pypdf 5.1.0 fails pip-audit: bump to 6.19.0 #930

New issue

Closed

opened 2026-09-29 10:36:43 +00:00 by claude-bot · 1 comment

claude-bot commented

2026-09-29 10:36:43 +00:00

Collaborator

The scheduled Dependency Audit on main (run 11405, job "Backend pip-audit") fails: pypdf==5.1.0 has ~50 advisories (PYSEC-2026-18xx/30xx/36xx/39xx, CVE-2026-57204), the newest fixed in 6.16.1.

pypdf reads the page count of uploaded handout PDFs (files_service._pdf_page_count), i.e. untrusted input, so the parser advisories matter. It was added in lane 8 PR 5 (#734) and is in no release yet, so prod (v4.4.1) is unaffected.

Plan: pin pypdf==6.19.0 (latest). PdfReader(...).pages / PdfReadError are unchanged in 6.x; run the files/handouts tests against it.

The scheduled Dependency Audit on main (run 11405, job "Backend pip-audit") fails: `pypdf==5.1.0` has ~50 advisories (PYSEC-2026-18xx/30xx/36xx/39xx, CVE-2026-57204), the newest fixed in 6.16.1. pypdf reads the page count of **uploaded handout PDFs** (`files_service._pdf_page_count`), i.e. untrusted input, so the parser advisories matter. It was added in lane 8 PR 5 (#734) and is in no release yet, so prod (v4.4.1) is unaffected. Plan: pin `pypdf==6.19.0` (latest). `PdfReader(...).pages` / `PdfReadError` are unchanged in 6.x; run the files/handouts tests against it.

rbrooks referenced this issue from a commit

2026-09-29 10:37:49 +00:00

fix(deps): pypdf 6.19.0, clearing the advisories pip-audit reports (#930)

claude-bot referenced this issue from a pull request that will close it,

2026-09-29 11:13:17 +00:00

pypdf 6.19.0, clearing the advisories pip-audit reports (#930) #931

claude-bot closed this issue

2026-09-29 12:07:38 +00:00

claude-bot referenced this issue from a commit

2026-09-29 12:07:38 +00:00

Merge PR #931: pypdf 6.19.0 (#930)

claude-bot commented

2026-09-29 12:08:10 +00:00

Author

Collaborator

Done in PR #931 (merged as f5523c47): pypdf==6.19.0. The files and handouts tests pass (30), and pip-audit on the backend requirements is clean. The next scheduled Dependency Audit on main should go green.

Done in PR #931 (merged as f5523c47): `pypdf==6.19.0`. The files and handouts tests pass (30), and `pip-audit` on the backend requirements is clean. The next scheduled Dependency Audit on main should go green.