fix(security): bump pillow, cryptography, pypdf, pyasn1, httplib2, setuptools - #1350
Merged
Conversation
…tuptools Clears all 158 open Dependabot alerts, which collapse to 7 distinct CVEs duplicated across the 13 lock files. - pillow >=12.3.0 HIGH CVE-2026-59205 heap OOB write in ImageCmsTransform.apply() HIGH CVE-2026-59200 decompression bomb in PdfParser.PdfStream.decode() - cryptography >=50.0.0 HIGH CVE-2026-69247 Bleichenbacher oracle in PKCS#7 EnvelopedData - pyasn1 >=0.6.4 HIGH CVE-2026-59884 BER/CER/DER decoder DoS - httplib2 >=0.32.0 HIGH CVE-2026-59939 decompression bomb DoS - pypdf >=6.15.0 MED CVE-2026-71870 large memory use for /ToUnicode streams - setuptools >=83.0.0 MED CVE-2026-59890 MANIFEST.in exclusion bypass Patch releases per the cascade policy: core 13.0.3, pdf 11.0.2, recognition 8.0.2, google 12.0.1, sema4ai 1.1.1, main 33.0.1. Also raises main's rpaframework-core floor to >=13.0.2 so a fresh install cannot resolve a core predating the RPA.Windows locator fixes. The floor stays at a published version deliberately: main resolves core from PyPI, so pointing it at the unreleased 13.0.3 makes the lock unsatisfiable. Locks updated with `uv lock --upgrade-package` — plain `uv lock` silently preserves existing transitive pins. Verified every dep meets its patched minimum across all 13 lock files. Tests: core 150, main 626, pdf 86, recognition 48 — all passing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01R5fd658SbZtHYC6nGpE1H5
Wheel artifactBuilt from commit Artifact name: |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Clears all 158 open Dependabot alerts, which collapse to 7 distinct CVEs duplicated across the 13 lock files. No criticals.
Releases (patch, per the cascade policy)
rpaframework-corerpaframework-pdfrpaframework-recognitionrpaframework-googlerpaframework-sema4airpaframeworkRelease order: core → pdf → main; the independent packages in any order.
Two things reviewers should know
1. main's
rpaframework-corefloor is>=13.0.2, not>=13.0.3.mainresolves core from PyPI, so pointing it at the unreleased 13.0.3 makes the lock unsatisfiable:13.0.2 is also the semantically correct floor — it carries the
RPA.Windowslocator fixes main depends on. Core 13.0.3 only bumps pillow, which main already constrains directly. If the tighter floor is wanted, it needs a follow-up PR after core 13.0.3 is published.2. Locks were updated with
uv lock --upgrade-package. Plainuv locksilently preserves existing transitive pins — it reports "Resolved N packages" with no "Updated" line and looks correct while leaving vulnerable versions in place. Every dep was verified against its patched minimum across all 13 lock files afterward.Test plan
packages/core— 150 passedpackages/main— 626 passedpackages/pdf— 86 passedpackages/recognition— 48 passed🤖 Generated with Claude Code
https://claude.ai/code/session_01R5fd658SbZtHYC6nGpE1H5