From b7b805e197669840d537ac2775a619e0f1cdce0d Mon Sep 17 00:00:00 2001 From: "Bobryk-Ozaki, Terrence" Date: Mon, 26 Oct 2026 09:49:48 -0700 Subject: [PATCH] fix: raise pypdf floor to 6.21.2 to close known CVEs pypdf>=6.19.0 still permits resolving vulnerable releases below the fixed 6.21.2 (no lower bound excludes them, e.g. a cached/offline mirror or a transitive upper-bound pin elsewhere could still select one). Raises the floor rather than pinning an exact version, consistent with the rest of this file's unpinned dependency style. Co-Authored-By: Claude Sonnet 5 --- py/install_config/pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/py/install_config/pyproject.toml b/py/install_config/pyproject.toml index e007fe1512..799c398ae7 100644 --- a/py/install_config/pyproject.toml +++ b/py/install_config/pyproject.toml @@ -68,7 +68,7 @@ dependencies = [ "pyenchant>=3.3.0", "pyjarowinkler>=2.0.0", # "pymupdf>=1.25.3", - "pypdf>=6.19.0", + "pypdf>=6.21.2", "pystemmer>=3.1.0", "pytesseract>=0.3.13", "pytest>=9.1.1",