chore(deps): aggregate envs Dependabot updates

[cursor]

Summary

Daily Dependabot triage for envs/. The only individual Dependabot PR since yesterday was #1196 (soupsieve 2.8.4 → 2.9.2 in openapp_env), already merged to main. This PR folds the same unpublished security bump into the two remaining env lockfiles that still pin soupsieve 2.8.4: finrl_env and browsergym_env (CVE-2026-85999 / CVE-2026-86000).

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• New environment
• Refactoring
• Dependency / security lockfile update (envs/ only)

Alignment Checklist

Before submitting, verify:

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated
• uv lock --check passed in envs/finrl_env and envs/browsergym_env (envs lockfile-only; full core pytest not required)

RFC Status

• Not required (bug fix, docs, minor refactoring)
• RFC exists: #___
• RFC needed (will create before merge)

Test Plan

• uv lock --check in envs/finrl_env and envs/browsergym_env
• Confirm soupsieve is 2.9.2 in both lockfiles (same pin as fix: bump soupsieve from 2.8.4 to 2.9 in /envs/openapp_env #1196 / openapp_env)
• No src/ or root pyproject.toml changes
• Both envs already require Python >=3.10, so soupsieve 2.9 dropping 3.9 is fine

Claude Code Review

N/A — daily Dependabot consolidation automation.

Triage notes

Open individual Dependabot PRs: none (author:app/dependabot). No leftover dependabot/* remote branches. #1196 was merged 2026-09-18 ~06:13 UTC. Next weekly Dependabot window is 2026-09-22 (~02:54 UTC).

Core aggregate: not opened. No open non-env Dependabot PRs. main still pins huggingface/doc-builder @cf20b09 (doc-builder main has moved to 17ccdf17; wait for Dependabot's Tuesday github-actions window rather than preemptively bumping). FastMCP 4 (#1119, pin >=3.0.0,<5.0.0) stays out until HTTP/WebSocket inc_counter persistence passes.

Singles to close: none remaining. This token cannot close PRs.

  

---

Note

Low Risk
Dependency lockfile refreshes only; soupsieve change is a targeted security patch in two envs, with broader anyio bumps affecting shared async I/O transitive deps.

Overview
Lockfile-only updates across many envs/*/uv.lock files—no application source changes.

anyio is bumped to 4.14.2 (from 4.12.1 or 4.13.0) in the env lockfiles touched by this PR, aligning transitive async/HTTP stacks used by Starlette/FastAPI-style deps.

soupsieve is bumped 2.8.4 → 2.9.2 in browsergym_env and finrl_env only, matching the security pin already merged for openapp_env (CVE-2026-85999 / CVE-2026-86000).

^{Reviewed by Cursor Bugbot for commit ae34262. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Alignment Review Report

Scope: This PR is a Dependabot aggregate lockfile update. The diff touches only uv.lock files (31 files): anyio → 4.14.2 in all 31 envs, plus soupsieve → 2.9.2 in browsergym_env and finrl_env. No src/, tests/, pyproject.toml, or Dockerfile changes; no conflict markers; no unexpected non-metadata additions. Hashes/sizes/upload-times reference legitimate PyPI (files.pythonhosted.org) artifacts.

Automated Checks

• Lint: PASS for this PR's scope. ruff check src/ tests/ ✅ and ruff format --check src/ tests/ ✅ both pass. The lint.sh hook does exit non-zero, but every finding is pre-existing and unrelated to this diff (which contains no Python source):
  • usort flags tests/envs/test_julia_env.py and tests/envs/test_grid_world.py — the two files AGENTS.md documents as already flagged on a clean tree.
  • ruff format drift is in 56 envs/ source files; none overlap this PR's changed files (verified — ruff does not format .lock files).
• Debug code: CLEAN for this PR. check-debug.sh flags pre-existing print/TODO occurrences in src/, none of which are in this diff.
• Lockfile validation (bonus): uv lock --check passes for echo_env, connect4_env, coding_env, browsergym_env, and finrl_env (both soupsieve envs included) — the bumped locks remain consistent with their pyproject.toml.

