chore(deps): bump soupsieve from 2.8.3 to 2.8.4 in /lockfiles/py39#1334
Closed
dependabot[bot] wants to merge 1 commit into
Closed
chore(deps): bump soupsieve from 2.8.3 to 2.8.4 in /lockfiles/py39#1334dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [soupsieve](https://github.com/facelessuser/soupsieve) from 2.8.3 to 2.8.4. - [Release notes](https://github.com/facelessuser/soupsieve/releases) - [Commits](facelessuser/soupsieve@2.8.3...2.8.4) --- updated-dependencies: - dependency-name: soupsieve dependency-version: 2.8.4 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Contributor
|
Auto-closed: |
github-actions
Bot
deleted the
dependabot/pip/lockfiles/py39/soupsieve-2.8.4
branch
July 10, 2026 05:09
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
markuslf
added a commit
that referenced
this pull request
Jul 10, 2026
… lockfiles (#1360) * fix(deps): pin linuxfabrik-lib 6.0.0 in every lockfile lib 6.0.0 renamed `lib.huawei` to `lib.huawei_dorado`. The plugins followed that rename in f3ab4b0, but all seven lockfiles still pinned 5.1.0, which only ships `lib/huawei.py`. A package built from main would have failed every huawei-dorado-* check with ModuleNotFoundError at import time. No tagged release is affected; v6.0.0 predates the rename. Dependabot proposed the bump for py312, py313 and py313-windows only. py311 and py314 were missed, py39 and py310 sit outside its `directory:` allowlist. Bumping all seven at once avoids a state in which half the target distros ship a broken library. Also bumps soupsieve 2.8.3 -> 2.8.4 in the py39 lockfile (GHSA ReDoS and memory exhaustion in the selector parser). soupsieve 2.8.4 still declares Requires-Python >=3.9. Verified with `pip install --dry-run --require-hashes` under UBI9 (Python 3.9.25). * ci(dependabot): stop auto-closing bumps against frozen lockfiles The py39 guard closed every Dependabot PR touching that lockfile, including security updates that do still support Python 3.9. It silently discarded the soupsieve 2.8.4 fix in #1334. Frozen lockfiles are now commented on and left open for a human. py310 is added to the guard: it is excluded in dependabot.yml too, but security updates ignore that allowlist, so a bump requiring Python 3.11 could previously have auto-merged. * fix(deps): pin setuptools 83.0.0 in the py310 and py312 lockfiles Dependabot bumped setuptools in py311, py313 and py314 only, leaving py310 and py312 on 82.0.1. 83.0.0 requires Python >= 3.10, so both can take it, and it carries the MANIFEST.in unicode-normalization fix (GHSA-h35f-9h28-mq5c). py39 stays on 82.0.1. Resolution verified with `pip install --dry-run --require-hashes` under UBI9/python-312 and Ubuntu 22.04 (Python 3.10.12; no RHEL-family image ships 3.10).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps soupsieve from 2.8.3 to 2.8.4.
Release notes
Sourced from soupsieve's releases.
Commits
28108abLimit excessive selectorsef18872Fix test for Windowseb43976Merge commit from fork3a661b2Fix typo in pseudo-classes.md (#294)0cb533dUpdate hatchling version requirement in pyproject.toml (#290)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.