[dependabot]

This transitive Soup Sieve upgrade preserves EventRelay's declared Python >=3.11,<3.13 compatibility.

The original lock selected Soup Sieve 4.0, which requires Python >=3.11.5, and silently downgraded Beautiful Soup from 4.15.0 to 4.6.3 on Python 3.11.0–3.11.4. It also changed aiohttp, orjson and python-dotenv. The correction starts from current main's lock and changes only Soup Sieve's resolved versions: 2.10 on the older supported patch releases, and exactly 4.0 on Python >=3.11.5. Beautiful Soup remains 4.15.0 throughout.

Change

• Add conditional tool.uv.constraint-dependencies for the existing transitive dependency. No new direct runtime dependency or Python minimum change.
• Regenerate the universal lock from main 512a2558f73d6281b6a880548bedf140b7e30292; unrelated package upgrades are removed.
• Keep this major upgrade a draft.
• Exclude only dependabot/uv/uv-a223a3ed80 through git.deploymentEnabled in root and app Vercel configs before publishing the corrected branch.

Published head: 149cd3092afde700f29b12251afb1fff3da3c0c7. Tree: 55fc2de26f4a0d8b305415831ccea67fb55d6707, identical to the locally validated tree.

Verification — November 12, 2026

• uv lock --check --offline: 347 packages, exit 0.
• Programmatic package-version comparison to main: only Soup Sieve changes. Beautiful Soup stays 4.15.0; aiohttp, orjson and python-dotenv retain main's versions.
• Universal-marker acceptance: Python 3.11.0, 3.11.4, 3.11.5 and 3.12.14 across linux, win32 and emscripten (12 cases) each select exactly one Beautiful Soup 4.15.0 and the intended Soup Sieve tier.
• Isolated Python 3.12.14 environments installed the exact tested Soup Sieve 2.10 / 4.0, Beautiful Soup 4.15.0 and nbconvert 7.17.1 packages. Socket connections were blocked during compatibility probes.
• Soup Sieve 4.0 probe: document selectors exclude inert template children; template-scoped selectors include them; manually inserted iframe children have ordinary descendant behavior and do not match :root. Passed.
• Both Soup Sieve versions successfully exported a notebook's Markdown to nbconvert Lab HTML without kernel execution; the 4.0 probe also checked stored code-output rendering. Passed.
• Package metadata confirms Soup Sieve 4.0 requires >=3.11.5 and 2.10 requires >=3.10.
• Source search found no direct Beautiful Soup / Soup Sieve imports or selector calls in the current repository. The locked path is the development Jupyter/nbconvert dependency graph.
• git diff --check: exit 0.
• These are targeted exact-package environments, not a full frozen installation of all optional dependencies. Older Python 3.11 patch interpreters were not executed; their universal lock selection was validated explicitly.
• Previous-head hosted CI/security passed but did not prevent the old-patch dependency downgrade. New-head hosted checks must finish separately.

No merge, deployment, paid provider call or production acceptance was performed. Keep the draft held until current-head checks and maintainer review pass. Rollback: revert the correction and reassess the older-Python lock regression before merging any alternative.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
v0-uvai	Ready	Preview, v0	Nov 13, 2026 1:30am UTC

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: groupthinking/EventRelay
• Branch: main
• File: .coderabbit.yaml
• Commit: 512a255
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 71b339a7-1a07-453b-afb3-dab9ca146373

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
pip/soupsieve	2.10	Unknown	Unknown
pip/soupsieve	4.0	Unknown	Unknown

Scanned Files

• uv.lock