fix(deps): propagate soupsieve CVE fix to OSS staging

[devin-ai-integration]

Relevant issues

Fixes #32982

Linear ticket

Pre-Submission checklist

Please complete all items before asking a LiteLLM maintainer to review your PR

• I have added meaningful tests
• My PR passes all CI/CD checks (e.g., lint, format, unit tests)
• My PR's scope is as isolated as possible; it only solves 1 specific problem
• I have requested a Greptile review by commenting @greptileai and received a Confidence Score of at least 4/5 before requesting a maintainer review

Delays in PR merge?

If you're seeing a delay in your PR being merged, ping the LiteLLM Team on Slack (#pr-review).

Screenshots / Proof of Fix

Before, the litellm_oss_staging base resolves the vulnerable version:

$ git show origin/litellm_oss_staging:uv.lock | awk '/^name = "soupsieve"$/{getline; print; exit}'
version = "2.8.3"

After, the branch resolves the patched version and the CI-pinned scanner reports no findings:

$ awk '/^name = "soupsieve"$/{getline; print; exit}' uv.lock
version = "2.8.4"

$ osv-scanner-v2.3.8 scan source --config osv-scanner.toml -L uv.lock
Scanned uv.lock file and found 415 packages
No issues found

uv 0.10.9 lock --check also passes. The PR's osv-scan check is green.

Three checks on the stale base remain red. llm_responses_api_testing also fails on the exact base commit and its parent. auth-and-jwt reproduces identically with both soupsieve 2.8.3 and 2.8.4 and is fixed later by d0d1c0e346. CircleCI logs for batches_testing require an authenticated CircleCI session, so that failure could not be inspected.

Type

🐛 Bug Fix

Changes

Propagates the already-merged #32643 dependency constraint to litellm_oss_staging, adding soupsieve>=2.8.4 and updating only the corresponding lockfile entries so existing fork PRs on that base stop failing OSV scan.

Link to Devin session: https://app.devin.ai/sessions/20764f608b794636b8f48c77e53f84c5

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[greptile-apps]

Greptile Summary

This PR propagates a dependency constraint from the main branch to litellm_oss_staging, bumping the minimum required version of soupsieve in both the project manifest and the lockfile.

• pyproject.toml: adds soupsieve>=2.8.4 to constraint-dependencies, matching the pattern of other existing security-hardened constraints.
• uv.lock: updates the resolved soupsieve entry from 2.8.3 to 2.8.4 with new sdist/wheel URLs and hashes; also adds the constraint line at the top of the lock manifest.

Confidence Score: 5/5

Safe to merge — the change is a single dependency version bump with no logic changes.

The change is minimal and isolated: one new constraint line in pyproject.toml and the corresponding lockfile update with verified hashes. The PR description includes OSV scanner output confirming no remaining findings and uv lock --check passing. No application code is modified.

No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Adds soupsieve>=2.8.4 to constraint-dependencies, consistent with the pattern of existing constraints (aiohttp, tornado, packaging)
uv.lock	Bumps soupsieve from 2.8.3 to 2.8.4 with updated sdist/wheel URLs and hashes; constraint entry added at the top of the lock manifest

_{Reviews (1): Last reviewed commit: "fix(deps): constrain soupsieve>=2.8.4 to..." | Re-trigger Greptile}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!