chore(deps): bump soupsieve from 2.8.3 to 2.8.4 in /envs/browsergym_env

[dependabot]

Bumps soupsieve from 2.8.3 to 2.8.4.

Release notes

Sourced from soupsieve's releases.

2.8.4

• FIX: Fix another inefficient attribute pattern (@​mauriceng98).
• FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@​mauriceng98).

Commits

• 28108ab Limit excessive selectors
• ef18872 Fix test for Windows
• eb43976 Merge commit from fork
• 3a661b2 Fix typo in pseudo-classes.md (#294)
• 0cb533d Update hatchling version requirement in pyproject.toml (#290)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Note

Low Risk
Patch-level transitive dependency update in the browsergym env lockfile only; no direct code changes.

Overview
Bumps soupsieve from 2.8.3 to 2.8.4 in envs/browsergym_env (lockfile update; transitive dependency of beautifulsoup4).

2.8.4 is a patch release with selector-engine fixes: more efficient attribute matching and a cap on how many selectors are processed in a single pattern (mitigates abusive or oversized selector input). No application code changes in this repo.

^{Reviewed by Cursor Bugbot for commit b518bb1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Alignment Review Report

Two-tier review of this Dependabot change. The PR is titled as a soupsieve patch bump, but the diff scope is much larger than the title suggests, so most of this review is about that scope — not the version bump itself.

Automated Checks

• Lint (.claude/hooks/lint.sh): FAIL on the repo baseline, but not attributable to this PR. Every flagged file is unformatted Python in other envs (opencode_env, chat_env, repl_env, terminus_env, textarena_env, coding_tools_env, jupyter_env, agent_world_model_env). This PR changes only a uv.lock (not a Python file), so it introduces no lint issues.
• Debug code (.claude/hooks/check-debug.sh): FOUND on the baseline, but not attributable to this PR — all print/TODO hits are pre-existing under src/. Nothing in the changed file.

Open RFCs Context

Open RFCs: 000, 001, 002, 003, 005 (In Review) and 010 (Draft). All concern the runtime abstractions, env-spec, MCP, rubrics, harnesses, and a token world model — none touch dependency management, packaging, uv locks, or PyPI registries, so none are relevant to this change.

Tier 1: Fixes Required

None. The only modified file is a uv lockfile; no lint, debug, type, import, syntax, or credential/injection issues. The soupsieve 2.8.3 → 2.8.4 patch bump itself is well-formed (valid sdist + wheel hashes on files.pythonhosted.org) and low-risk.

Tier 2: Alignment Discussion

Principle Conflicts

None identified — PRINCIPLES.md / INVARIANTS.md govern the runtime API and architecture, which this change does not touch.

RFC Conflicts

None identified.

Process & Supply-Chain Concerns

Neither is a hard-rule violation, but both look like unintended side effects of how Dependabot regenerated the lock and deserve a human decision before merge:

ALIGNMENT FLAG: PR updates a path Dependabot is configured to exclude

• Policy at stake: .github/dependabot.yml sets exclude-paths: ["envs/**"] for the uv ecosystem (added in #644).
• The concern: this PR bumps a uv dependency inside envs/browsergym_env/ — exactly the excluded path. Either the exclusion isn't matching as intended (may need directories: or a different glob) or this PR is stale. Merging it effectively validates output the config is meant to suppress.
• Suggested reviewer: @burtenshaw (author of the Dependabot config in #644 and of the dependency-aggregation PR #930); cc @Darktex

ALIGNMENT FLAG: a "soupsieve patch bump" also rewrites the package index for the whole lockfile

• The concern: beyond soupsieve, the diff flips the source registry of ~57 packages (170 lines) from https://pypi.registries.huggingface.tech/ → https://pypi.org/simple, and bumps the lockfile revision 2 → 3. The HF registry isn't configured anywhere in-repo (no [[tool.uv.index]]), so this is an artifact of the environment where Dependabot re-resolved the lock, not an intentional migration. The repo is currently split (~25 envs still on the internal registry, ~10 already on public PyPI); merging deepens that inconsistency, and if HF build/CI infra relies on the internal index this could affect reproducibility. Artifact URLs/hashes are unchanged, so this is not a dependency-confusion risk.
• Suggested action: decide whether to standardize the index across envs and/or pin Dependabot's registry so locks stop flip-flopping on each run.
• Suggested reviewer: @burtenshaw; cc @Darktex

Summary

• 0 mechanical (Tier 1) issues to fix
• 2 alignment / process points for human review
• 0 RFC conflicts

Note: uv was absent from the review environment; I installed it to run the lint hook. Because the only changed file is a lockfile, the hook results reflect the repo baseline, not this PR.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

revision = 2 → 3 is a uv lockfile format bump — it means Dependabot regenerated this lock with a newer uv than the one that originally produced it. That regeneration is why all ~57 package source lines below also got rewritten in a PR that's nominally just a soupsieve patch.

[cursor]

This block is the intended change (soupsieve 2.8.3 → 2.8.4) and it's fine on its own.

⚠️ But note the source here also flips from the internal pypi.registries.huggingface.tech registry to public pypi.org/simple — and the same flip hits ~57 packages / 170 lines across this file. That index churn (plus the revision bump on line 2) is the real thing to review here, not the version bump. See the review summary for the full flag.

[burtenshaw]

Aggregated into #921 (chore(deps): aggregate envs dependabot updates), so closing this single Dependabot PR.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.