chore: bump pypdf from 6.10.2 to 6.12.0#111
Conversation
dependabot
Bot
added
dependencies
Security Vulnerability — No Patch Available Yetaieng-bot fixed the following vulnerabilities automatically:
However, the following vulnerability cannot be fixed automatically because no patched version has been released to PyPI yet:
DetailsCVE-2026-45829 (chromadb 1.5.5): A pre-authentication code injection vulnerability in ChromaDB ≥1.0.0. An unauthenticated attacker can run arbitrary code on the server by sending a malicious model repository with Why this cannot be auto-fixedThe vulnerability exists in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability is a pre-authentication code injection in ChromaDB (versions 1.0.0+). It allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository with The OSV database confirms no Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability exists in aieng-bot verified that versions 1.5.5 through 1.5.9 (latest) all carry this CVE with no fix version listed in the advisory. A fix requires the upstream ChromaDB maintainers to release a new version. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Vulnerability DetailsA pre-authentication, code injection vulnerability in chromadb version 1.0.0 or later allows an unauthenticated attacker to run arbitrary code on the server by sending a malicious model repository with Why this cannot be auto-fixedThe PyPI vulnerability advisory for CVE-2026-45829 lists Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability is a pre-authentication code injection vulnerability in Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
|
A newer version of pypdf exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged. |
Security Vulnerability — No Patch Available Yetaieng-bot found the following security vulnerability reported by pip-audit, but cannot fix it automatically because no patched version has been released to PyPI yet:
Why this cannot be auto-fixedThe vulnerability is a pre-authentication code injection flaw in ChromaDB (CRITICAL severity). According to the OSV advisory, all versions from 1.0.0 through 1.5.9 (the current latest on PyPI) are affected — the range uses Bumping chromadb from 1.5.5 to 1.5.9 would not resolve the vulnerability. Recommended next steps
This PR will not be auto-merged until the vulnerability is resolved. |
amrit110
force-pushed
the
dependabot/uv/pypdf-6.12.0
branch
from
b352fd1 to
40ca602
Compare
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 0 files - Executed 145 agent actions - (93 info, 24 tool_call, 2 error, 19 tool_result, 6 reasoning, 1 action) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.10.2 to 6.12.0. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.10.2...6.12.0) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.12.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
…6 (pip) Bump aiohttp to >=3.14.0 to remediate CVE-2026-34993 (CookieJar.load arbitrary code execution) and CVE-2026-47265 (cross-origin cookie leak). Add pip>=26.1.2 to dev dependencies to remediate PYSEC-2026-196 (console script path traversal in pip 26.1). Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
amrit110
force-pushed
the
dependabot/uv/pypdf-6.12.0
branch
from
40ca602 to
40723c5
Compare
…, msgpack, pydantic-settings - bump pypdf from 6.12.0 to 6.13.3 to fix CVE-2026-48735, CVE-2026-49461, CVE-2026-49460, CVE-2026-54531, CVE-2026-54530, GHSA-jm82-fx9c-mx94 - bump cryptography from 46.0.6 to 48.0.1 to fix GHSA-537c-gmf6-5ccf - bump langsmith from 0.8.0 to 0.8.18 to fix GHSA-f4xh-w4cj-qxq8 - add msgpack>=1.2.1 to fix GHSA-6v7p-g79w-8964 - add pydantic-settings>=2.14.2 to fix GHSA-4xgf-cpjx-pc3j Co-authored-by: aieng-bot <aieng-bot@vectorinstitute.ai>
Security Vulnerabilities — Partial Fix + Remaining Unfixable Issuesaieng-bot applied fixes for 5 packages (cryptography, pypdf, langsmith, msgpack, pydantic-settings) but the following vulnerabilities cannot be auto-fixed due to incompatible dependency constraints: Fixed ✅
Unfixable — Human Review Required
|
| Package | Version | Vulnerability | Reason Cannot Fix |
|---|---|---|---|
| chromadb | 1.5.5 | CVE-2026-45829 | No patched version available on PyPI |
| langchain | 0.3.30 | GHSA-gr75-jv2w-4656 | Fix requires langchain>=1.3.9 but incompatible with langchain-graphrag (numpy<2.0.0) and langchain-neo4j constraints |
| langchain-openai | 0.3.35 | PYSEC-2026-76 | Fix requires langchain-openai>=1.1.14 (langchain 1.x ecosystem, same numpy conflict) |
| langchain-text-splitters | 0.3.11 | PYSEC-2026-77 | Fix requires langchain-text-splitters>=1.1.2 (langchain 1.x ecosystem, same numpy conflict) |
| langgraph | 0.5.0 | PYSEC-2026-83 | Fix requires langgraph>=1.0.10 (langchain 1.x ecosystem, same numpy conflict) |
Why the langchain ecosystem cannot be upgraded
Bumping langchain to 1.x causes an unsatisfiable dependency conflict:
langchain-graphrag>=0.0.9requiresnumpy<2.0.0langchain-neo4j>=0.7.0(required by langchain 1.x path) requiresneo4j-graphrag>=1.12.0which requiresnumpy>=2.0.0
This conflict is irreconcilable until either langchain-graphrag is updated to support numpy 2.x or an alternative dependency path exists.
