[Aparnap2]

What changed

File	Change
pyproject.toml	pypdf>=6.19.0 → pypdf>=6.21.2 (1 line)
uv.lock	re-pin pypdf 6.21.0 → 6.21.2 — only version change in the lock

Base main@c971727 · commit 1584eac · mirrors W1 / #180 (pillow) exactly.

Root cause — external, not this tree

The PyPI advisory database moved between the last green main run and the next PR's CI. pypdf 6.21.0 (in the lock via the old floor) now carries four advisories, all fixed upstream:

CVE	Fix
CVE-2026-113786	6.21.1
CVE-2026-115572	6.21.2
CVE-2026-115585	6.21.2
CVE-2026-115580	6.21.2

The advisory failure surfaced on PR #183's security job; that PR changes only Go tests and is unaffected. This PR raises the floor so every branch re-running pip-audit goes green again.

Why corpus identity had to be proven — pypdf is the generator dependency

Unlike pillow (a decoding library), pypdf writes fixtures/parser_eval/ — tools/corpus (sole reproducer of the committed 45-case Tier A+C corpus, master_seed: 29) depends on it. By the repo rule, corpus changes require requalification — so the load-bearing negative control:

Candidate corpus generated with pypdf 6.21.2 at seed 29 → diff -r against fixtures/parser_eval: exit 0, zero differences. All 45 case PDFs cmp-identical, manifest identical (upstream generator_version 1.0.0, layout_version v1 unchanged). No corpus requalification needed — generator Version≈8 still reproduces the locked corpus byte-for-byte.

Test results

uvx pip-audit  -> No known vulnerabilities found   (claimops-ai: workspace-local, skipped as before)
uv pip check                                 -> compatible
uv run pytest tests/unit -q                  -> 67 passed
uv run ruff check .                          -> All checks passed!
uv run python -m tools.corpus.generate --out … --seed 29, diff -r fixtures/parser_eval
                                             -> exit 0 (45/45 byte-identical)
gofmt -l / go vet ./... / go test ./... -count=1 -> 41 packages ok (untouched scope)

Unresolved issues / edge cases

• Watch tools/corpus/generate.py's GENERATOR_VERSION contract if pypdf surfaces a 7.x break before this ships — the byte-identity control above is the referee either way.
• The advisory DB may move again before this merges (it did for test(claims): witness the five unasserted legal edges and the stale-vs-edge precedence #183); if so this PR re-locks on rebase.

Status

Single-dependency superscription. Not authorized to merge — opened as a draft for review. Release NOT QUALIFIED.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 3188efe6-c448-4420-bd71-8696ef550eca

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}