fix(deps): constrain soupsieve>=2.8.4 to patch two high-severity CVEs

[devin-ai-integration]

Relevant issues

Fixes #32636

Linear ticket

Pre-Submission checklist

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have received a Greptile Confidence Score of at least 4/5 before requesting a maintainer review

Screenshots / Proof of Fix

soupsieve is a transitive dependency of beautifulsoup4, so it can't be bumped directly; instead I added soupsieve>=2.8.4 to [tool.uv].constraint-dependencies and re-locked with the same uv version CI pins (0.10.9), which keeps the lockfile diff minimal (just the constraint entry plus the soupsieve package block)

Reproduced with the same osv-scanner version CI uses (v2.3.8) and the repo's osv-scanner.toml

Before, at 60729f733e (soupsieve 2.8.3):

$ osv-scanner scan source --config osv-scanner.toml -L uv.lock
Scanned uv.lock file and found 415 packages

Total 1 package affected by 2 known vulnerabilities (0 Critical, 2 High, 0 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
2 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------+---------+---------------+---------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE   | VERSION | FIXED VERSION | SOURCE  |
+-------------------------------------+------+-----------+-----------+---------+---------------+---------+
| https://osv.dev/GHSA-2wc2-fm75-p42x | 7.5  | PyPI      | soupsieve | 2.8.3   | 2.8.4         | uv.lock |
| https://osv.dev/GHSA-836r-79rf-4m37 | 7.5  | PyPI      | soupsieve | 2.8.3   | 2.8.4         | uv.lock |
+-------------------------------------+------+-----------+-----------+---------+---------------+---------+

After, at b3a44bd1b2 (soupsieve 2.8.4):

$ osv-scanner scan source --config osv-scanner.toml -L uv.lock
Scanned uv.lock file and found 415 packages

No issues found

Type

🐛 Bug Fix

Changes

Added soupsieve>=2.8.4 to [tool.uv].constraint-dependencies in pyproject.toml and re-locked, upgrading the resolved soupsieve from 2.8.3 to 2.8.4 in uv.lock. This clears GHSA-2wc2-fm75-p42x and GHSA-836r-79rf-4m37 (both CVSS 7.5) that the OSV scanner flags on the transitive soupsieve pulled in via beautifulsoup4

Link to Devin session: https://app.devin.ai/sessions/ee8d8720e92143a297210a5392110d40

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR adds a soupsieve>=2.8.4 constraint in pyproject.toml and regenerates uv.lock to force the transitive dependency (pulled in via beautifulsoup4) to resolve to the patched version, addressing two known security advisories flagged by the OSV scanner.

• pyproject.toml: soupsieve>=2.8.4 added to [tool.uv].constraint-dependencies, which is the correct mechanism for pinning a transitive-only dependency in a uv-managed project.
• uv.lock: Only soupsieve changed (2.8.3 → 2.8.4); the exclude-newer timestamp updated as expected during re-locking, but no other packages were upgraded.

Confidence Score: 5/5

Safe to merge — the change is surgical, touching only the constraint entry and the auto-generated lockfile.

The constraint addition is the correct approach for a uv-managed transitive dependency, the lockfile diff is minimal (only the targeted package version and its hashes changed), and the PR author supplied before/after scanner output confirming the fix takes effect.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Adds soupsieve>=2.8.4 to [tool.uv].constraint-dependencies to pin the transitive dependency to the patched version
uv.lock	Regenerated lockfile bumping soupsieve from 2.8.3 to 2.8.4 with updated hashes; only soupsieve changed, no unexpected package upgrades introduced

_{Reviews (1): Last reviewed commit: "fix(deps): constrain soupsieve>=2.8.4 to..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 31 untouched benchmarks

---

_{Comparing litellm_soupsieve_cve_bump (b3a44bd) with litellm_internal_staging (60729f7)¹}

Footnotes

1. No successful run was found on litellm_internal_staging (b3a44bd) during the generation of this report, so 60729f7 was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