chore(deps): bump soupsieve from 2.8.3 to 2.8.4 in /envs/finrl_env

[dependabot]

Bumps soupsieve from 2.8.3 to 2.8.4.

Release notes

Sourced from soupsieve's releases.

2.8.4

• FIX: Fix another inefficient attribute pattern (@​mauriceng98).
• FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@​mauriceng98).

Commits

• 28108ab Limit excessive selectors
• ef18872 Fix test for Windows
• eb43976 Merge commit from fork
• 3a661b2 Fix typo in pseudo-classes.md (#294)
• 0cb533d Update hatchling version requirement in pyproject.toml (#290)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Lockfile-only patch bump with no repo code changes; risk is limited to behavior of HTML/CSS selector parsing used indirectly through Beautiful Soup.

Overview
Bumps soupsieve from 2.8.3 to 2.8.4 in envs/finrl_env (via uv.lock). It is a transitive dependency of beautifulsoup4, not a direct app dependency.

Upstream 2.8.4 adds hardening: caps how many selectors are processed in a pattern and fixes an inefficient attribute-matching path—relevant if untrusted CSS selectors are ever parsed.

^{Reviewed by Cursor Bugbot for commit f94d85f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Alignment Review Report

PR #937 — bump soupsieve 2.8.3 → 2.8.4 in /envs/finrl_env (native dependabot/uv/...). Scope: 1 file, envs/finrl_env/uv.lock (+189/−195). 0 Python files changed.

Automated Checks

• Lint (.claude/hooks/lint.sh): FAIL, but exclusively on ~20 pre-existing formatting candidates in unrelated envs (opencode_env, chat_env, coding_tools_env, jupyter_env, repl_env, terminus_env, textarena_env, agent_world_model_env). This PR changes no .py files and .lock/TOML aren't linted → it is lint-neutral. Not this PR's fault.
• Debug code (.claude/hooks/check-debug.sh): CLEAN for this PR — findings are pre-existing print/docstring lines in src/; the hook doesn't scan envs/ and this PR touches 0 src/ files.
• uv lock --check --project envs/finrl_env: PASS (resolved 184 packages; lock is consistent with pyproject.toml).

The intended change is a SECURITY FIX (positive signal)

soupsieve is transitive (pulled via beautifulsoup4; not pinned in pyproject.toml), so a lock-only bump with no pyproject edit is correct. 2.8.3 → 2.8.4 fixes two High-severity CVEs, both fixed_in: 2.8.4:

• CVE-2026-49477 (GHSA-836r-79rf-4m37): ReDoS in the CSS-selector parser — a ~300-byte unterminated-quote selector hangs the regex >3s.
• CVE-2026-49476 (GHSA-2wc2-fm75-p42x): unbounded memory allocation — a ~500KB comma-selector list allocates ~244MB.

Verified live on PyPI: 2.8.4 yanked: false, vulnerabilities: [], requires_python: >=3.9 (OK for finrl's >=3.10); lock sdist + wheel sha256/size match PyPI exactly.

Open RFCs Context

All RFCs are Draft/In Review (000/001/002/003/005 = In Review; 010 = Draft), but they cover environment architecture (abstractions, MCP, rubrics, harnesses, world-modeling). No RFC governs Python packaging / the PyPI index / lockfile provenance (RFC "registry" references are Docker/tool registries on HF Hub, not the pip index). No RFC conflicts.

Tier 1: Fixes Required

None. No lint/debug/type/import/syntax/security regressions are introduced by this PR, and uv lock --check passes.

Tier 2: Alignment Discussion

Principle Conflicts

ALIGNMENT FLAG: Lockfile silently re-attributes 185 packages from the internal HF mirror to public PyPI

• Principle at stake: "Container isolation for reproducibility and security" (.claude/docs/PRINCIPLES.md L15)
• The concern: Beyond the named bump, dependabot rewrote every package's source from https://pypi.registries.huggingface.tech/ (internal mirror) → https://pypi.org/simple (public PyPI) — a complete flip (185 → 185, 0 mirror refs left). Artifact URLs stay on files.pythonhosted.org and all package hashes are unchanged, so it is almost certainly benign, but it silently changes finrl_env's declared provenance and widens an existing cross-env split (25 other env locks still record the HF mirror; 11 are already on pypi.org). No committed config pins the mirror — it lives only inside uv.lock files. Worth a conscious team decision on which index these env locks should record rather than letting it drift per dependabot PR.
• Suggested reviewers: @Darktex (authored the reproducibility principle line, b1a92e1b1), @burtenshaw (owns dependabot/lock policy)
• Heads-up (non-blocking): the same regeneration bumped the lock revision = 2 → 3 (line 2) and dropped 6 greenlet 3.3.2 s390x wheels (version unchanged → benign; IBM Z only). rev-3 diverges finrl_env from most envs still on rev 2. PR CI runs uv 0.9.3 (supports rev 3) and docker-build.yml isn't triggered by uv.lock, so nothing breaks here — but the openenv-base image ships uv 0.5.27 (can't parse rev 3); verify before any uv sync --frozen re-lock against that base.

RFC Conflicts

None identified.

Process note (not a code issue)

.github/dependabot.yml configures the uv updater with directory: "/" + exclude-paths: ["envs/**"] (L8–9, 5f499da9), yet this native dependabot/uv/envs/finrl_env/... PR still modifies envs/finrl_env/uv.lock. exclude-paths is a valid, supported Dependabot key, so the uv ecosystem appears not to honor it here — the scope guard isn't holding. Not a blocker for this PR, but flagging so the config can be revisited. cc @burtenshaw. (The separate github-actions updater has no exclude-paths and is intentionally in scope.)

Summary

• 0 mechanical issues to fix (Tier 1)
• 1 principle-alignment point (index/provenance flip) + 1 process note (exclude-paths bypass) for human review
• 0 RFC conflicts

Net: a legitimate, hash-verified security patch resolving two High-severity soupsieve CVEs. The only discussion points are the collateral index-flip / lock-revision churn and the dependabot scope guard — no code changes recommended by this review.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Lock format revision bumped 2 → 3 here (dependabot regenerated with a newer uv). This diverges finrl_env from most sibling env locks still on revision = 2.

Non-blocking: PR CI runs uv 0.9.3 (supports rev 3) and docker-build.yml isn't triggered by uv.lock, so nothing breaks on this PR. Heads-up: openenv-base ships uv 0.5.27, which can't parse rev 3 — verify the base image's uv before any uv sync --frozen re-lock against it.

[cursor]

Index-source flip (collateral, not part of the named bump): this and 184 other packages were re-attributed from https://pypi.registries.huggingface.tech/ (internal mirror) → https://pypi.org/simple. Complete flip (185 → 185, 0 mirror refs left); artifact URLs stay on files.pythonhosted.org and hashes are unchanged, so it's benign — but it silently changes declared provenance and widens the cross-env split (25 env locks still record the HF mirror).

Registry choice is a team decision → flagging, not fixing. cc @Darktex / @burtenshaw

[cursor]

Intended change ✅. soupsieve is transitive (via beautifulsoup4), so lock-only is correct.

2.8.3 → 2.8.4 is a security fix: resolves CVE-2026-49477 (ReDoS) and CVE-2026-49476 (memory-exhaustion DoS), both fixed_in: 2.8.4. Verified live on PyPI: yanked: false, vulnerabilities: [], requires_python >=3.9; sdist + wheel sha256/size match this lock exactly.

[burtenshaw]

Aggregated into #921 (chore(deps): aggregate envs dependabot updates), so closing this single Dependabot PR.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.