Skip to content

Update pypdf requirement from <7,>=6.13.0 to >=6.13.1,<7 - #1966

Merged
JSv4 merged 1 commit into
mainfrom
dependabot/pip/pypdf-gte-6.13.1-and-lt-7
Jun 10, 2026
Merged

Update pypdf requirement from <7,>=6.13.0 to >=6.13.1,<7#1966
JSv4 merged 1 commit into
mainfrom
dependabot/pip/pypdf-gte-6.13.1-and-lt-7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on pypdf to permit the latest version.

Release notes

Sourced from pypdf's releases.

Version 6.13.1, 2026-06-08

What's new

Security (SEC)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.13.1, 2026-06-08

Security (SEC)

  • Prevent infinite loops when processing threads/articles (#3839)

Full Changelog

Version 6.13.0, 2026-06-05

Security (SEC)

  • Avoid infinite loops for outlines and text extraction (#3830)

New Features (ENH)

  • Add Japanese predefined CMaps (#3800)
  • Font: Collect all character widths, not only those that can be unicode mapped (#3798)

Robustness (ROB)

  • Recover a corrupt trailing startxref pointer (closes #3238) (#3826)
  • Handle /Pages node without /Kids during flattening (#3825)
  • Accept inline image EI marker at the end of a content stream (#3827)

Maintenance (MAINT)

  • Type the always-raising deprecation helpers as NoReturn (#3819)

Full Changelog

Version 6.12.2, 2026-05-26

Security (SEC)

  • Optimize _decode_png_prediction regarding memory and speed (#3806)
  • Improve loop control in text extraction (#3805)

Full Changelog

Version 6.12.1, 2026-05-22

Security (SEC)

  • Limit input size and element count for XMP metadata (#3796)

Robustness (ROB)

  • Prevent cyclic parent hierarchies for inherited dictionaries (#3795)
  • Deal with invalid first code in LZW decoder (#3794)

Full Changelog

Version 6.12.0, 2026-05-21

Security (SEC)

  • Disallow cross-reference streams with zero-only width values (#3791)
  • Avoid excessive whitespace in layout mode text extraction (#3790)

... (truncated)

Commits
  • 7a3a870 REL: 6.13.1
  • 5efe472 SEC: Prevent infinite loops when processing threads/articles (#3839)
  • 80509e3 ROB: Avoid recursion errors for _doc_common (#3838)
  • d74d95d MAINT: Remove unreachable return in read_until_regex (#3833)
  • 1f56e9a ROB: Skip truncated bfrange and bfchar lines in process_cm_line (#3829)
  • See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Update pypdf requirement from <7,>=6.13.0 to >=6.13.1,<7
ade8447 
Updates the requirements on [pypdf](https://github.com/py-pdf/pypdf) to permit the latest version.
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.13.0...6.13.1)

---
updated-dependencies:
- dependency-name: pypdf
  dependency-version: 6.13.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 8, 2026
@claude

claude Bot commented Jun 8, 2026

Copy link
Copy Markdown

Code Review: Update pypdf ≥6.13.1,<7

Overview

This is a Dependabot-generated single-line bump of the pypdf lower-bound in requirements/base.txt from >=6.13.0 to >=6.13.1. The new floor locks in a security patch released today (2026-06-08).

What changed and why it matters

Release Category Fix
6.13.1 SEC Prevent infinite loops when processing threads/articles (#3839)
6.13.0 SEC Avoid infinite loops for outlines and text extraction (#3830)
6.12.2 SEC Optimize _decode_png_prediction for memory/speed; improve loop control in text extraction
6.12.1 SEC Limit XMP metadata input size; prevent cyclic parent hierarchies
6.12.0 SEC Disallow zero-only-width cross-reference streams; avoid excessive whitespace in layout-mode extraction

This project processes user-uploaded PDFs, making infinite-loop and resource-exhaustion DoS vectors directly exploitable against the parser pipeline. Bumping to 6.13.1 is the correct action.

Assessment

Correctness ✅
The change is a one-character lower-bound increment. The upper bound <7 is preserved, so no major API breakage is introduced.

Security ✅ (recommend merge)
6.13.1 carries multiple security-tagged fixes targeting infinite loops and memory exhaustion during PDF parsing — all high-relevance attack surfaces for a document analytics platform that accepts untrusted PDFs.

No test coverage needed
This is a version-floor bump; no application code changed. Existing PDF parsing tests implicitly exercise the new library version on merge.

No changelog fragment needed
Dependency bumps don't meet the project's bar for changelog fragments (no production logic changed), but if the team tracks security dependency updates, a security fragment is appropriate:

changelog.d/1966.security.md
- Bumped `pypdf` lower bound to 6.13.1 to pick up security fixes for infinite-loop
  DoS vulnerabilities in PDF thread/article and outline processing (py-pdf/pypdf #3839, #3830).

Verdict

Approve and merge. This is a straightforward, low-risk security patch with no API changes. No concerns.

@JSv4
JSv4 merged commit 60d5c31 into main Jun 10, 2026
6 checks passed
@JSv4
JSv4 deleted the dependabot/pip/pypdf-gte-6.13.1-and-lt-7 branch June 10, 2026 01:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@JSv4