resolve CVEs and HF issue (#4009)

update reqs to resolve CVEs and add the HF ENV to stop it from reaching
out

updated the Dockerfile with
ENV HF_HUB_OFFLINE=1

to stop it from pinging HF. This was an issue for a gov customer. and
updated requirements to resolve some open CVEs

---------

Co-authored-by: cragwolfe <[email protected]>
Co-authored-by: ryannikolaidis <[email protected]>
Co-authored-by: luke-kucing <[email protected]>

Author: 3 people

CHANGELOG.md

@@ -1,3 +1,12 @@
+## 0.17.7
+
+### Enhancements
+- **Updated Docker file with ENV HF_HUB_OFFLINE=1 to prevent the contianer from trying to access the internet
+
+### Features
+
+### Fixes
+
 ## 0.17.7-dev0
 
 ### Enhancements

Dockerfile

@@ -31,4 +31,6 @@ RUN find requirements/ -type f -name "*.txt" ! -name "test.txt" ! -name "dev.txt
     $PYTHON -c "from unstructured.partition.model_init import initialize; initialize()" && \
     $PYTHON -c "from unstructured_inference.models.tables import UnstructuredTableTransformerModel; model = UnstructuredTableTransformerModel(); model.initialize('microsoft/table-transformer-structure-recognition')"
 
+ENV HF_HUB_OFFLINE=1
+
 CMD ["/bin/bash"]

requirements/base.txt

@@ -20,25 +20,25 @@ cffi==1.17.1
     # via cryptography
 chardet==5.2.0
     # via -r ./base.in
-charset-normalizer==3.4.1
+charset-normalizer==3.4.2
     # via
     #   requests
     #   unstructured-client
 click==8.1.8
     # via
     #   nltk
     #   python-oxmsg
-cryptography==44.0.2
+cryptography==45.0.3
     # via unstructured-client
 dataclasses-json==0.6.7
     # via
     #   -r ./base.in
     #   unstructured-client
-deepdiff==8.4.2
+deepdiff==8.5.0
     # via unstructured-client
 emoji==2.14.1
     # via -r ./base.in
-exceptiongroup==1.2.2
+exceptiongroup==1.3.0
     # via anyio
 filetype==1.2.0
     # via -r ./base.in
@@ -56,7 +56,7 @@ idna==3.10
     #   httpx
     #   requests
     #   unstructured-client
-joblib==1.4.2
+joblib==1.5.1
     # via nltk
 jsonpath-python==1.0.6
     # via unstructured-client
@@ -80,7 +80,7 @@ numpy==2.0.2
     # via -r ./base.in
 olefile==0.47
     # via python-oxmsg
-orderly-set==5.4.0
+orderly-set==5.4.1
     # via deepdiff
 packaging==25.0
     # via
@@ -90,7 +90,7 @@ psutil==7.0.0
     # via -r ./base.in
 pycparser==2.22
     # via cffi
-pypdf==5.4.0
+pypdf==5.6.0
     # via unstructured-client
 python-dateutil==2.9.0.post0
     # via unstructured-client
@@ -125,11 +125,12 @@ tqdm==4.67.1
     # via
     #   -r ./base.in
     #   nltk
-typing-extensions==4.13.2
+typing-extensions==4.14.0
     # via
     #   -r ./base.in
     #   anyio
     #   beautifulsoup4
+    #   exceptiongroup
     #   pypdf
     #   python-oxmsg
     #   typing-inspect

requirements/dev.txt

@@ -17,9 +17,9 @@ distlib==0.3.9
     # via virtualenv
 filelock==3.18.0
     # via virtualenv
-identify==2.6.10
+identify==2.6.12
     # via pre-commit
-importlib-metadata==8.6.1
+importlib-metadata==8.7.0
     # via
     #   -c ././deps/constraints.txt
     #   build
@@ -32,7 +32,7 @@ packaging==25.0
     #   build
 pip-tools==7.4.1
     # via -r ./dev.in
-platformdirs==4.3.7
+platformdirs==4.3.8
     # via
     #   -c ./test.txt
     #   virtualenv
@@ -49,11 +49,11 @@ tomli==2.2.1
     #   -c ./test.txt
     #   build
     #   pip-tools
-virtualenv==20.30.0
+virtualenv==20.31.2
     # via pre-commit
 wheel==0.45.1
     # via pip-tools
-zipp==3.21.0
+zipp==3.22.0
     # via importlib-metadata
 
