From c565a80e6e9ebebd402ca37a7364c1c73b4cc0c6 Mon Sep 17 00:00:00 2001 From: Superbot Helper Date: Fri, 30 Oct 2026 10:59:30 -0500 Subject: [PATCH] Bump pypdf from 6.11.0 to 6.21.2 GHSA-6c7f-9265-g8fw (CVE-2026-115572): pypdf returns early from its object cache only when the lookup is not None, and a missing object is cached as None, so each reference to the same absent object re-copies and re-scans the whole stream. A 1.2 MB PDF whose page tree references one never-defined object 20,000 times takes about 70 s in the page-tree walk on 6.11.0 and 0.025 s on 6.21.2. The API image installs exactly this lock with `uv sync --no-dev --no-install-project --locked`, and _check_pdf runs that walk on every PDF upload to POST /general/v0/general before the route has any chance to time out or reject the file. uv.lock only; no source changes. --- uv.lock | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/uv.lock b/uv.lock index 576451b6..c7855203 100644 --- a/uv.lock +++ b/uv.lock @@ -2522,11 +2522,11 @@ wheels = [ [[package]] name = "pypdf" -version = "6.11.0" +version = "6.21.2" source = { registry = "https://pypi.org/simple" } -sdist = { url = "https://files.pythonhosted.org/packages/bf/58/6dd97d78a4b17a7a6b9d1c6ad23895abc41f0fdc49c553cc05bdfdcc36d0/pypdf-6.11.0.tar.gz", hash = "sha256:062b51c81b0910e6d2755e99e1c5547a0a23b7d0a32322af66240d8edcfabe87", size = 6453975, upload-time = "2026-05-09T13:26:48.955Z" } +sdist = { url = "https://files.pythonhosted.org/packages/06/28/081f1cbcca7042441dafc8de00f48ba60853f89e5bff92c5f26477346d81/pypdf-6.21.2.tar.gz", hash = "sha256:0a3e1c5c886a1be03646c16a04827cc166c2a0575c971b26a4bf89686551c2d4", size = 7144571, upload-time = "2026-10-21T16:44:55.272Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/07/b1/68feb7eb3b99f0c020b414234825f4a5d70e0126c18d933770e8c93a35fc/pypdf-6.11.0-py3-none-any.whl", hash = "sha256:769394d5756d5b304c9b6bef88b54b1816b328e7e6fc9254e625529a15ed4ab8", size = 338819, upload-time = "2026-05-09T13:26:46.904Z" }, + { url = "https://files.pythonhosted.org/packages/1b/4d/c9d2d67f204eff463237a1a8f5e25a6923b7b1043982b91fcaf104c8ef60/pypdf-6.21.2-py3-none-any.whl", hash = "sha256:1d44d1a3a200f25062adff0085b02040e4646431ac2ccac22e42679e91466084", size = 407766, upload-time = "2026-10-21T16:44:53.626Z" }, ] [[package]]