Repository navigation
chore(deps): bump soupsieve to 4.0.0 in src/fetch/uv.lock (3 advisories) #5546
Description
Filed automatically from 3 open Dependabot alerts by the daily alert sweep (#4874). The fix is written by hand against v2/main.
| Package | soupsieve (pip) |
| Manifest | src/fetch/uv.lock |
Vulnerable on v2/main |
2.10 |
| Bump to | 4.0.0: the lowest listed patched version that no range below covers |
| Scope | runtime |
| Highest severity | high |
Advisories
| GHSA | CVE | Severity | Vulnerable range | Fixed in | Summary |
|---|---|---|---|---|---|
| GHSA-6655-6qjp-jx7x | CVE-2026-126191 | high | <= 2.10 | 3.0.2 | Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER |
| GHSA-7g44-g9rc-x53w | CVE-2026-126193 | medium | >= 0.4, <= 2.10 | 3.0.2 | Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack |
| GHSA-mmhr-3c5m-f64f | CVE-2026-126190 | high | < 4.0.0 | 4.0.0 | Soup Sieve: Polynomial-time denial of service in the descendant combinator |
Fix
Run uv lock --upgrade-package soupsieve in src/fetch and commit the refreshed uv.lock. soupsieve is transitive here, so no declared range names it. If the package that pulls it in caps it below 4.0.0, add constraint-dependencies = ["soupsieve>=4.0.0"] under [tool.uv] in src/fetch/pyproject.toml instead.
Then verify before opening the PR: every locked copy must be outside every range in the Advisories table. node scripts/dependabot-alerts.mjs --dry-run against the branch should report this exposure cleared.
| Vulnerable copy | Version |
|---|---|
soupsieve |
2.10 |
Note
The GHSA, CVE, severity, range and summary are the advisory's own, as Dependabot reports them. What this sweep verified against v2/main is the installed versions and whether each advisory's range still matches them: GitHub computes alerts from the default branch, so an alert is filed only after that re-check.
Activity
github-actions commentedon Nov 14, 2026
2 new Dependabot advisories for
soupsieve. The bump this issue asks for is now to4.0.0, which clears them along with the rest.[-]chore(deps): bump `soupsieve` to `4.0.0` in `src/fetch/uv.lock` (1 advisory)[/-][+]chore(deps): bump `soupsieve` to `4.0.0` in `src/fetch/uv.lock` (3 advisories)[/+]