Bump pypdf from 6.13.2 to 6.14.2 - #61
Conversation
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.13.2 to 6.14.2. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.13.2...6.14.2) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.14.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
LGTM — routine Dependabot dependency bump.
Extended reasoning...
Overview
This PR is an automated Dependabot update to uv.lock only, bumping pypdf from 6.13.2 to 6.14.2. No application code, container registrations, or environment variable handling is touched. The changelog for the intervening releases (6.13.3 through 6.14.2) consists entirely of security hardening (infinite-loop and truncated-stream fixes for malformed inline images, a general image-size limit) and robustness fixes for malformed PDF input — all backward compatible, additive fixes with no breaking API changes.
Security risks
None identified. The version bump is itself security-motivated (fixes for infinite loops and unbounded resource use when parsing malformed/malicious PDF inline images), so this reduces risk rather than introducing any. No new transitive dependencies are introduced, and the change is confined to the lockfile.
Level of scrutiny
Minimal scrutiny is appropriate here: this is a single-file, machine-generated lockfile diff for a patch/minor version bump of an already-approved third-party dependency, with no hand-written code changes to review for architectural or business-logic correctness.
Other factors
No bugs were reported by the bug hunting system, and the PR is a single mechanical diff. No prior reviews exist in the timeline.
1 participant
Bumps pypdf from 6.13.2 to 6.14.2.
Release notes
Sourced from pypdf's releases.
Changelog
Sourced from pypdf's changelog.
Commits
2266ee8REL: 6.14.25a33a46SEC: Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (...1ee4e58REL: 6.14.1ec3b145SEC: Detect end of stream during inline image end marker detection (#3891)c6cd82eROB: Tolerate malformed inline image settings in _read_inline_image (#3889)0ae42baROB: Tolerate malformed page label entries in get_label_from_nums (#3884)50617b5ROB: Tolerate malformed Tm operand count in extract_text (#3877)86e5a82MAINT: Improve readability (#3874)83cb25fDEV: Fix sample files commit06588ecREL: 6.14.0Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.