docs(deps): correct the advisory count on the pypdf floor - #76
Merged
Conversation
Dependabot's #75 raised the floor to 6.15.0 but left the comment reading "13 advisories", which was the count for the previous 6.14.2 floor. The two advisories that prompted the bump are not reflected: GHSA-fp3f-mc75-235c large memory usage for large /ToUnicode streams GHSA-fwg2-594c-jp42 long runtimes / large memory for large CID font widths That comment block exists to record what each floor actually covers, so a stale count there is worth a line. Comment only. No constraint or lock change: 6.15.0 already clears both, and there are now zero open Dependabot alerts.
kmadan
force-pushed
the
chore/pypdf-security-bump
branch
from
August 27, 2026 06:49
8ead378 to
2973be3
Compare
kmadan
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reduced to a one-line comment fix. Superseded in substance by #75.
When I opened this,
pypdfwas at>=6.14.2with two open advisories. Dependabot's #75 merged 13 minutes later and raised the floor to 6.15.0, which clears both — so the constraint and lock changes I had here were redundant and I've dropped them. There are now zero open Dependabot alerts.What remains is genuinely stale, though: #75 moved the floor but left the comment reading
# 13 advisories, which was the count for the old 6.14.2 floor. It doesn't reflect the two that prompted the bump:/ToUnicodestreamsThat block exists specifically to record what each floor covers, so an inaccurate count in it is worth correcting.
Comment only. No constraint change, no lock change, no behaviour change. Close it instead if you'd rather not carry a docs-only PR.