[dependabot]

Bumps soupsieve from 2.8.4 to 2.9.

Release notes

Sourced from soupsieve's releases.

2.9

• NEW: Drop Python 3.9 support.
• NEW: Lazy compile selector patterns to improve initial import speed.
• FIX: Correct :nth-child/:nth-of-type (and -last- variants) for An+B values whose sequence steps onto index 0 or onto the last child (e.g. :nth-child(2n-2), :nth-child(n-1), :nth-child(n+5)), which previously matched the wrong elements or nothing at all (@​gaoflow).
• FIX: More efficient CSS ID matching (@​kaimandalic).
• FIX: Fix inefficient trimming of comments and white space (@​kaimandalic).

Commits

• 8763f91 Format changelog message
• cf198fc Fix inefficient trimming of comments and white space
• ce44e49 Merge commit from fork
• 751c57b Fix :nth-child/:nth-of-type matching for An+B index boundaries (#297)
• 08e9ede Drop Python 3.9
• d6e6830 Rework selector mapping
• d2d1581 Utilize property for accessing lazy regular expression pattern
• b8701de Build patterns and regexes lazily in css_parser (#296)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only transitive dependency bump; Python version floor in openapp_env is already 3.11+.

Overview
Updates envs/openapp_env/uv.lock to pin soupsieve from 2.8.4 to 2.9.2 (sdist and wheel URLs/hashes only). No application source changes.

The newer release brings lazy selector compilation, fixes for :nth-child / :nth-of-type edge cases, and drops Python 3.9 support—which does not affect this env because pyproject.toml already requires Python >=3.11.

^{Reviewed by Cursor Bugbot for commit 0c98283. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Scope: Dependabot bump of the transitive dependency soupsieve 2.8.4 → 2.9 in envs/openapp_env/uv.lock. The diff touches one file (envs/openapp_env/uv.lock, 3 insertions / 3 deletions) and no Python source. soupsieve is pulled in via beautifulsoup4 (4.14.2) → BrowserGym; it is not a direct dependency in pyproject.toml.

Automated Checks

• Lint: FAIL — pre-existing baseline, NOT introduced by this PR. bash .claude/hooks/lint.sh fails on the branch, but the failures are repo-wide and unrelated to the diff: usort check src/ tests/ flags only tests/envs/test_grid_world.py and tests/envs/test_julia_env.py (documented as pre-existing in AGENTS.md), and ruff format --check reports 56 files across src/ tests/ envs/. None of the flagged files appear in this diff — the only changed file is a lockfile, which ruff/usort do not check. The same baseline exists on main.
• Debug code: FOUND — pre-existing baseline, NOT introduced by this PR. check-debug.sh reports print()/TODO occurrences under src/. The hook scans the whole tree rather than the diff; none of these are in this PR.

Open RFCs Context

• Draft: 010 (Echo env-token world model), 011 (ARD catalog discovery).
• In Review: 000, 001, 002, 003, 005, 008, 012.

None of these RFCs concern dependency management, soupsieve, BeautifulSoup, or BrowserGym, so none are relevant to this change.

Tier 1: Fixes Required

None attributable to this PR. (The lint/debug findings above are pre-existing repo baseline and out of scope for a lockfile-only bump.)

Tier 2: Alignment Discussion

Principle Conflicts

None identified. A transitive dependency version bump does not touch the Gymnasium API (reset/step/state), the MCP agent boundary, reward computation, or client–server separation.

RFC Conflicts

None identified.

Dependency-PR Validation (extra diligence)

• Supply chain: soupsieve 2.9 exists on PyPI, and both the sdist and wheel sha256 hashes in the lockfile match PyPI exactly — no hash/source mismatch.
• Python compatibility: soupsieve 2.9 requires Python >=3.10; openapp_env requires >=3.11,<3.14 — compatible.
• Lockfile integrity: uv lock --check in envs/openapp_env passes (164 packages resolved, no drift) — the lockfile stays internally consistent with pyproject.toml.

Summary

• 0 mechanical issues to fix (lint/debug findings are pre-existing baseline, not introduced here)
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Low-risk, mergeable transitive dependency bump — no action required from this review.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Refreshed this lock to soupsieve 2.9.2 (was 2.9) and merging it as a security update.

Why 2.9.2 rather than 2.9

• 2.9 is the patched version for the two advisories behind this PR: GHSA-gjv8-xp57-g29c / CVE-2026-86000 and GHSA-j934-xhv5-fg8f / CVE-2026-85999 (both medium, polynomial-time ReDoS in IDENTIFIER/VALUE and in the RE_WS_END trimming regex).
• 2.9.1 and 2.9.2 have been on PyPI since 2026-07-21 and 2026-08-07 and add CSS Selectors Level 4 correctness fixes (empty substring attribute matching; empty selectors inside :is()/:where()/:has()), so taking 2.9.2 now avoids a second Dependabot cycle for the same package.

Verification at exact head 0c98283

• uv lock --upgrade-package soupsieve in envs/openapp_env produced a 3-line change; the wheel (8089a26f…c823) and sdist (4a55d8cf…af74) hashes match PyPI, neither file is yanked, and requires_python >=3.10 is satisfied by this env's >=3.11,<3.14.
• uv sync --frozen --all-groups --all-extras --dry-run --no-install-project (the same command validate-env-locks runs) passes locally, and validate-env-locks is green in CI.
• Functional smoke against the pinned beautifulsoup4==4.14.2: tag/class/id/:nth-child/:is()/:has()/attribute selectors and select_one() all behave as expected on soupsieve 2.9.2.
• All 12 checks are green on this head.

soupsieve is transitive here (via beautifulsoup4 → browsergym/weblinx); no envs/openapp_env source references it directly, and envs/**/uv.lock is not part of the published openenv wheel, so this affects environment images only.

One behavior change worth knowing for anyone writing selectors against OpenApp pages: since 2.9.1, [attr^=""], [attr$=""] and [attr*=""] correctly match nothing instead of matching every element that merely has the attribute.

  

_{Sent by Cursor Automation: Release}