[dependabot]

Bumps soupsieve from 2.9 to 4.0.

Release notes

Sourced from soupsieve's releases.

4.0

• BREAK: The contents of an HTML template are no longer treated as part of the document. Selectors do not descend into a template, and elements inside one can't see beyond it, which also applies to pseudo-classes such as :lang(), :disabled, and :default. select and filter will still reach the contents of a template when they are called on the template itself, for example soup.template.select('p'). See the FAQ for more information.
• BREAK: The contents of an iframe are no longer treated as a separate document, as they are not one in a browser. Elements in an iframe are normal children, so :root does not match them, and :default, :indeterminate, :checked, :dir(), :lang(), and :read-write treat them like any other element. Recent versions of html.parser, lxml, and html5lib all escape the contents of an iframe like a browser does, so this mostly affects XHTML, Python versions that still don't escape such content in their specific html.parser, and elements added to an iframe by hand. :-soup-contains() now also includes the escaped text in an iframe. See the FAQ for more information.
• NEW: Update :disabled and :enabled to treat option and optgroup elements inside a disabled select as disabled, following a recent HTML specification update.
• FIX: Fix the subsequent-sibling combinator and :has(~ ...) never matching top level elements of a fragment that has no root element, unless caching was disabled.
• FIX: :indeterminate now treats a radio button group without a form as extending across the whole document instead of the top level element that contains it, and it no longer ignores radio buttons at the top level.
• FIX: Fix :default to treat a button with a missing or invalid type, and an input with type="image", as submit buttons.
• FIX: Fix :in-range and :out-of-range raising TypeError when the document contains an input without a type attribute.
• FIX: :read-write (and :read-only) now treat contenteditable="plaintext-only" elements as editing hosts and match the editable elements inside an editing host, following the nearest contenteditable state.
• FIX: :read-write (and :read-only) now ignore contenteditable on non-HTML elements, such as an SVG foreignObject, as the attribute only applies to HTML elements. Such elements inherit the state of their parent.
• FIX: :checked now only matches the last radio button with a checked attribute in a radio button group, as in a browser, where a group is the radio buttons with the same name and form, including the form attribute. :default still matches all of them, and the contents of a template are unaffected as they are not connected.
• FIX: :dir() and :defined no longer affect the rest of the selector list they are in. Previously, a selector list that used either of them could not have its combinators cross an iframe, ignored the specified namespaces, and matched nothing in XML, not even the parts that didn't use them. They still do not match in XML, but :not(:dir(ltr)) and :not(:defined) now do.
• FIX: :default and :indeterminate now honor the form attribute, which can associate a submit button or radio button with a form it is not in, or leave it without a form. It is ignored in a template, as in the HTML specification. Submit buttons outside of a form can now be its default button.
• FIX: :default, :checked, and :indeterminate now handle a form inside a form like a browser. In HTML, a browser ignores the nested form and takes its end tag for that of the parent, which matters for parsers that keep the nested form, such as html.parser. In XHTML and in a template, nested forms are real forms.
• FIX: :checked now matches the option that a browser would select. Without multiple, that is only the last option with a selected attribute in a select, and if there are none and the select shows a single option, the first option that is not disabled. :default still only considers the selected attribute.
• FIX: Fix [attribute!=value] excluding values that only start with the specified value, and in XML documents, type values that contain a newline.
• FIX: Match the values of every attribute that the HTML specification lists as ASCII case insensitive (rel, method, lang, dir, ...) without ASCII case sensitivity on HTML elements in HTML documents, not just type. Non-HTML elements are matched case sensitively.
• FIX: :dir() now matches non-HTML elements, such as SVG and MathML, by the direction they inherit from their

... (truncated)

Commits

• ff1a5ce Cache ancestor matches in the descendant combinator (#351)
• 144deae Update docs
• cce8eb5 Fix iframe tests
• fcfde02 Respect iframe boundary and ensure behavior matches browsers
• f78ac28 Various spec fixes
• d305d43 Generally fix template handling (#349)
• cedc978 Respect namespaces provided by the parser when root is not HTML element (#348)
• d0e5402 Various :dir fixes (#347)
• b7bc7d7 Inherit the direction of non-HTML elements in :dir() (#346)
• 33f9057 Allow spaces or T in datetime-local value
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-13T21:02:17.876513Z	201e0b0	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04131a4548

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Avoid downgrading yfinance on supported Python 3.11

When running Python 3.11.0–3.11.4, which is permitted by requires-python = ">=3.11", this marker makes uv sync --frozen install yfinance 0.1.96 instead of 1.5.1; uv tree --python-version 3.11.4 --frozen confirms this branch. This unrelated four-year downgrade affects the runtime market-data fallback in fetch_yfinance_historical_candles, where client exceptions are converted into an empty candle set, so failures or behavioral incompatibilities in the obsolete client become silent missing data. Retain the current yfinance with a compatible soupsieve for these patch releases, or raise the project's minimum Python version.

AGENTS.md reference: AGENTS.md:L14-L17

Useful? React with 👍 / 👎.