Repository navigation
Python: Bump soupsieve from 2.8.4 to 2.9 in /python - #14456
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [soupsieve](https://github.com/facelessuser/soupsieve) from 2.8.4 to 2.9. - [Release notes](https://github.com/facelessuser/soupsieve/releases) - [Commits](facelessuser/soupsieve@2.8.4...2.9) --- updated-dependencies: - dependency-name: soupsieve dependency-version: '2.9' dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
semantic-kernel-automation
Bot
added
the
python
github-actions
Bot
changed the title
![semantic-kernel-automation[bot]](https://avatars.githubusercontent.com/u/189665073?s=60&v=4){kind=small}
There was a problem hiding this comment.
MAF Automated Review — Iteration 1
Result: No findings
Scope: full PR (1 commit(s)): cb222f7e040f
Model: gpt-5.6-sol-fast
Overview
This lockfile update raises Soup Sieve from 2.8.4 to 2.9 while preserving the repository's Python 3.10 floor, supported platforms, package set, and hash-pinned artifacts. CI installs the complete development dependency path across supported Python versions and platforms, and the apparent package-feed change restores the repository's longstanding PyPI source rather than bypassing a documented feed boundary. No publishable Critical, High, or Medium defect remains after reconciliation.
Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.
Eduard van Valkenburg (eavanvalkenburg)
left a comment
Eduard van Valkenburg (eavanvalkenburg)
left a comment
There was a problem hiding this comment.
Dependency update reviewed; no blocking issues found.
|
Superseded by #14552, which consolidates the reviewed Python dependency updates into one PR. |
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
### Motivation and Context <!-- Thank you for your contribution to the semantic-kernel repo! Please help reviewers and future users, providing the following information: 1. Why is this change required? 2. What problem does it solve? 3. What scenario does it contribute to? 4. If it fixes an open issue, please link to the issue here. --> Consolidates the currently open Python Dependabot updates into one reviewable pull request while preserving the compatibility fixes already applied to those PRs. Supersedes microsoft#14463, microsoft#14462, microsoft#14456, microsoft#14393, microsoft#14392, microsoft#14391, microsoft#14336, and microsoft#14256. ### Description <!-- Describe your changes, the overall approach, the underlying design. These notes will help understanding how your code works. Thanks! --> - Updates the root Python dependency ranges for `google-genai` and `websockets`. - Keeps `mistralai` on its compatible 1.x API and retains the existing `mcp<2.0` bound because both 2.x updates break current connectors. - Updates `onnxruntime-genai` to 0.15.2 for Python 3.11+ while retaining 0.9.0 for Python 3.10. - Updates the root lockfile to `anyio` 4.14.2, `soupsieve` 2.9, `google-genai` 1.75.0, `websockets` 16.1.1, and the compatible ONNX GenAI pins. - Updates the OAuth server lockfile to `anyio` 4.14.2 and removes its obsolete `sniffio` dependency. - Regenerates and validates the lockfiles with the CI-pinned `uv` 0.5.31. Validation: - `uvx --from 'uv==0.5.31' uv lock --check` passed for both lockfiles. - `uvx --from 'uv==0.5.31' uv sync --all-extras --dev --frozen --quiet` passed. - `uvx --from 'uv==0.5.31' uv run --frozen pytest ./tests/unit --ignore=tests/unit/processes/dapr_runtime` passed. - The OAuth server dependency environment resolves with `uv sync --frozen --no-install-project`; its editable package build remains blocked by the sample's pre-existing missing `README.md`. ### Contribution Checklist <!-- Before submitting this PR, please make sure: --> - [ ] The code builds clean without any errors or warnings - [ ] The PR follows the [SK Contribution Guidelines](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md) and the [pre-submission formatting script](https://github.com/microsoft/semantic-kernel/blob/main/CONTRIBUTING.md#development-scripts) raises no violations - [ ] All unit tests pass, and I have added new tests where possible - [x] I didn't break anyone 😄
Bumps soupsieve from 2.8.4 to 2.9.
Release notes
Sourced from soupsieve's releases.
Commits
8763f91Format changelog messagecf198fcFix inefficient trimming of comments and white spacece44e49Merge commit from fork751c57bFix :nth-child/:nth-of-type matching for An+B index boundaries (#297)08e9edeDrop Python 3.9d6e6830Rework selector mappingd2d1581Utilize property for accessing lazy regular expression patternb8701deBuild patterns and regexes lazily in css_parser (#296)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.