fix cve (#3989)

fix critical cve for h11. supposedly 0.16.0 fixes it.

---------

Co-authored-by: Yao You <yao@unstructured.io>
Co-authored-by: Austin Walker <austin@unstructured.io>
Co-authored-by: ryannikolaidis <1208590+ryannikolaidis@users.noreply.github.com>
Co-authored-by: badGarnet <badGarnet@users.noreply.github.com>

Author: 4 people

CHANGELOG.md

@@ -1,4 +1,4 @@
-## 0.17.6-dev1
+## 0.17.6-dev2
 
 ### Enhancements
 
@@ -9,6 +9,8 @@
 Two executions of the same code, on the same file, produce different results. The order of the elements is random.
 This makes it impossible to write stable unit tests, for example, or to obtain reproducible results.
 - **Do not use NLP to determine element types for extracted elements with hi_res.** This avoids extraneous Title elements in hi_res outputs. This only applies to *extracted* elements, meaning text objects that are found outside of Object Detection objects which get mapped to *inferred* elements. (*extracted* and *inferred* elements get merged together to form the list of `Element`s returned by `pdf_partition()`)
+- Resolve open CVEs
+
 
 ## 0.17.5
 

requirements/base.txt

@@ -8,9 +8,9 @@ anyio==4.9.0
     # via httpx
 backoff==2.2.1
     # via -r ./base.in
-beautifulsoup4==4.13.3
+beautifulsoup4==4.13.4
     # via -r ./base.in
-certifi==2025.1.31
+certifi==2025.4.26
     # via
     #   httpcore
     #   httpx
@@ -42,11 +42,11 @@ exceptiongroup==1.2.2
     # via anyio
 filetype==1.2.0
     # via -r ./base.in
-h11==0.14.0
+h11==0.16.0
     # via httpcore
 html5lib==1.1
     # via -r ./base.in
-httpcore==1.0.7
+httpcore==1.0.9
     # via httpx
 httpx==0.28.1
     # via unstructured-client
@@ -62,13 +62,13 @@ jsonpath-python==1.0.6
     # via unstructured-client
 langdetect==1.0.9
     # via -r ./base.in
-lxml==5.3.1
+lxml==5.4.0
     # via -r ./base.in
 marshmallow==3.26.1
     # via
     #   dataclasses-json
     #   unstructured-client
-mypy-extensions==1.0.0
+mypy-extensions==1.1.0
     # via
     #   typing-inspect
     #   unstructured-client
@@ -80,9 +80,9 @@ numpy==2.0.2
     # via -r ./base.in
 olefile==0.47
     # via python-oxmsg
-orderly-set==5.3.0
+orderly-set==5.4.0
     # via deepdiff
-packaging==24.2
+packaging==25.0
     # via
     #   marshmallow
     #   unstructured-client
@@ -100,7 +100,7 @@ python-magic==0.4.27
     # via -r ./base.in
 python-oxmsg==0.0.2
     # via -r ./base.in
-rapidfuzz==3.12.2
+rapidfuzz==3.13.0
     # via -r ./base.in
 regex==2024.11.6
     # via nltk
@@ -119,13 +119,13 @@ six==1.17.0
     #   unstructured-client
 sniffio==1.3.1
     # via anyio
-soupsieve==2.6
+soupsieve==2.7
     # via beautifulsoup4
 tqdm==4.67.1
     # via
     #   -r ./base.in
     #   nltk
-typing-extensions==4.13.0
+typing-extensions==4.13.2
     # via
     #   -r ./base.in
     #   anyio

requirements/deps/constraints.txt

@@ -22,3 +22,5 @@ importlib-metadata>=8.5.0
 unstructured-client>=0.23.0,<0.26.0
 # paddle constrains protobuf; maybe we should put paddle here since its version is pinned in .in file
 protobuf>=6.30.0
+# (yao) issues with pdfminer-six above 20250416
+pdfminer.six<20250416

requirements/dev.txt

@@ -17,15 +17,15 @@ distlib==0.3.9
     # via virtualenv
 filelock==3.18.0
     # via virtualenv
-identify==2.6.9
+identify==2.6.10
     # via pre-commit
 importlib-metadata==8.6.1
     # via
     #   -c ././deps/constraints.txt
     #   build
 nodeenv==1.9.1
     # via pre-commit
-packaging==24.2
+packaging==25.0
     # via
     #   -c ./base.txt
     #   -c ./test.txt
@@ -49,7 +49,7 @@ tomli==2.2.1
     #   -c ./test.txt
     #   build
     #   pip-tools
-virtualenv==20.29.3
+virtualenv==20.30.0
     # via pre-commit
 wheel==0.45.1
     # via pip-tools

