robocorp · mikahanninen · Aug 23, 2026 · Aug 23, 2026
diff --git a/docs/source/releasenotes.rst b/docs/source/releasenotes.rst
@@ -35,9 +35,27 @@ Latest versions
 - **Security:** Bump ``soupsieve`` ≥2.8.4 (HIGH — memory exhaustion via large
   comma-separated selector lists, CVE-2026-49476) in the root and ``rpaframework``
   lock files.
-
-- ``rpaframework-core`` **13.0.2**
-- ``rpaframework`` **33.0.0**
+- **Security:** Bump ``pillow`` ≥12.3.0 (HIGH — heap out-of-bounds write in
+  ``ImageCmsTransform.apply()``, CVE-2026-59205; decompression-bomb DoS in
+  ``PdfParser.PdfStream.decode()``, CVE-2026-59200) across all packages.
+- **Security:** Bump ``cryptography`` ≥50.0.0 (HIGH — Bleichenbacher oracle in PKCS#7
+  ``EnvelopedData`` decryption, CVE-2026-69247) across all packages.
+- **Security:** Bump ``pypdf`` ≥6.15.0 (MEDIUM — large memory usage for large
+  ``/ToUnicode`` streams, CVE-2026-71870) in ``rpaframework-pdf``.
+- **Security:** Bump ``pyasn1`` ≥0.6.4 (HIGH — BER/CER/DER decoder DoS via unbounded
+  long-form tag IDs, CVE-2026-59884) and ``httplib2`` ≥0.32.0 (HIGH — decompression-bomb
+  DoS via unbounded gzip/deflate handling, CVE-2026-59939) in ``rpaframework-google``.
+- **Security:** Bump ``setuptools`` ≥83.0.0 (MEDIUM — ``MANIFEST.in`` exclusion bypass via
+  Unicode normalization collision, CVE-2026-59890) in ``rpaframework-sema4ai``.
+- ``rpaframework``: Require ``rpaframework-core`` ≥13.0.2, so a fresh install cannot
+  resolve a core that predates the Windows locator fixes ``RPA.Windows`` relies on.
+
+- ``rpaframework-core`` **13.0.3**
+- ``rpaframework-pdf`` **11.0.2**
+- ``rpaframework-recognition`` **8.0.2**
+- ``rpaframework-google`` **12.0.1**
+- ``rpaframework-sema4ai`` **1.1.1**
+- ``rpaframework`` **33.0.1**
 
 `Released <https://pypi.org/project/rpaframework/#history>`_
 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

diff --git a/packages/assistant/uv.lock b/packages/assistant/uv.lock
diff --git a/packages/aws/uv.lock b/packages/aws/uv.lock
diff --git a/packages/core/pyproject.toml b/packages/core/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rpaframework-core"
-version = "13.0.2"
+version = "13.0.3"
 description = "Core utilities used by RPA Framework"
 authors = [{name = "RPA Framework", email = "rpafw@robocorp.com"}]
 license = {text = "Apache-2.0"}
@@ -28,7 +28,7 @@ dependencies = [
 	"psutil >=5.9.0; platform_system == 'Windows'",
 	"pywin32 >=300, <400; platform_system == 'Windows' and python_version != '3.8.1'",
 	"uiautomation >=2.0.15; platform_system == 'Windows'",
-	"pillow >=10.2.0",
+	"pillow >=12.3.0",
 	"packaging >=24.0",
 	"httpx>=0.28.1",
 ]

diff --git a/packages/core/uv.lock b/packages/core/uv.lock
diff --git a/packages/devutils/uv.lock b/packages/devutils/uv.lock
diff --git a/packages/google/pyproject.toml b/packages/google/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rpaframework-google"
-version = "12.0.0"
+version = "12.0.1"
 description = "Google library for RPA Framework"
 authors = [{name = "RPA Framework", email = "rpafw@robocorp.com"}]
 license = {text = "Apache-2.0"}

