build(deps): bump pypdf from 6.16.1 to 6.19.0 - #2558
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.16.1 to 6.19.0. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.16.1...6.19.0) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.19.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cwl-noema-review[bot]](https://avatars.githubusercontent.com/u/295022177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Noema LLM review
Autogenerated hash-locked bump of pypdf from 6.16.1 to 6.19.0 with a 1:1 hash replacement. Only the pypdf pin and its two digests change; no source or test code is touched. Both regression hypotheses (hash-set corruption/install failure, silent transitive dependency change) were refuted at the changed-side lines, so no blocking issue is present.
Reviewed changed lines
requirements-strix-ci-hashes.txt:1822 (RIGHT): The version pin is correctly updated from 6.16.1 to 6.19.0.requirements-strix-ci-hashes.txt:1823 (RIGHT): The hash is replaced with a new, distinct 64-hex sha256 value corresponding to the new version.requirements-strix-ci-hashes.txt:1824 (RIGHT): The second hash is replaced with a new, distinct 64-hex sha256 value, maintaining the original number of hash entries.
Adversarial validation
requirements-strix-ci-hashes.txt:1823 (RIGHT)falsified: The lockfile hash set is stale, duplicated, or malformed, causing pip/uv hash-verification failure at install time. — verifiedrequirements-strix-ci-hashes.txt:1824 (RIGHT)falsified: The version bump silently changes the resolved dependency graph (added or dropped transitive pins) while the lockfile shows only the pypdf rows. — verified- Residual risk: low
Findings
- No blocking findings.
- Result: APPROVE
- Head SHA:
ad03defed38d31adf22b7a4982463f32b2383852 - Reviewer credential:
noema-review-github-app-refresh - Actor:
cwl-noema-review[bot]
|
New executable current-owner composition evidence, not approval or protected-main shipment. The complete private union of current pagination #2555 The actual unfiltered compiled Strix lock audit still finds eight vulnerabilities in pypdf 6.16.1. The existing #2558 patch applies cleanly to that union under a private index. Complete package-map comparison proves the only version delta is pypdf 6.16.1→6.19.0; all 106 compiled pins then audit with zero known vulnerabilities, exit0. Strix uses exactly the existing workflow's overridden-lock Actual CPython3.10.20 hash-required installation of pypdf6.19.0 plus its inherited typing-extensions4.15.0 closure succeeds; blank-page write/read and dependency check pass. An initial probe omitted that closure and failed before installation; it is retained as a fixture error, not a package incompatibility. Private composed tree |
2026-10-03 exact-head lifecycle correction
The PR is therefore returned to Draft / Proposed / merge HOLD without discarding its pypdf delta. No rerun, synthetic result, bypass, auto-merge, merge, force update, rebase, or closure is used. |
This branch has not been deployed
1 participant
Bumps pypdf from 6.16.1 to 6.19.0.
Release notes
Sourced from pypdf's releases.
... (truncated)
Changelog
Sourced from pypdf's changelog.
... (truncated)
Commits
d62cb58REL: 6.19.00d8b5a8SEC: Limit size of alphabetical page labels (#4096)959467aPI: Move static value out of loop body for appearance stream data (#4087)20822b2DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)25f2301DEP: Replace PdfWriter method add_js (#3979)a924438BUG: Do not copy unrelated pages when appending pages with non-terminal field...cf5cec2BUG: Use page reference for existing internal link targets (#4076)96d81f0BUG: Arabic-Indic digits are reversed during text extraction (#4077)2d21901DEV: Fix Color class for latest mypy (#4082)893a010MAINT: Split PdfDocCommon._flatten (#4070)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.