requirements/extra-docx.txt

@@ -4,13 +4,13 @@
 #
 #    pip-compile ./extra-docx.in
 #
-lxml==5.3.1
+lxml==5.4.0
     # via
     #   -c ./base.txt
     #   python-docx
 python-docx==1.1.2
     # via -r ./extra-docx.in
-typing-extensions==4.13.0
+typing-extensions==4.13.2
     # via
     #   -c ./base.txt
     #   python-docx

requirements/extra-markdown.txt

@@ -8,7 +8,7 @@ importlib-metadata==8.6.1
     # via
     #   -c ././deps/constraints.txt
     #   markdown
-markdown==3.7
+markdown==3.8
     # via -r ./extra-markdown.in
 zipp==3.21.0
     # via importlib-metadata

requirements/extra-odt.txt

@@ -4,15 +4,15 @@
 #
 #    pip-compile ./extra-odt.in
 #
-lxml==5.3.1
+lxml==5.4.0
     # via
     #   -c ./base.txt
     #   python-docx
 pypandoc==1.15
     # via -r ./extra-odt.in
 python-docx==1.1.2
     # via -r ./extra-odt.in
-typing-extensions==4.13.0
+typing-extensions==4.13.2
     # via
     #   -c ./base.txt
     #   python-docx

requirements/extra-paddleocr.txt

@@ -18,11 +18,11 @@ anyio==4.9.0
     #   httpx
 astor==0.8.1
     # via paddlepaddle
-beautifulsoup4==4.13.3
+beautifulsoup4==4.13.4
     # via
     #   -c ./base.txt
     #   unstructured-paddleocr
-certifi==2025.1.31
+certifi==2025.4.26
     # via
     #   -c ./base.txt
     #   httpcore
@@ -44,13 +44,13 @@ exceptiongroup==1.2.2
     #   anyio
 fire==0.7.0
     # via unstructured-paddleocr
-fonttools==4.56.0
+fonttools==4.57.0
     # via unstructured-paddleocr
-h11==0.14.0
+h11==0.16.0
     # via
     #   -c ./base.txt
     #   httpcore
-httpcore==1.0.7
+httpcore==1.0.9
     # via
     #   -c ./base.txt
     #   httpx
@@ -68,7 +68,7 @@ imageio==2.37.0
     # via scikit-image
 lazy-loader==0.4
     # via scikit-image
-lxml==5.3.1
+lxml==5.4.0
     # via
     #   -c ./base.txt
     #   python-docx
@@ -102,14 +102,14 @@ opencv-python-headless==4.11.0.86
     #   albumentations
 opt-einsum==3.3.0
     # via paddlepaddle
-packaging==24.2
+packaging==25.0
     # via
     #   -c ./base.txt
     #   lazy-loader
     #   scikit-image
 paddlepaddle==3.0.0
     # via -r ./extra-paddleocr.in
-pillow==11.1.0
+pillow==11.2.1
     # via
     #   imageio
     #   paddlepaddle
@@ -121,17 +121,17 @@ protobuf==6.30.2
     #   paddlepaddle
 pyclipper==1.3.0.post6
     # via unstructured-paddleocr
-pydantic==2.10.6
+pydantic==2.11.3
     # via albumentations
-pydantic-core==2.27.2
+pydantic-core==2.33.1
     # via pydantic
 python-docx==1.1.2
     # via unstructured-paddleocr
 pyyaml==6.0.2
     # via
     #   albumentations
     #   unstructured-paddleocr
-rapidfuzz==3.12.2
+rapidfuzz==3.13.0
     # via
     #   -c ./base.txt
     #   unstructured-paddleocr
@@ -153,21 +153,21 @@ sniffio==1.3.1
     # via
     #   -c ./base.txt
     #   anyio
-soupsieve==2.6
+soupsieve==2.7
     # via
     #   -c ./base.txt
     #   beautifulsoup4
-stringzilla==3.12.3
+stringzilla==3.12.5
     # via albucore
-termcolor==2.5.0
+termcolor==3.0.1
     # via fire
 tifffile==2024.8.30
     # via scikit-image
 tqdm==4.67.1
     # via
     #   -c ./base.txt
     #   unstructured-paddleocr
-typing-extensions==4.13.0
+typing-extensions==4.13.2
     # via
     #   -c ./base.txt
     #   albucore
@@ -178,6 +178,9 @@ typing-extensions==4.13.0
     #   pydantic
     #   pydantic-core
     #   python-docx
+    #   typing-inspection
+typing-inspection==0.4.0
+    # via pydantic
 unstructured-paddleocr==2.10.0
     # via -r ./extra-paddleocr.in
 urllib3==1.26.20