fix(deps): update dependency pypdf to v6.13.3 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pypdf (changelog)	==6.13.0 → ==6.13.3

---

pypdf: Missing stream length values ignore defined limits

GHSA-jm82-fx9c-mx94

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value.

Patches

This has been fixed in pypdf==6.13.3.

Workarounds

If you cannot upgrade yet, consider applying the changes from PR #​3871.

Severity

• CVSS Score: 6.9 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-jm82-fx9c-mx94
• https://github.com/py-pdf/pypdf/pull/3871
• https://github.com/py-pdf/pypdf/releases/tag/6.13.3
• https://github.com/advisories/GHSA-jm82-fx9c-mx94

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

py-pdf/pypdf (pypdf)

v6.13.3

Compare Source

Security (SEC)

• Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#​3871)

Performance Improvements (PI)

• Avoid per-pixel getpixel loop for 1-bit indexed images (#​3854)

Robustness (ROB)

• Several fixes

Maintenance (MAINT)

• Make mypy assert messages consistent (#​3849)

Full Changelog

v6.13.2

Compare Source

Security (SEC)

• Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#​3847)

Robustness (ROB)

• Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#​3841)
• Raise PdfStreamError on non-hexadecimal bytes in hex readers (#​3832)

Full Changelog

v6.13.1

Compare Source

Security (SEC)

• Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#​3847)

Robustness (ROB)

• Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#​3841)
• Raise PdfStreamError on non-hexadecimal bytes in hex readers (#​3832)

Full Changelog

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: services/aimer-web/uv.lock

Command failed: uv lock --upgrade-package pypdf
Using CPython 3.13.14 interpreter at: /opt/containerbase/tools/python/3.13.14/bin/python3
  × No solution found when resolving dependencies:
  ╰─▶ Because only openrag<=0.5.0 is available and openrag==0.5.0 depends
      on litellm==1.83.14, we can conclude that openrag>=0.5.0 depends on
      litellm==1.83.14.
      And because your project depends on litellm==1.84.0 and openrag>=0.5.0,
      we can conclude that your project's requirements are unsatisfiable.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (c086ffc)	720	517	71.81%
Head commit (a70c4e4)	720 (+0)	517 (+0)	71.81% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#974)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}