[lelia]

Upgrades the locked soupsieve (a transitive dependency of beautifulsoup4) from 2.9.2, which fails pip-audit in the Dependency Audit workflow:

• GHSA-mmhr-3c5m-f64f (high): descendant-combinator matching runs in polynomial time. Fixed in 4.0.
• GHSA-4j63-6c4x-wfg4 (medium): :has() with the general sibling combinator runs in quadratic time. Fixed in 2.10.

Only uv.lock and CHANGELOG.md change. This rides the unreleased 2.11.15.

Python split

soupsieve 4 requires Python 3.11.5 or later, but we declare requires-python = ">= 3.11". uv therefore resolves:

• 4.1 on 3.11.5 and later, which fixes both advisories
• 2.10 on 3.11.0–3.11.4, which fixes only the medium one

Exposure

Neither advisory is reachable from the CLI. Both need a CSS selector (select(), select_one(), css.select()), and the only bs4 usage, in socketsecurity/core/helper/__init__.py, calls find, find_all and the sibling finders.

Testing

• pip-audit --strict against the uv export, run the same way as CI on Python 3.12: no known vulnerabilities.
• pytest tests/unit/ tests/core/: 753 passed.
• uv lock --locked: clean.

[cursor]

PR Summary

Low Risk
Lockfile-only dependency refresh with no CLI code changes; runtime BeautifulSoup usage avoids CSS selector APIs, so exposure was already minimal.

Overview
Updates the locked transitive soupsieve dependency (via beautifulsoup4) in uv.lock from 2.9.2 to address two slow CSS-selector matching advisories (GHSA-mmhr-3c5m-f64f, GHSA-4j63-6c4x-wfg4).

Because soupsieve 4 needs Python 3.11.5+ while the project still supports >=3.11, resolution is split: 4.1 on 3.11.5 and later (both fixes), 2.10 on 3.11.0–3.11.4 (medium advisory only). Lock resolution-markers and beautifulsoup4’s dependency entries were adjusted for that split.

CHANGELOG.md documents the security bump under the unreleased 2.11.15 release. No application code changes—only the lockfile and changelog.

^{Reviewed by Cursor Bugbot for commit c619644. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit c619644. Configure here.}

[cursor]

Changelog restates the soupsieve PR

Low Severity

The 2.11.15 soupsieve note walks through the Python split, why 4.x cannot install, both GHSA IDs, and that the CLI never ran CSS selectors. Users of this release will not see a product, dashboard, or CI-log change from the lockfile bump, and the text also treats both advisories as fixed on every supported Python even though 2.10 still has GHSA-mmhr-3c5m-f64f.

 

^{Triggered by learned rule: CHANGELOG is user-facing — short bullets only}

^{Reviewed by Cursor Bugbot for commit c619644. Configure here.}