#32982 [Bug]: osv-scan fails on every external PR ā soupsieve fix (#32643) has not propagated to litellm_oss_staging
### Check for existing issues
- [x] I have searched the existing issues and checked that my issue is not a duplicate.
### What happened?
The soupsieve CVE fix is merged but has not reached the branch external contributors must target, so the osv-scan check fails on every fork PR.
Timeline: #32636 reported two high-severity advisories (GHSA-2wc2-fm75-p42x, GHSA-836r-79rf-4m37) against soupsieve 2.8.3 on Jul 9; #32643 merged the `soupsieve>=2.8.4` constraint plus relock the same day, and the issue was closed as completed.
However, `litellm_oss_staging` ā the base branch external fork PRs target ā still pins `soupsieve 2.8.3` in `uv.lock` at its current tip (`9e7ba6575`, the Jul 9 merge of #32579; re-verified Jul 12). The branch has not advanced since the fix merged, so osv-scan fails on every external PR against it (observed on #32966; reproducible on any open fork PR with that base).
External contributors cannot self-serve the fix because CI blocks `uv.lock` modifications from fork PRs (noted in #32636; #32622 is an open external attempt blocked by exactly that policy). Propagation needs a canonical-repo change: either cherry-pick the #32643 constraint bump onto `litellm_oss_sā¦