Skip to content

chore(deps): bump pypdf from 6.7.2 to 6.7.4#2265

Merged
aivong-openhands merged 2 commits intomainfrom
dependabot/uv/pypdf-6.7.4
Mar 3, 2026
Merged

chore(deps): bump pypdf from 6.7.2 to 6.7.4#2265
aivong-openhands merged 2 commits intomainfrom
dependabot/uv/pypdf-6.7.4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 2, 2026 •
edited by github-actions bot
Loading

Bumps pypdf from 6.7.2 to 6.7.4.

Release notes

Sourced from pypdf's releases.

Version 6.7.4, 2026-02-27

What's new

Security (SEC)

Robustness (ROB)

Full Changelog

Version 6.7.3, 2026-02-24

What's new

Security (SEC)

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.7.4, 2026-02-27

Security (SEC)

  • Allow limiting output length for RunLengthDecode filter (#3664)

Robustness (ROB)

  • Deal with invalid annotations in extract_links (#3659)

Full Changelog

Version 6.7.3, 2026-02-24

Security (SEC)

  • Use zlib decompression limit when retrieving XFA data (#3658)

Full Changelog

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Agent Server images for this PR

• GHCR package: https://github.com/OpenHands/agent-sdk/pkgs/container/agent-server

Variants & Base Images

Variant Architectures Base Image Docs / Tags
java amd64, arm64 eclipse-temurin:17-jdk Link
python amd64, arm64 nikolaik/python-nodejs:python3.12-nodejs22 Link
golang amd64, arm64 golang:1.21-bookworm Link

Pull (multi-arch manifest)

# Each variant is a multi-arch manifest supporting both amd64 and arm64
docker pull ghcr.io/openhands/agent-server:d9965c5-python

Run

docker run -it --rm \
  -p 8000:8000 \
  --name agent-server-d9965c5-python \
  ghcr.io/openhands/agent-server:d9965c5-python

All tags pushed for this build

ghcr.io/openhands/agent-server:d9965c5-golang-amd64
ghcr.io/openhands/agent-server:d9965c5-golang_tag_1.21-bookworm-amd64
ghcr.io/openhands/agent-server:d9965c5-golang-arm64
ghcr.io/openhands/agent-server:d9965c5-golang_tag_1.21-bookworm-arm64
ghcr.io/openhands/agent-server:d9965c5-java-amd64
ghcr.io/openhands/agent-server:d9965c5-eclipse-temurin_tag_17-jdk-amd64
ghcr.io/openhands/agent-server:d9965c5-java-arm64
ghcr.io/openhands/agent-server:d9965c5-eclipse-temurin_tag_17-jdk-arm64
ghcr.io/openhands/agent-server:d9965c5-python-amd64
ghcr.io/openhands/agent-server:d9965c5-nikolaik_s_python-nodejs_tag_python3.12-nodejs22-amd64
ghcr.io/openhands/agent-server:d9965c5-python-arm64
ghcr.io/openhands/agent-server:d9965c5-nikolaik_s_python-nodejs_tag_python3.12-nodejs22-arm64
ghcr.io/openhands/agent-server:d9965c5-golang
ghcr.io/openhands/agent-server:d9965c5-java
ghcr.io/openhands/agent-server:d9965c5-python

About Multi-Architecture Support

  • Each variant tag (e.g., d9965c5-python) is a multi-arch manifest supporting both amd64 and arm64
  • Docker automatically pulls the correct architecture for your platform
  • Individual architecture tags (e.g., d9965c5-python-amd64) are also available if needed

@dependabot
chore(deps): bump pypdf from 6.7.2 to 6.7.4
755913d 
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.7.2 to 6.7.4.
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.7.2...6.7.4)

---
updated-dependencies:
- dependency-name: pypdf
  dependency-version: 6.7.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 2, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 2, 2026 •
edited
Loading

API breakage checks (Griffe)

Result: Failed

Log excerpt (first 1000 characters) 

============================================================
Checking openhands-sdk (openhands.sdk)
============================================================
Comparing openhands-sdk 1.11.5 against 1.11.4
::notice title=openhands-sdk API::Ignoring Field metadata-only change (non-breaking): load_public_skills
::notice title=openhands-sdk API::Ignoring Field metadata-only change (non-breaking): temperature
::warning file=openhands-sdk/openhands/sdk/llm/llm.py,line=196,title=LLM.top_p::Attribute value was changed: `Field(default=1.0, ge=0, le=1)` -> `Field(default=None, ge=0, le=1, description='Nucleus sampling parameter. Defaults to None (uses provider default). Set to a value between 0 and 1 to control diversity of outputs.')`
::error title=SemVer::Breaking changes detected (1); require at least minor version bump from 1.11.x, but new is 1.11.5

============================================================
Checking openhands-workspace (openhands.workspace)
============================

Action log

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 2, 2026 •
edited
Loading

Agent server REST API breakage checks (OpenAPI)

Result: Passed

Action log

@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 2, 2026 •
edited
Loading

Coverage

Coverage Report •
FileStmtsMissCoverMissing
TOTAL20065544072% 
report-only-changed-files is enabled. No files were changed during this commit :)

all-hands-bot
all-hands-bot approved these changes Mar 2, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@all-hands-bot all-hands-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Good taste - Straightforward security update.

This bumps pypdf from 6.7.2 → 6.7.4, picking up security fixes for decompression limits (RunLengthDecode filter, XFA data) and robustness improvements for invalid PDF annotations. No behavior changes for valid PDFs, just defense against malformed ones.

VERDICT: ✅ LGTM - Approve and merge.

@aivong-openhands aivong-openhands merged commit 9f1e298 into main Mar 3, 2026
59 of 65 checks passed
@aivong-openhands aivong-openhands deleted the dependabot/uv/pypdf-6.7.4 branch March 3, 2026 00:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@all-hands-bot all-hands-bot all-hands-bot approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@all-hands-bot @aivong-openhands