chore(deps): bump pypdf from 6.13.3 to 6.14.2 in /envs/repl_env - #1013
Conversation
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.13.3 to 6.14.2. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.13.3...6.14.2) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.14.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
Dependencies
python:uv
|
The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update. |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Alignment Review Report
Clean, security-positive direct-dependency bump: pypdf 6.13.3 → 6.14.2 in envs/repl_env. Dependabot correctly bumped both the pyproject.toml floor and the lock (requires-dist + package version/hashes).
Automated Checks
- Lint: PASS (for this PR).
lint.shexits 1 only on ~20 pre-existingenvs/format candidates (incl.repl_env/runner.py,repl_env/server/repl_environment.py) — none touched here. This PR changes onlypyproject.toml+uv.lock(TOML/lock aren't linted).uv lock --checkpasses (121 packages resolved). - Debug code: CLEAN.
check-debug.shhits are all pre-existingsrc/openenv/cli/...; this PR touches zero.pyfiles.
Open RFCs Context
000/001/002/003/005 In Review; 004 (Rubrics, no status header); 010 Draft. None cover packaging / dependency management / PyPI, so no RFC governs this bump. (repl_env's PyExecutor import-allowlist is likewise not RFC-governed.)
Tier 1: Fixes Required
None. Verified:
- Hashes match PyPI exactly — wheel
sha256:3f07891…e946(349,514 B), sdistsha256:7873f50…5b25(6,491,182 B);yanked: false; 6.14.2 has 0 known vulnerabilities. - Constraints satisfied — repl_env
requires-python = ">=3.10"⊆ pypdf>=3.9; runtime dep set unchanged (onlytyping-extensions; python<3.11, already locked). No packages added/removed. - No lock side effects — born-clean: no index-flip (0 mirror refs, already
pypi.org/simple), no revision bump (alreadyrevision = 3), norequires-distre-sync, no editable-openenv refresh.
Security-positive: this clears all 4 known pypdf 6.13.3 CVEs (all DoS-class via crafted PDFs):
| CVE | Issue | Fixed in |
|---|---|---|
| CVE-2026-59938 | Large memory usage (bad image dimensions) | 6.14.0 |
| CVE-2026-59937 | Long runtime (malformed xref streams) | 6.14.0 |
| CVE-2026-59936 | Infinite loop (unterminated inline images) | 6.14.1 |
| CVE-2026-59935 | Infinite loop (ASCII85/ASCIIHex inline images) | 6.14.2 |
envs/repl_env/server/gradio_ui.py:146 runs pypdf.PdfReader(...) on user-uploaded PDFs server-side, so these DoS fixes map directly onto repl_env's untrusted-input surface. Pinning exactly 6.14.2 (not 6.14.0/6.14.1) is required to clear CVE-2026-59935.
Tier 2: Alignment Discussion
Principle Conflicts
None identified.
RFC Conflicts
None identified.
Process note (recurring, non-blocking)
ALIGNMENT FLAG: Native dependabot/uv PR modifies envs/** despite exclude-paths
- Principle/RFC at stake: none — repo automation config (
.github/dependabot.yml) - The concern: the
uvupdater is configureddirectory: "/"+exclude-paths: ["envs/**"](lines 4–9), yet this native PR editsenvs/repl_env/**. Theuvecosystem doesn't appear to honorexclude-paths(known platform limitation); the intended path for env bumps is the aggregatecodex/dependabot-envs-*roll-up. Not a defect in this PR. - Suggested reviewer: @burtenshaw (author of the
exclude-pathsconfig)
Summary
- 0 mechanical issues to fix
- 1 alignment/process point (recurring
exclude-pathsbypass; non-blocking) - 0 RFC conflicts
Verdict: safe, security-positive bump. No blockers.
Sent by Cursor Automation: Pre-review
| "gradio>=4.0.0", | ||
| # Document upload support in the Gradio tab (server-side only, not in the sandbox) | ||
| "pypdf>=6.13.3", | ||
| "pypdf>=6.14.2", |
There was a problem hiding this comment.
Direct-dep floor bump verified — this is a security fix. pypdf 6.13.3 carries 4 DoS CVEs (CVE-2026-59935/59936/59937/59938) triggered by parsing crafted PDFs; all are fixed by ≤6.14.2, and CVE-2026-59935 is fixed only in 6.14.2, so bumping to exactly this version is what clears the full set.
Directly relevant here: server/gradio_ui.py:146 calls pypdf.PdfReader(io.BytesIO(fh.read())) on user-uploaded PDFs server-side (the comment notes "server-side only, not in the sandbox"). repl_env's requires-python >=3.10 satisfies pypdf's >=3.9, and no new runtime deps are pulled in.
| [[package]] | ||
| name = "pypdf" | ||
| version = "6.13.3" | ||
| version = "6.14.2" |
There was a problem hiding this comment.
Lock entry verified against PyPI: wheel sha256:3f07891…e946 (349,514 B) and sdist sha256:7873f50…5b25 (6,491,182 B) match the published artifacts; yanked: false; 0 known vulnerabilities for 6.14.2. uv lock --check passes (121 packages).
Lock is born-clean: source stays pypi.org/simple (no index-flip, 0 mirror refs) and revision is already 3 (not bumped), so there are no reproducibility/registry-provenance side effects to flag on this PR.
|
Aggregated into maintainer PR #1015 for env-only Dependabot updates. |
1 participant
Bumps pypdf from 6.13.3 to 6.14.2.
Release notes
Sourced from pypdf's releases.
Changelog
Sourced from pypdf's changelog.
Commits
2266ee8REL: 6.14.25a33a46SEC: Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (...1ee4e58REL: 6.14.1ec3b145SEC: Detect end of stream during inline image end marker detection (#3891)c6cd82eROB: Tolerate malformed inline image settings in _read_inline_image (#3889)0ae42baROB: Tolerate malformed page label entries in get_label_from_nums (#3884)50617b5ROB: Tolerate malformed Tm operand count in extract_text (#3877)86e5a82MAINT: Improve readability (#3874)83cb25fDEV: Fix sample files commit06588ecREL: 6.14.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Note
Low Risk
Dependency-only patch bump with no code changes; security fixes reduce risk when parsing untrusted PDF uploads in Gradio.
Overview
Bumps the
pypdfdependency inenvs/repl_envfrom 6.13.3 to 6.14.2, updatingpyproject.tomlanduv.lockonly.That library is used server-side in the Gradio tab to extract text from uploaded PDFs; the new versions add security hardening (limits on inline image parsing, stream handling, and requested image size) and robustness fixes for malformed PDFs, with no application code changes in this PR.
Reviewed by Cursor Bugbot for commit cfc03ca. Bugbot is set up for automated code reviews on this repo. Configure here.