Fix security vulnerabilities in pypdf, urllib3, and wrapt (#1314)

mikahanninen · claude · web-flow · commit 475f484952ce · 2026-02-02T14:22:00.000+02:00
* fix security vulnerabilities in pypdf, urllib3, and wrapt deps

- pypdf: bump minimum to &gt;=6.6.2 (fixes infinite loop, decompression
  bomb, and malformed startxref CVEs)
- urllib3: remove &lt;=1.26.20 upper bound to allow 2.6.3+ on Python 3.10+
  (fixes decompression bomb bypass and unbounded decompression chain CVEs)
- wrapt: remove &lt;2.0.0 upper bound (not directly imported, avoids
  unnecessary resolver conflicts)
- Update lock files for pdf, aws, and main packages

Co-Authored-By: Claude Opus 4.5 &lt;noreply@anthropic.com&gt;

* bump versions: pdf 10.0.2, aws 7.0.2, main 31.1.1

Co-Authored-By: Claude Opus 4.5 &lt;noreply@anthropic.com&gt;

* fix CI: replace macos-13 runners and remove pip upper bound

- Replace macos-13 with macos-latest in all 12 workflow files
  (macos-13 runners are being deprecated by GitHub)
- Remove pip&lt;26.0 upper bound from invocations/requirements.txt
  (pip 26.0 is pre-installed on Windows runners, and the &lt;26.0
  constraint causes a self-downgrade failure)

Co-Authored-By: Claude Opus 4.5 &lt;noreply@anthropic.com&gt;

* fix checkbox test for pypdf 6.6.2 name serialization change

pypdf 6.6.2 serializes checkbox NameObject values with quotes
(/'Yes' instead of /Yes). Add the new format to accepted values.

Co-Authored-By: Claude Opus 4.5 &lt;noreply@anthropic.com&gt;

---------

Co-authored-by: Claude Opus 4.5 &lt;noreply@anthropic.com&gt;
diff --git a/.github/workflows/assistant.yaml b/.github/workflows/assistant.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/aws.yaml b/.github/workflows/aws.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     steps:
     - uses: actions/checkout@v5
diff --git a/.github/workflows/core.yaml b/.github/workflows/core.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/google.yaml b/.github/workflows/google.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/hubspot.yaml b/.github/workflows/hubspot.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
@@ -59,13 +59,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       SETUPTOOLS_USE_DISTUTILS: stdlib
diff --git a/.github/workflows/openai.yaml b/.github/workflows/openai.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/pdf.yaml b/.github/workflows/pdf.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/pip.yaml b/.github/workflows/pip.yaml
@@ -29,7 +29,7 @@ jobs:
         # adding macos and windows to the matrix adds a bunch of running and delay because of mac and windows
         # runners being slower to allocate
         include:
-          - os: macos-13
+          - os: macos-latest
             python-version: "3.10.16"
             pip-version: "24.2"
           - os: windows-latest
diff --git a/.github/workflows/recognition.yaml b/.github/workflows/recognition.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/sema4ai.yaml b/.github/workflows/sema4ai.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py312"
             python: "3.12"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/.github/workflows/windows.yaml b/.github/workflows/windows.yaml
@@ -58,13 +58,13 @@ jobs:
             os: ubuntu-latest
           - name: "macos-py39"
             python: "3.9"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py310"
             python: "3.10"
-            os: macos-13
+            os: macos-latest
           - name: "macos-py311"
             python: "3.11"
-            os: macos-13
+            os: macos-latest
 
     env:
       INVOKE_IS_CI_CD: 1
diff --git a/invocations/requirements.txt b/invocations/requirements.txt
@@ -1,6 +1,6 @@
 setuptools>=69.0.2
 invoke~=2.2.0
-pip>=23.3.1,<26.0
+pip>=23.3.1
 poetry~=2.1.1
 keyring>=25.1.0,<26.0.0
 toml~=0.10.2
diff --git a/packages/aws/pyproject.toml b/packages/aws/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "rpaframework-aws"
-version = "7.0.1"
+version = "7.0.2"
 description = "AWS library for RPA Framework"
 authors = [{name = "RPA Framework", email = "rpafw@robocorp.com"}]
 license = {text = "Apache-2.0"}
@@ -29,7 +29,7 @@ dependencies = [
 	"robotframework-pythonlibcore >=4.2.0",
 	"boto3 >=1.41.2",
 	"amazon-textract-response-parser >=0.1.33",
-	"urllib3 >=1.25.4, <=1.26.20",
+	"urllib3 >=1.25.4",
 ]
 
 [project.urls]
diff --git a/packages/aws/uv.lock b/packages/aws/uv.lock
diff --git a/packages/main/pyproject.toml b/packages/main/pyproject.toml
diff --git a/packages/main/uv.lock b/packages/main/uv.lock
diff --git a/packages/pdf/pyproject.toml b/packages/pdf/pyproject.toml
diff --git a/packages/pdf/tests/python/test_model.py b/packages/pdf/tests/python/test_model.py
diff --git a/packages/pdf/uv.lock b/packages/pdf/uv.lock
