chore(deps): bump the uv group across 1 directory with 3 updates

[dependabot]

Bumps the uv group with 3 updates in the /packages/clip-processor-py directory: requests, soupsieve and streamlink.

Updates requests from 2.32.4 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

New Contributors

• @​M0d3v1 made their first contribution in psf/requests#6865
• @​aminvakil made their first contribution in psf/requests#7220
• @​E8Price made their first contribution in psf/requests#6960
• @​mitre88 made their first contribution in psf/requests#7244
• @​magsen made their first contribution in psf/requests#6553
• @​Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

• 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

• CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

• Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

• Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

• Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

• Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

Commits

• bc04dfd v2.33.0
• 66d21cb Merge commit from fork
• 8b9bc8f Move badges to top of README (#7293)
• e331a28 Remove unused extraction call (#7292)
• 753fd08 docs: fix FAQ grammar in httplib2 example
• 774a0b8 docs(socks): same block as other sections
• 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
• ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
• 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
• d568f47 docs: clarify Quickstart POST example (#6960)
• Additional commits viewable in compare view

Updates soupsieve from 2.8.3 to 2.8.4

Release notes

Sourced from soupsieve's releases.

2.8.4

• FIX: Fix another inefficient attribute pattern (@​mauriceng98).
• FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@​mauriceng98).

Commits

• 28108ab Limit excessive selectors
• ef18872 Fix test for Windows
• eb43976 Merge commit from fork
• 3a661b2 Fix typo in pseudo-classes.md (#294)
• 0cb533d Update hatchling version requirement in pyproject.toml (#290)
• See full diff in compare view

Updates streamlink from 6.5.0 to 8.4.0

Release notes

Sourced from streamlink's releases.

Streamlink 8.4.0

• SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
• Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
• Fixed: --interface selection by name on macOS (#6908)
• Fixed: --interface not being applied to adapters mounted after session init (#6915)
• Updated plugins:
  • goltelevision: rewritten and fixed plugin (#6916)
  • twitcasting: improved ad segment filtering (#6910)

📦 Download and Installation

Please see the installation instructions for a list of available install methods and packages on the supported operating systems.

⚙️ Configuration and Usage

Please see the CLI documentation for how to configure and use Streamlink.

❤️ Support

If you think that Streamlink is useful and if you want to keep the project alive, then please consider supporting its maintainers by sending a small and optionally recurring tip via the available options.
Your support is very much appreciated, thank you!

🙏 Contributors

• 26: @​bastimeyer
• 1: @​jordandalley
• 1: @​streamlinkbot

🗒️ Full changelog

3l3m3nt <jordan@dalleyfamily.net> (1):
      stream: add --stream-passthrough-encrypted
bastimeyer <mail@bastimeyer.de> (26):

tools: bump ty to 0.0.30 and fix issues

tools: bump mypy to 1.20.1

tools: bump ruff to 0.15.10

tests: add --stream-passthrough-encrypted tests

cli.argparser: fix type of session-option mapping

docs: fix sidebar-brand anchor color

ci.readthedocs: bump python to 3.14

tools: set ty.environment.python-platform to "all"

ci.github: add macos-latest runners

ci.github: update temp-dependencies install script

compat: add more OS-check constants

tests: add linux_only and darwin_only markers

session.http: fix set_interface on macOS

session.http: patch urllib3's set_socket_options

plugins.twitcasting: filter preroll on segment map

</tr></table>

... (truncated)

Changelog

Sourced from streamlink's changelog.

streamlink 8.4.0 (2026-05-06)

• SECURITY: fixed arbitrary local file read via file:// URI in HLS and DASH (CVE-2026-44353 / GHSA-hgqw-6m45-hw5f)
• Added: --stream-passthrough-encrypted for passing through encrypted HLS/DASH segments to the output stream without any checks (#6896)
• Fixed: --interface selection by name on macOS (#6908)
• Fixed: --interface not being applied to adapters mounted after session init (#6915)
• Updated plugins:
  • goltelevision: rewritten and fixed plugin (#6916)
  • twitcasting: improved ad segment filtering (#6910)

Full changelog

streamlink 8.3.0 (2026-04-10)

• Added: support for choosing the --interface by name on non-Windows systems, with optional prefixes, similar to curl (#6862)
• Added: support for also checking stream segments in HLSStream.parse_variant_playlist() by setting check_streams="segments" (#6878)
• Fixed: stdout/stderr streams in ProcessOutput not being fully line-buffered (#6868)
• Updated plugins:
  • cdnbg: rewritten and fixed plugin (#6890)
  • nicolive: added websocket reconnect attempts on HLS decryption key retrieval failure (#6871)
  • soop: migrated to sooplive.com (#6876)
  • telefe: rewritten and fixed plugin (#6891)

Full changelog

streamlink 8.2.1 (2026-03-05)

• Changed: HLS stream names using the "pixels" format to include framerate data, if available (#6848)
• Deprecated: imports of re-exported attributes from streamlink.stream (#6821)
• Fixed: plugin-related typing issues and missing typing annotations (#6822)
• Updated plugins:
  • ceskatelevize: fixed sports streams (#6826)
  • nrk: updated to tv-player v9 (#6841)
  • pluto: updated to v2 API (#6851)
  • twitch: switched to Usher v2 API endpoints (#6840, #6847)
  • youtube: updated API clientVersion (#6853)

Full changelog

streamlink 8.2.0 (2026-02-09)

• Added: --http-cookies-file CLI argument and http-cookies-files session option (#6796)
• Changed: PluginError to also be raised when setting a plugin's url attribute to a value that doesn't match any of its URL matchers, not just when initializing the plugin class (#6810)
• Deprecated: imports of re-exported module attributes from streamlink.utils (#6819)
• Fixed: LogRecord missing the function name and stack info (#6788)
• Fixed: custom network interface being reset when disabling Diffie-Hellman key exchange (#6795)
• Fixed: broken logic when unsetting ipv4/ipv6 session options (#6795)

... (truncated)

Commits

• a0cd8f7 release: 8.4.0
• c9f3f0d stream.dash: check BaseURL and segment URI scheme
• 805abf6 tests.stream.hls: decryption key w/ custom adapter
• ef56b4f stream.hls: check segment/map/key/plist URI scheme
• 0542a25 utils.url: add is_insecure_scheme
• e110e03 docs: update Ubuntu package URL to Ubuntu 26.04
• 0bffcf8 plugins.goltelevision: rewrite and fix plugin
• 6e36892 session.http: also set interface on adapter mount
• 6794b9d session.http_useragents: update useragents
• ece43d0 tools: bump mypy to 1.20.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.