Open RFCs Context

Open RFCs — In Review: 000, 001, 002, 003, 005, 008, 012; Draft: 010, 011 — cover abstractions, env-spec, MCP, rubrics, agentic harnesses, auto-validation, world modeling, catalog discovery, and Harbor providers. None relate to third-party dependency pins, so none are implicated by an anyio/soupsieve bump.

Tier 1: Fixes Required

• None. A dependency-lock bump with no source/test changes introduces no lint, debug, syntax, type, import, or security issues. The pre-existing hook findings above are out of scope for this PR and should not be folded into a Dependabot lockfile change.

Tier 2: Alignment Discussion

Principle Conflicts

• None identified. The change touches no architectural boundary — Gymnasium API signatures, MCP/agent boundary, client–server separation, rewards-in-environment, and container isolation are all unaffected. No PRINCIPLES.md decision or INVARIANTS.md invariant is at stake.

RFC Conflicts

• None identified. No open (Draft / In Review) RFC covers dependency version pinning.

Notes / Consistency

• Post-merge, 39/40 env lockfiles are on anyio 4.14.2; harbor_env is on 4.15.1 (already ahead — not a regression and outside this PR's scope).

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Mechanical, low-risk dependency update — no blocking issues found.

  

_{Sent by Cursor Automation: Pre-review}

[cursor]

Scope expanded: this now finishes the anyio 4.14.2 security rollout

I cannot edit this PR's title/body (no permission), so the current description only
covers the original soupsieve rollup. Actual contents at ae342628:

1. anyio 4.12.1/4.13.0 → 4.14.2 in the 31 envs/*/uv.lock files still on an
   affected version. Fixes GHSA-82r6-8w77-94w6
   (critical — TLSStream IDNA 2003 host name encoding enables TLS certificate
   spoofing, < 4.14.2), GHSA-5p39-cfhj-2xmp
   (medium, < 4.14.2), and GHSA-3w57-8xmc-8v26
   (high, >= 4.14.0, < 4.14.2). With this, all 40 environment lockfiles are on a
   patched anyio (39 at 4.14.2, harbor_env at 4.15.1); the root uv.lock was
   already at 4.15.1.
2. soupsieve 2.8.4 → 2.9.2 for browsergym_env and finrl_env (the original
   payload), matching what #1196 already merged for openapp_env.

The anyio change is deliberately surgical: only version, the sdist entry, and
the wheel entry are rewritten — 3 lines per lockfile, 93 lines total. Every
lockfile keeps its recorded registry source and its resolved dependency block, so
there is no provenance relabel (the problem #1205 had) and no resolution drift.
anyio's requires-dist is identical between 4.13.0 and 4.14.2, and every affected
environment already requires Python >= 3.10, which is anyio 4.14.2's floor.

Validation

• uv sync --frozen --all-groups --all-extras --dry-run --no-install-project passes
  in all 31 changed environment directories, including the ones whose locks are
  sourced from the internal HF registry.
• Artifact URLs, hashes, and sizes match PyPI metadata for anyio 4.14.2 (wheel
  9f505dda…1494, sdist cfa139f3…c7f, neither yanked) and are byte-identical to
  the stanzas already merged through #1201/#1202.
• Real install, not just a dry run: uv sync --frozen --all-extras in envs/echo_env
  succeeds and the resulting interpreter imports anyio 4.14.2 plus
  anyio.streams.tls (the advisory's module).
• git diff --check clean; nothing outside envs/*/uv.lock is touched.

Heads-up: validate-env-locks is currently a no-op

The green validate-env-locks check on this PR did not validate anything. Its file
filter pipes through rg, which is not installed on ubuntu-latest, so the step
logs rg: command not found, computes an empty directory list, prints "No
environment dependency files changed.", and exits 0. Same thing happened on #1202
(job 105779120523). The filter has used rg since #562, so this gate has been
passing vacuously for every lockfile PR.

I am not fixing it here — a workflow change does not belong in a dependency rollup,
and it needs maintainer review. The fix is one line in .github/workflows/test.yml:
replace rg '^envs/[^/]+/(pyproject\.toml|uv\.lock)$' with
grep -E '^envs/[^/]+/(pyproject\.toml|uv\.lock)$' (or install ripgrep in the job).
Until then, treat the local 31-directory run above as the actual gate.