diff --git a/packages/google/uv.lock b/packages/google/uv.lock
diff --git a/packages/hubspot/uv.lock b/packages/hubspot/uv.lock
diff --git a/packages/main/pyproject.toml b/packages/main/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rpaframework"
-version = "33.0.0"
+version = "33.0.1"
 description = "A collection of tools and libraries for RPA"
 authors = [{name = "RPA Framework", email = "rpafw@robocorp.com"}]
 license = {text = "Apache-2.0"}
@@ -24,7 +24,7 @@ classifiers = [
 
 dependencies = [
 	"docutils>=0.21.2",
-	"rpaframework-core>=13.0.0",
+	"rpaframework-core>=13.0.2",
 	"rpaframework-pdf>=11.0.0",
 	"rpaframework-windows>=11.0.0; sys_platform == 'win32'",
 	"java-access-bridge-wrapper>=1.1.0",
@@ -49,13 +49,13 @@ dependencies = [
 	"xlwt>=1.3.0",
 	"xlutils>=2.0.0",
 	"openpyxl>=3.0.9",
-	"pillow>=12.2.0",
+	"pillow>=12.3.0",
 	"simple_salesforce>=1.0.0",
 	"netsuitesdk>=1.1.0",
 	"tweepy>=3.8.0",
 	"graphviz>=0.13.2",
 	"notifiers>=1.3.3",
-	"cryptography>=48.0.1",
+	"cryptography>=50.0.0",
 	"mss>=6.0.0",
 	"chardet>=3.0.0",
 	"PySocks>=1.5.6,!=1.5.7,<2.0.0",

diff --git a/packages/main/uv.lock b/packages/main/uv.lock
diff --git a/packages/openai/uv.lock b/packages/openai/uv.lock
diff --git a/packages/pdf/pyproject.toml b/packages/pdf/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rpaframework-pdf"
-version = "11.0.1"
+version = "11.0.2"
 description = "PDF library of RPA Framework"
 authors = [{name = "RPA Framework", email = "rpafw@robocorp.com"}]
 license = {text = "Apache-2.0"}
@@ -26,7 +26,7 @@ dependencies = [
 	"rpaframework-core >=13.0.0",
 	"robotframework >=4.0.0, !=4.0.1, !=6.1.0, <8.0.0",
 	"pdfminer.six >=20251107",
-	"pypdf>=6.13.3",
+	"pypdf>=6.15.0",
 	"fpdf2 >=2.8.4",
 	"docutils>=0.21.2",
 ]

diff --git a/packages/pdf/uv.lock b/packages/pdf/uv.lock
diff --git a/packages/recognition/pyproject.toml b/packages/recognition/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rpaframework-recognition"
-version = "8.0.1"
+version = "8.0.2"
 description = "OCR capabilities used by RPA Framework"
 authors = [{name = "RPA Framework", email = "rpafw@robocorp.com"}]
 license = {text = "Apache-2.0"}
@@ -25,7 +25,7 @@ classifiers = [
 
 dependencies = [
 	"rpaframework-core >=13.0.0",
-	"pillow >=10.2.0",
+	"pillow >=12.3.0",
 	"opencv-python-headless >=4.8.1, <4.11.0",
 	"numpy >=1.19.3",
 	"pytesseract >=0.3.6, <0.4.0",

diff --git a/packages/recognition/uv.lock b/packages/recognition/uv.lock
diff --git a/packages/sema4ai/pyproject.toml b/packages/sema4ai/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rpaframework-sema4ai"
-version = "1.1.0"
+version = "1.1.1"
 description = "Sema4ai library for RPA Framework"
 authors = [{name = "RPA Framework", email = "rpafw@robocorp.com"}]
 license = {text = "Apache-2.0"}
@@ -27,7 +27,7 @@ dependencies = [
 	"sema4ai-actions>=1.6.4",
 	"robocorp>=3.0.0",
 	"pydantic>=2.12.4",
-	"setuptools>=65.0.0",
+	"setuptools>=83.0.0",
 	"wheel>=0.40.0"
 ]
 
@@ -40,7 +40,7 @@ dev = [
 package = true
 
 override-dependencies = [
-	"cryptography>=46.0.5",
+	"cryptography>=50.0.0",
 ]
 
 [tool.uv.sources]