-
chore(deps): bring every manager up to date
frostbyte_neo 发布于
2026-09-01 05:28:11 +00:00 Java (java/pom.xml):
- verapdf 1.31.160 -> 1.31.169. One property, five artifacts, because
the released validation pom this project imports as a BOM pins the
modules beneath it: validation-model, wcag-validation and
metadata-fixer to 1.31.169, parser 1.31.48 -> 1.31.51, core and
verapdf-xmp-core 1.31.35 -> 1.31.37 - okhttp 5.4.0 -> 5.5.0
- jackson-databind 2.22.1 -> 2.22.2. jackson-annotations stays at 2.22,
its own release line, where no 2.22.2 exists - junit-jupiter 6.1.2 -> 6.1.3
- pdfbox stays at 3.0.4, the version wcag-algorithms asks for
The comments in are cut down to what prevents a mistake.
The entry-point and security-floor notes go entirely: they said not to
go below a version, which guides nothing when the policy is to pin the
latest and only move forward. What is left is three two-line notes on
the pins that are not obvious — a range that needs freezing, a version
line that does not track its sibling, and one that has to move in step
with veraPDF.Node: 9 devDependencies. commander, the only runtime dependency, is
unchanged. Manifest moves with the lockfile because reverting it alone
fails pnpm install --frozen-lockfile, which is what CI runs.Python: 45 transitive packages in opendataloader-pdf and 22 in
opendataloader-pdf-mcp, lockfiles only. Held back so the tier-3 set does
not move here: docling and its family, since 2.124.0 pulls docling-parse
across two majors; transformers, safetensors, accelerate,
huggingface-hub, rapidocr, imageio, pypdfium2, which reach the extracted
text; opencv-python 4.13 -> 5.0.0, rpds-py and pywin32, all major.The docling floor also moves >=2.91.0 -> >=2.94.0. Everything below
2.94.0 carries CVE-2026-47214, unsafe URI and path handling in the HTML
backend. The lockfile already pinned 2.94.0, so a resolved install was
not exposed, but a fresh resolution could have been — which is also why
no alert fired.Examples: opendataloader-pdf floor >=2.2.1 -> >=2.5.6.
Verified: 641 tests; samples/pdf byte-identical in both -f json (20/20)
and -f pdf (20/20); pnpm --frozen-lockfile, build and 33 tests;
uv lock --check on both packages; clean-venv install of both examples.下载附件
- verapdf 1.31.160 -> 1.31.169. One property, five artifacts, because