Codestin Search App

dependabot · 2026-06-18T17:07:03Z

Warning

Dependabot will stop supporting python v3.9!

Please upgrade to one of the following versions: v3.9, v3.10, v3.11, v3.12, v3.13, or v3.14.

Bumps pypdf from 6.13.0 to 6.13.3.

Release notes

Version 6.13.3, 2026-06-17

What's new

Security (SEC)

Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#3871) by @stefan6419846

Performance Improvements (PI)

Avoid per-pixel getpixel loop for 1-bit indexed images (#3854) by @Samuel-Harris

Robustness (ROB)

Several fixes by @metsw24-max

Maintenance (MAINT)

Make mypy assert messages consistent (#3849) by @j-t-1

Full Changelog

Version 6.13.2, 2026-06-10

What's new

Security (SEC)

Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#3847) by @fredericoschardong

Robustness (ROB)

Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#3841) by @joszamama

Raise PdfStreamError on non-hexadecimal bytes in hex readers (#3832) by @metsw24-max

Full Changelog

Version 6.13.1, 2026-06-08

What's new

Security (SEC)

Prevent infinite loops when processing threads/articles (#3839) by @stefan6419846

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.13.3, 2026-06-17

Security (SEC)

Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#3871)

Performance Improvements (PI)

Avoid per-pixel getpixel loop for 1-bit indexed images (#3854)

Robustness (ROB)

Several fixes

Maintenance (MAINT)

Make mypy assert messages consistent (#3849)

Full Changelog

Version 6.13.2, 2026-06-10

Security (SEC)

Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#3847)

Robustness (ROB)

Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#3841)

Raise PdfStreamError on non-hexadecimal bytes in hex readers (#3832)

Full Changelog

Version 6.13.1, 2026-06-08

Security (SEC)

Prevent infinite loops when processing threads/articles (#3839)

Full Changelog

Commits

9aa05e7 REL: 6.13.3
bbd083d SEC: Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#3871)
d5cd266 ROB: Guard text operators against missing operands in extract_text (#3861)
82f1f90 ROB: Tolerate malformed /Limits in index2label (#3858)
0276a6f PI: Avoid per-pixel getpixel loop for 1-bit indexed images (#3854)
41a9c3c MAINT: Make mypy assert messages consistent (#3849)
d1bba60 MAINT: Increase readability of PdfDocCommon (#3834)
53b6fbc DEV: Bump codecov/codecov-action from 6.0.1 to 7.0.0 (#3859)
e07c223 MAINT: Enforce G004 (no f-strings in logging) (#3845)
5270f76 ROB: Guard zero unitsPerEm in from_truetype_font_file (#3846)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.13.0 to 6.13.3. - [Release notes](https://github.com/py-pdf/pypdf/releases) - [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md) - [Commits](py-pdf/pypdf@6.13.0...6.13.3) --- updated-dependencies: - dependency-name: pypdf dependency-version: 6.13.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2026-06-18T17:08:17Z

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

github-actions · 2026-06-18T17:08:18Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

github-actions · 2026-06-18T17:10:02Z

📦 Dependency diff (SBOM)

Comparing main → dependabot/pip/agent-governance-python/agent-os/modules/caas/pypdf-6.13.3.

Summary: ➕ 0 added · ➖ 0 removed · 🔄 1 bumped

🔄 Bumped

`pypi` (1)

Package	From	To
pypdf	6.13.0	6.13.3

imran-siddique · 2026-06-19T15:26:48Z

The failures on this PR are a false positive -- they are caused by three regex bugs in (shipped in #3107) that break the K-12 policy tests for all PRs. Fix is in #3115. Once that merges, please retrigger this PR's CI with a rebase or empty push and it should go green. Cooling-off still expires 2026-06-22.

imran-siddique · 2026-06-22T18:26:46Z

Two blockers:

7-day cooling-off: PR opened 2026-06-18, today is 2026-06-22 (4 days). Cannot clear until 2026-06-25.
test (agent-os): The 3 test failures are pre-existing in the agent-os test suite (quorum vote duplicate-append and edu-k12 regex issues). They are fixed in fix(escalation): record votes in approve/deny; fix quorum always evaluating to 0 #3127 but the fixes have not yet landed in main. Once fix(escalation): record votes in approve/deny; fix quorum always evaluating to 0 #3127 merges, a rebase here should clear those test failures alongside the cooling-off expiry.

imran-siddique

pypdf 6.13.0 → 6.13.3 includes two security fixes (MAX_DECLARED_STREAM_LENGTH enforcement for streams without declared length, and multi-hop cyclic /Pages tree detection to prevent SIGSEGV). Both are relevant to the PDF-parsing surface in agent-os/caas. The "Policy: Awaiting maintainer review" gate blocked this; approving now.

