build(deps-dev): update pypdf requirement from >=6.15.0 to >=6.16.1 - #1411
Merged
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
requested review from
accesswatch and
kellylford
as code owners
August 16, 2026 18:24
dependabot
Bot
added
security
Updates the requirements on [pypdf](https://github.com/py-pdf/pypdf) to permit the latest version. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.15.0...6.16.1) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.16.0 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/pip/pypdf-gte-6.16.0
branch
from
August 17, 2026 18:52
7bf7847 to
05922c6
Compare
Contributor
|
@dependabot rebase |
Contributor
Author
|
Looks like this PR is already up-to-date with main! If you'd still like to recreate it from scratch, overwriting any edits, you can request |
accesswatch
pushed a commit
that referenced
this pull request
Aug 17, 2026
…d unpin a vulnerable pypdf Quill-Radio-Companion-<ver>.zip was the only release artifact nothing built. build_portable.py has had --no-runtime since the distribution overhaul, and it prints the zip name it expects the caller to create -- but no caller existed. So the Companion was assembled by hand, and each release shipped whichever copy happened to be left in dist\ from the last time somebody remembered. Today's 3.0.0 zip was four hours stale against the payload beside it. build_release.ps1 now builds it after the OptiLab staging, passes it to sign-build alongside the shared runtime and the portable app, and zips it. Same argument as the site-docs sync a few steps above: mechanical, or it rots. Separately, uv.lock pinned pypdf 6.14.2 and drew two moderate Dependabot alerts (vulnerable range < 6.15.0, both filed against uv.lock, not pyproject). The lock had not been regenerated in a long time, so `uv lock --upgrade-package pypdf` moved a good deal else with it -- wxPython 4.2.5 -> 4.3.1, pywin32 311 -> 312. Dev-only either way: releases build with pip and the pinned system CPython, and pypdf is not in any shipped Radio bundle (the runtime carries pypdfium2, a different package), so nothing that ever reached a user was exposed. Worth recording because it was not obvious: PR #1411 raised the pypdf floor to >=6.16.1 while the build interpreter still had 6.15.0, which put check_build_env.py into failure and would have stopped the next release build. Upgraded, verified, and the artifacts rebuilt against it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on pypdf to permit the latest version.
Release notes
Sourced from pypdf's releases.
Changelog
Sourced from pypdf's changelog.
... (truncated)
Commits
1bce7a7REL: 6.16.1d91ab70SEC: Limit iterations for outline retrieval and XForm text extraction (#3966)2b60c99REL: 6.16.0c9ba557SEC: Detect cycles in TreeObject.insert_child (#3964)c8e1c72BUG: Always define PdfWriter._reader (#3960)3a0f355ROB: Detect cyclic pages in _get_page_in_node (#3962)20512f4ROB: AppearanceStream: Only escape parentheses for 8-bit fonts (#3961)34ccd14MAINT: Deduplicate CatalogAttributes and CatalogDictionary (#3940)5b8f19eENH: AppearanceStream: Allow arbitrary rotations and apply rotations for anno...53bfbc6PI: Build /ToUnicode source-code bytes directly in parse_bfrange (#3952)