I ran into a well-known bug of (old lxml versions) that breaks an add-on I'm contributing to. Could we bump lxml version for Plone 4 to something more modern? The current requirement (2.3.6) is ancient. How should this kind of issues be raised & handled? Should I submit a request to the framework team somewhere?
I don't think we can upgrade for a legacy version of Plone.
You can always require a later version of lxml + cssselect in your add-on setup.py so people that install it know it's a requirement.