 # The following packages are considered to be unsafe in a requirements file:

requirements/extra-docx.txt

@@ -10,7 +10,7 @@ lxml==5.4.0
     #   python-docx
 python-docx==1.1.2
     # via -r ./extra-docx.in
-typing-extensions==4.13.2
+typing-extensions==4.14.0
     # via
     #   -c ./base.txt
     #   python-docx

requirements/extra-markdown.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile ./extra-markdown.in
 #
-importlib-metadata==8.6.1
+importlib-metadata==8.7.0
     # via
     #   -c ././deps/constraints.txt
     #   markdown
 markdown==3.8
     # via -r ./extra-markdown.in
-zipp==3.21.0
+zipp==3.22.0
     # via importlib-metadata

requirements/extra-odt.txt

@@ -12,7 +12,7 @@ pypandoc==1.15
     # via -r ./extra-odt.in
 python-docx==1.1.2
     # via -r ./extra-odt.in
-typing-extensions==4.13.2
+typing-extensions==4.14.0
     # via
     #   -c ./base.txt
     #   python-docx

requirements/extra-paddleocr.txt

@@ -4,11 +4,11 @@
 #
 #    pip-compile ./extra-paddleocr.in
 #
-albucore==0.0.23
+albucore==0.0.24
     # via
     #   albumentations
     #   unstructured-paddleocr
-albumentations==2.0.5
+albumentations==2.0.8
     # via unstructured-paddleocr
 annotated-types==0.7.0
     # via pydantic
@@ -28,23 +28,23 @@ certifi==2025.4.26
     #   httpcore
     #   httpx
     #   requests
-charset-normalizer==3.4.1
+charset-normalizer==3.4.2
     # via
     #   -c ./base.txt
     #   requests
-cython==3.0.12
+cython==3.1.1
     # via unstructured-paddleocr
 decorator==5.2.1
     # via paddlepaddle
 eval-type-backport==0.2.2
     # via albumentations
-exceptiongroup==1.2.2
+exceptiongroup==1.3.0
     # via
     #   -c ./base.txt
     #   anyio
 fire==0.7.0
     # via unstructured-paddleocr
-fonttools==4.57.0
+fonttools==4.58.1
     # via unstructured-paddleocr
 h11==0.16.0
     # via
@@ -115,15 +115,15 @@ pillow==11.2.1
     #   paddlepaddle
     #   scikit-image
     #   unstructured-paddleocr
-protobuf==6.30.2
+protobuf==6.31.1
     # via
     #   -c ././deps/constraints.txt
     #   paddlepaddle
 pyclipper==1.3.0.post6
     # via unstructured-paddleocr
-pydantic==2.11.3
+pydantic==2.11.5
     # via albumentations
-pydantic-core==2.33.1
+pydantic-core==2.33.2
     # via pydantic
 python-docx==1.1.2
     # via unstructured-paddleocr
@@ -147,7 +147,7 @@ scipy==1.13.1
     #   scikit-image
 shapely==2.0.7
     # via unstructured-paddleocr
-simsimd==6.2.1
+simsimd==6.4.7
     # via albucore
 sniffio==1.3.1
     # via
@@ -159,27 +159,28 @@ soupsieve==2.7
     #   beautifulsoup4
 stringzilla==3.12.5
     # via albucore
-termcolor==3.0.1
+termcolor==3.1.0
     # via fire
 tifffile==2024.8.30
     # via scikit-image
 tqdm==4.67.1
     # via
     #   -c ./base.txt
     #   unstructured-paddleocr
-typing-extensions==4.13.2
+typing-extensions==4.14.0
     # via
     #   -c ./base.txt
     #   albucore
     #   albumentations
     #   anyio
     #   beautifulsoup4
+    #   exceptiongroup
     #   paddlepaddle
     #   pydantic
     #   pydantic-core
     #   python-docx
     #   typing-inspection
-typing-inspection==0.4.0
+typing-inspection==0.4.1
     # via pydantic
 unstructured-paddleocr==2.10.0
     # via -r ./extra-paddleocr.in