre-existing drift, not a new floor bump. pyproject.toml already declares fastapi>=0.116.0 (set by #810) but the base lock's metadata was stale at >=0.115.0. Verified: uv lock --check fails at base, passes at HEAD. Resolved fastapi stays 0.136.1 (satisfies both floors), so no resolution impact — net positive, the lock is now consistent with the manifest.

• No index-flip / no revision bump: this lock is "born clean" — 0 registries.huggingface.tech refs at base and HEAD (already 100% pypi.org/simple), revision = 3 at both. So the usual provenance/reproducibility flag does not apply here.

Open RFCs Context

In Review: 000, 001, 002 (+ L148 proposed amendment), 003, 005. Draft: 010. 004 (rubrics) has no status header. None cover packaging, dependency management, PyPI, or lockfiles → no RFC surface for this change.

Tier 1: Fixes Required

• None.

Tier 2: Alignment Discussion

Principle Conflicts

• None. A transitive lockfile bump touches no API / reward / client-server / MCP-WebSocket / container-isolation surface.

RFC Conflicts

• None identified.

Process / config note (non-blocking)

ALIGNMENT FLAG: Native dependabot/uv PR modifies envs/** despite the exclude-paths guard

• Config at stake: .github/dependabot.yml — the uv updater is directory: "/" with exclude-paths: ["envs/**"].
• The concern: this native dependabot/uv/envs/openapp_env/... PR edits envs/openapp_env/uv.lock, which exclude-paths should have excluded. The guard isn't being honored for the uv ecosystem (platform limitation or glob mismatch); env lock updates are intended to flow through the aggregate codex/dependabot-envs-* roll-ups. Not a problem with this diff — flagging the config drift only.
• Suggested reviewer: @burtenshaw (authored the exclude-paths guard in #566)

Summary

• 0 mechanical issues to fix
• 1 process/config note for human review (dependabot exclude-paths, cc @burtenshaw)
• 0 RFC conflicts
• Bonus: this PR incidentally repairs a stale openapp_env lock (uv lock --check now passes).

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

soupsieve 2.8.4 verified against PyPI: wheel sha256:e7e6b0769c8f51ed59acab6e994b00621096cfb1c640a7509295987388fbaf65 (37304 B) and sdist sha256:e121fd02e975c695e4e9e8774a5ee35d74714b59307868dcc5319ad2d9e3328e (121110 B) match the lock exactly. requires_python>=3.9 ✓ (env >=3.11,<3.14), not yanked, no known vulnerabilities (not a security fix). Transitive via beautifulsoup4 4.14.2, so lock-only (no pyproject.toml edit) is correct.

[cursor]

Heads up — this line changed even though the PR title is only about soupsieve. It's not a new floor bump: dependabot's re-lock re-synced this requires-dist metadata to match pyproject.toml, which already declares fastapi>=0.116.0 (set in #810). The base lock was stale at >=0.115.0, so uv lock --check fails at base and passes at HEAD. Resolved fastapi stays 0.136.1 (satisfies both), so there's no resolution change — this simply makes the lock consistent with the manifest. Benign / net-positive.

[burtenshaw]

Aggregated into #921 (chore(deps): aggregate envs dependabot updates), so closing this single Dependabot PR.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.