Note: CI failure on this PR is the same pre-existing edu-k12 regex bug that will be fixed by #3127 and is unrelated to this dependency bump.

imran-siddique

The 7-day cooling-off gate is still active (opened June 18 -- passes June 25). Additionally, the test suite has failures that need investigation:

test (agent-os, 3.11), test (agent-os, 3.12), test (agent-os, 3.13): failing
docker-compose-test: failing

These test failures need to be resolved (or confirmed pre-existing in main) before this can merge. Once the cooling-off passes and CI is clean, I can approve.

…-os/modules/caas/pypdf-6.13.3

github-actions · 2026-06-22T21:41:49Z

🤖 AI Agent: security-scanner — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

No security issues found.

github-actions · 2026-06-22T21:41:49Z

🤖 AI Agent: test-generator — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Test coverage looks good. No gaps identified.

github-actions · 2026-06-22T21:41:51Z

🤖 AI Agent: docs-sync-checker — Docs Sync

AI-generated review output. Treat it as untrusted analysis and verify before acting.

Docs Sync

Documentation is in sync.

github-actions · 2026-06-22T21:41:52Z

🤖 AI Agent: code-reviewer — View details

AI-generated review output. Treat it as untrusted analysis and verify before acting.

TL;DR: 0 blockers, 1 warning. Safe update with a minor follow-up suggestion.

#	Sev	Issue	Where
1	Warn	Dependency update lacks explicit verification of security fixes in the changelog.	`requirements.txt`

Action items:

None.

Warnings:

#	Issue	Where	Action
1	Dependency update lacks explicit verification of security fixes in the changelog.	`requirements.txt`	Fine as follow-up PR.

github-actions · 2026-06-22T21:41:55Z

🤖 AI Agent: breaking-change-detector — API Compatibility

AI-generated review output. Treat it as untrusted analysis and verify before acting.

API Compatibility

No breaking changes detected.

MohammadHaroonAbuomar

Routine dependency bump — reviewed in batch.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jun 18, 2026

dependabot Bot requested review from MohammadHaroonAbuomar and imran-siddique as code owners June 18, 2026 17:07

github-actions Bot enabled auto-merge (squash) June 18, 2026 17:08

github-actions Bot added the size/XS Extra small PR (< 10 lines) label Jun 18, 2026

imran-siddique mentioned this pull request Jun 19, 2026

fix(edu-k12): correct three regex bugs in K-12 starter policy pack #3115

Closed

3 tasks

imran-siddique approved these changes Jun 22, 2026

View reviewed changes

imran-siddique reviewed Jun 22, 2026

View reviewed changes

imran-siddique mentioned this pull request Jun 22, 2026

feat(engine-api): add FastAPI reference adapter and /policies gap-fix (Epic 0, issue #3066) #3085

Open

Merge branch 'main' into dependabot/pip/agent-governance-python/agent…

0605954

…-os/modules/caas/pypdf-6.13.3

MohammadHaroonAbuomar approved these changes Jun 23, 2026

View reviewed changes

MohammadHaroonAbuomar merged commit 8c6a8cc into main Jun 23, 2026
129 of 131 checks passed

MohammadHaroonAbuomar deleted the dependabot/pip/agent-governance-python/agent-os/modules/caas/pypdf-6.13.3 branch June 23, 2026 19:28

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 18, 2026

Version 6.13.3, 2026-06-17

What's new

Security (SEC)

Performance Improvements (PI)

Robustness (ROB)

Maintenance (MAINT)

Version 6.13.2, 2026-06-10

What's new

Security (SEC)

Robustness (ROB)

Version 6.13.1, 2026-06-08

What's new

Security (SEC)

Version 6.13.3, 2026-06-17

Security (SEC)

Performance Improvements (PI)

Robustness (ROB)

Maintenance (MAINT)

Version 6.13.2, 2026-06-10

Security (SEC)

Robustness (ROB)

Version 6.13.1, 2026-06-08

Security (SEC)

Uh oh!

github-actions Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review Summary

Uh oh!

github-actions Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

github-actions Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Dependency diff (SBOM)

🔄 Bumped

pypi (1)

Uh oh!

imran-siddique commented Jun 19, 2026

Uh oh!

imran-siddique commented Jun 22, 2026

Uh oh!

imran-siddique left a comment

Choose a reason for hiding this comment

Uh oh!

imran-siddique left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

Docs Sync

Uh oh!

github-actions Bot commented Jun 22, 2026

Uh oh!

github-actions Bot commented Jun 22, 2026

API Compatibility

Uh oh!

MohammadHaroonAbuomar left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 18, 2026 •

edited

Loading

github-actions Bot commented Jun 18, 2026 •

edited

Loading

github-actions Bot commented Jun 18, 2026 •

edited

Loading

`pypi` (1)