Security fixes for August 2025

[mikahanninen]

Changelog (Unreleased)

Highlights

• Security hardening across CI (CodeQL) and automated updates via Dependabot
• Packaging modernization: migrate from Poetry lockfiles to uv with dependency refresh
• Compatibility updates for OpenAI API; PDF library upgrades; stability and test fixes

Security

• Added Dependabot configuration for automated dependency updates (.github/dependabot.yml).
• Improved CodeQL analysis workflow (.github/workflows/codeql-analysis.yml).
• Bumped h11 to >=0.16.0 in the root pyproject.toml.

Packaging and Tooling

• Migrated from Poetry lockfiles to uv:
  • Removed poetry.lock files; added uv.lock in the repo root and per package.
  • Updated multiple pyproject.toml files to align with uv and refreshed versions.
• Updated and consolidated GitHub Actions workflows:
  • assistant.yaml, aws.yaml, core.yaml, docs.yaml, google.yaml, hubspot.yaml, main.yaml, openai.yaml, pdf.yaml, pip.yaml, recognition.yaml, release.yaml, windows.yaml.

Library Updates

• OpenAI:
  • Updated library for the latest API (openai>=1.0.0); tests adjusted.
• PDF:
  • Upgraded dependencies to address stability/security:
    • pypdf >= 6.0.0
    • fpdf2 >= 2.8.4
    • pdfminer.six == 20250506
  • Fixed IntelliSense issue and refreshed tests.
• Windows (core):
  • Improvements across elements, locators, helpers, inspect, window, and context.
• Google:
  • Updates to Drive keywords and authentication script.
• HubSpot:
  • Test fixes and minor library adjustments.
• Main/Twitter:
  • Minor updates in packages/main/src/RPA/Twitter.py.
• Core:
  • Adjustments in notebook.py and Windows internals.

Tests

• Robot test updates and fixes across suites:
  • test_clipboard.robot, test_crypto_cli.robot, test_excel.robot, test_robocorp_workitems.robot, test_tables.robot.
• Additional targeted test fixes for HubSpot, PDF, and OpenAI.

Misc

• Root pyproject.toml and uv.lock updated for new dependency resolution.

References:

• PR #1228

[lehtera]

Could we accommodate an update for pypdf into this PR?
Updating pypdf -> 6.0.0

References:
CVE-2025-55197
Release 6.0.0

Description
pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requires just reading the file if a series of FlateDecode filters is used on a malicious cross-reference stream. Other content streams are affected on explicit access. This issue has been fixed in 6.0.0. If an update is not possible, a workaround involves including the fixed code from pypdf.filters.decompress into the existing filters file.

[mikahanninen]

Yes, the pypdf upgrade is also in the plans.

[lehtera]

Also there is minor security fix in fpdf2 2.8.4 that closes
"minor regular-expression optimization in the SVG parsing module, nullifying any risk of ReDOS attack"

References:
Release 2.8.4

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.