Recommended next steps
- Update or replace
langchain-graphragto support numpy>=2.0.0 - Then the full langchain 1.x ecosystem upgrade can be applied
- For
chromadb CVE-2026-45829: monitor upstream for a patched release, or consider adding to the pip-audit ignore list with justification if the attack surface is not applicable to this project's deployment
This PR will not be auto-merged until the remaining vulnerabilities are resolved.
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 688 agent actions - (538 info, 62 tool_call, 15 error, 45 tool_result, 28 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Security Vulnerabilities — Cannot Be Auto-Fixedaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically:
Why these cannot be auto-fixedchromadb CVE-2026-45829: A pre-authentication code injection vulnerability affecting ChromaDB 1.0.0+. pip-audit reports no fixed version — the latest PyPI release (1.5.9) is still listed as affected. langchain GHSA-gr75-jv2w-4656: A path traversal vulnerability fixed in langchain 1.3.9. However, upgrading to 1.3.9 requires langchain-neo4j ≥ 0.7.0, which in turn requires neo4j-graphrag with numpy ≥ 2.0.0. This conflicts with langchain-graphrag's dependency on graspologic, which requires numpy < 2.0.0. The dependency graph is unsatisfiable with the current package set. Recommended next steps
This PR will not be auto-merged until the vulnerabilities are resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 422 agent actions - (328 info, 38 tool_call, 4 error, 32 tool_result, 19 reasoning, 1 action) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
Security Vulnerabilities — Cannot Be Auto-Fixedaieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically:
CVE-2026-45829 — chromadb 1.5.5A pre-authentication code injection vulnerability affecting chromadb ≥ 1.0.0 when Why it cannot be auto-fixed: No patched version has been released upstream. GHSA-gr75-jv2w-4656 — langchain 0.3.30A path traversal / sandbox escape vulnerability. The fix requires upgrading to langchain ≥ 1.3.9 (a major version bump from 0.3.x to 1.x). Why it cannot be auto-fixed: Upgrading langchain to 1.x requires To fix this, upstream Recommended next steps
This PR will not be auto-merged until the vulnerabilities are resolved. |
|
Automated fix applied and PR merged The agentic fix loop successfully fixed this PR and merged it. ✓ Successfully fixed security failures - Modified 1 files - Executed 414 agent actions - (327 info, 37 tool_call, 5 error, 32 tool_result, 13 reasoning) View detailed trace on dashboard | Raw trace AI Engineering Maintenance Bot |
1 participant
Bumps pypdf from 6.10.2 to 6.12.0.
Release notes
Sourced from pypdf's releases.
Changelog
Sourced from pypdf's changelog.
Commits
08eb143REL: 6.12.0507d7c9SEC: Disallow cross-reference streams with zero-only width values (#3791)9d27470SEC: Avoid excessive whitespace in layout mode text extraction (#3790)0a8e699DOC: Block encrypting writer in incremental mode (#3789)541ebd4DEV: Update idna from version 3.10 to 3.15de405a8DEV: Update idna from version 3.10 to 3.15a2b90f9ROB: AppearanceStream: Also honor user-set font name when not flattening anno...22bd60fMAINT: Tiny change of comments (#3787)2995392ENH: Implement SASLprep (RFC 4013) for AES-256 password normalization (#3780)e044789TST: Disable PyPy update checks after image updateDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.