pypdf 6.19.0, clearing the advisories pip-audit reports (#930) #931

Merged

claude-bot merged 1 commit from fix/930-pypdf into main

2026-09-29 12:07:37 +00:00

claude-bot commented

2026-09-29 11:13:17 +00:00

Collaborator

Closes #930.

The scheduled Dependency Audit on main (run 11405) fails on pypdf==5.1.0 (~50 advisories, newest fixed in 6.16.1). pypdf reads the page count of uploaded handout PDFs, so the parser advisories apply to untrusted input. It came in with lane 8 and is in no release, so prod is unaffected.

pypdf==6.19.0 (latest). PdfReader(...).pages and PdfReadError are unchanged.
Checked: tests/wiki/test_files_service.py + test_handouts_api.py pass (30) on 6.19.0; pip-audit -r webapp/backend/requirements.txt → no known vulnerabilities.
Changelog: changelog.d/930-pypdf.security.md.

🤖 Generated with Claude Code

Closes #930. The scheduled Dependency Audit on main (run 11405) fails on `pypdf==5.1.0` (~50 advisories, newest fixed in 6.16.1). pypdf reads the page count of **uploaded** handout PDFs, so the parser advisories apply to untrusted input. It came in with lane 8 and is in no release, so prod is unaffected. - `pypdf==6.19.0` (latest). `PdfReader(...).pages` and `PdfReadError` are unchanged. - Checked: `tests/wiki/test_files_service.py` + `test_handouts_api.py` pass (30) on 6.19.0; `pip-audit -r webapp/backend/requirements.txt` → no known vulnerabilities. - Changelog: `changelog.d/930-pypdf.security.md`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 1 commit

2026-09-29 11:13:17 +00:00

fix(deps): pypdf 6.19.0, clearing the advisories pip-audit reports (#930 )

CI / Bot/backend version sync (pull_request) Successful in 1m12s

Details

CI / Backend lint (ruff) (pull_request) Successful in 1m17s

Details

CI / Feedback site tests (pull_request) Successful in 1m27s

Details

CI / Does this change touch the recording path? (pull_request) Successful in 24s

Details

CI / Summarisation accuracy eval harness (stub provider) (pull_request) Successful in 2m20s

Details

CI / Docker image build (pull_request) Successful in 1m45s

Details

CI / Bot tests and audit (pull_request) Successful in 3m33s

Details

CI / Synthetic session harness (no GPU, no LLM) (pull_request) Successful in 13m53s

Details

CI / Backend migration, tests, and audit (pull_request) Successful in 16m41s

Details

CI / End-to-end journeys (desktop, phone, keyboard-only) (pull_request) Successful in 30m12s

Details

CI / Frontend tests, audit, and build (pull_request) Successful in 37m39s

Details

8e5321636a

pypdf reads the page count of uploaded handout PDFs, so its parser
advisories apply to untrusted input. 5.1.0 fails the scheduled
Dependency Audit (run 11405); 6.19.0 audits clean. PdfReader(...).pages
and PdfReadError are unchanged, and the files and handouts tests pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot merged commit f5523c4790 into main

2026-09-29 12:07:37 +00:00

claude-bot referenced this pull request from a commit

2026-09-29 12:07:38 +00:00

Merge PR #931: pypdf 6.19.0 (#930)

claude-bot referenced this pull request

2026-09-29 12:08:10 +00:00

pypdf 5.1.0 fails pip-audit: bump to 6.19.0 #930