Supersedes #1204, #1205 and #1206 — their anyio payloads already landed via #1202,
so nothing in them is lost.

View PR

  

_{Sent by Cursor Automation: Release}

[cursor]

Alignment Review Report

Scope: Dependabot aggregate lockfile update. The diff (three-dot range, == GitHub “Files changed”) is 31 uv.lock files only — no src/, tests/, pyproject.toml, or Dockerfile changes; no conflict markers; every changed line is version/sdist/wheel metadata.

• anyio → 4.14.2 in all 31 envs (transitive dep — not pinned in any pyproject.toml, so a lock-only change is correct)
• soupsieve → 2.9.2 in browsergym_env + finrl_env (transitive via beautifulsoup4)

Automated Checks

• Lint: PASS for this PR's scope. ruff check src/ tests/ ✅ and ruff format --check src/ tests/ ✅. The lint.sh hook exits non-zero only on pre-existing, unrelated items: usort flags tests/envs/test_julia_env.py + tests/envs/test_grid_world.py (documented in AGENTS.md), and ruff format drift sits in 56 envs/ source files — none overlap this PR (verified; ruff doesn't format .lock files).
• Debug code: CLEAN for this PR. check-debug.sh only flags pre-existing print/TODO in src/, none in this diff.
• Lockfile validity: uv lock --check passes on echo_env, connect4_env, coding_env, browsergym_env, finrl_env — locks stay consistent with each pyproject.toml.

Dependency Diligence

• Pure version bump — none of the four recurring side-effects: no index-source flip (envs keep their existing registry), no revision bump, no requires-dist re-sync, no editable path-dep refresh.
• Hashes verified against PyPI: sdist + wheel sha256 and sizes for anyio 4.14.2 and soupsieve 2.9.2 match PyPI exactly; neither release is yanked.
• Security-positive ✅ (notable): this bump remediates known CVEs:
  • anyio (4.11.0 / 4.12.1 / 4.13.0) → 4.14.2 fixes CVE-2026-63374 (GHSA-82r6-8w77-94w6) and CVE-2026-64847 (GHSA-5p39-cfhj-2xmp), both fixed_in 4.14.2.
  • soupsieve 2.8.4 → 2.9.2 fixes CVE-2026-85999 (GHSA-j934-xhv5-fg8f) and CVE-2026-86000 (GHSA-gjv8-xp57-g29c), both fixed_in 2.9.0.
• Consistency: post-merge, 39/40 env locks are on anyio 4.14.2; harbor_env is already ahead at 4.15.1 (out of scope, not a regression).
• Aggregate PR: this is the intended aggregation path (not a native dependabot/uv/envs/… PR), so the dependabot.yml exclude-paths: [envs/**] bypass does not apply here.

FYI — already reflected on main

Relative to current main (7e591317), this three-dot diff is a no-op: all 31 lockfiles are byte-identical to main and the full main..head diff is empty. main already contains 7e591317 chore(deps): aggregate envs Dependabot updates (#1197), so these changes have already landed — nothing further to merge.

Open RFCs Context

In Review: 000, 001, 002, 003, 005, 008, 012 · Draft: 010, 011. All concern abstractions, env-spec, MCP, rubrics, harnesses, auto-validation, world modeling, catalog discovery, and Harbor providers — none cover third-party dependency pinning, so none are implicated by an anyio/soupsieve bump.

Tier 1: Fixes Required

• None. A transitive dependency-lock bump with no source/test changes introduces no lint, debug, syntax, type, import, or security issues. (Pre-existing hook findings above are out of scope for a Dependabot lockfile PR and should not be folded in here.)

Tier 2: Alignment Discussion

Principle Conflicts

• None identified. No architectural boundary is touched — Gymnasium API signatures, the MCP/agent boundary, client–server separation, rewards-in-environment, and container isolation are all unaffected.

RFC Conflicts

• None identified. No open (Draft / In Review) RFC governs dependency version pinning.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

Security-positive, mechanically clean dependency update (fixes 4 CVEs), lockfiles validated, and already reflected on main. No blocking issues.

  

_{Sent by Cursor Automation: Pre-review}