[eserscor]

Description

Add soupsieve>=4.0 alongside Furo in docs/python/requirements.txt. Furo depends on Beautiful Soup, which depends on Soup Sieve; the explicit minimum prevents this documentation environment from resolving a vulnerable Soup Sieve release. No other dependency requirements change.

Validation:

• git diff --check — passed before commit.
• .\.venv\Scripts\python.exe -m pip install --dry-run --ignore-installed --only-binary=:all: "furo" "soupsieve>=4.0" --disable-pip-version-check --quiet — passed on Windows/Python 3.13 using the configured package feed.
• git diff --check origin/main...HEAD — passed after incorporating current main; the PR diff is exactly one added requirement.
• Full documentation dependency resolution, installation, and documentation build — not run. The focused resolver check does not establish full documentation build compatibility.

Motivation and Context

CVE-2026-126190 / GHSA-mmhr-3c5m-f64f affects Soup Sieve versions below 4.0. Descendant CSS selectors can take polynomial time when processing attacker-controlled, deeply nested HTML/XML. Release 4.0 enables the caching fix by default.

Tracks Azure DevOps Bug 114500, Component Governance alert 22753466 for soupsieve 2.5. The alert's precise inventory/path ownership has not yet been verified; this PR constrains the identified documentation dependency chain and does not claim repository-wide alert closure.

Soup Sieve 4.0 requires Python >=3.11.5; earlier Python versions are outside the supported scope confirmed for this change. No alert dismissals, exclusions, or scan triggers are included.

[Copilot]

🟢 Approval recommended

No active review issues were identified for the Soup Sieve minimum-version update, though full documentation installation and build compatibility remain unverified.

No open issues 🎉

What changed in this PR

Adds an explicit Soup Sieve minimum version to the Python documentation dependencies to prevent resolution of releases affected by the reported vulnerability.

Changes:

• Adds soupsieve>=4.0 alongside Furo; all other requirements remain unchanged.
• Requires Python 3.11.5 or newer for this dependency. Focused dependency resolution passed, but full documentation installation and build compatibility remain unverified.

File	Description
docs/​python/​requirements.txt	Requires Soup Sieve 4.0 or newer in the documentation environment.

_{Review effort: Balanced}