fix(deps): bump pypdf to 6.21.2 for CVE-2026-115572/115585/115580 by PetrefiedThunder · Pull Request #3550 · regengine/RegEngine

PetrefiedThunder · 2026-10-23T21:20:08Z

This bumps pypdf from 6.21.1 to 6.21.2 (the fixed version) in root requirements.lock. That version fixes CVE-2026-115572, CVE-2026-115585 and CVE-2026-115580, which pip-audit started reporting today and which fail 'Security Audit (compliance)' on every PR.

I regenerated the lockfile with the command in its header (pip-compile 7.6.2, Python 3.11): pip-compile --allow-unsafe --generate-hashes --upgrade-package pypdf==6.21.2 --output-file=requirements.lock requirements.in.
The diff is only the 3 pypdf lines. Both hashes match PyPI's sha256 values for the sdist and the wheel.
Running pip-audit 2.10.0 locally on requirements.lock with the workflow's existing ignore list reports no known vulnerabilities. This PR adds no --ignore-vuln entries.
Not changed: packages/factory-local/requirements.lock, a separate uv lock that still pins pypdf==6.21.1. The backend pip-audit doesn't scan it.

Note

Low Risk
Lockfile-only patch upgrade for known PDF-library CVEs; no application code changes.

Overview
Security dependency bump: pypdf in root requirements.lock moves from 6.21.1 to 6.21.2, with updated PyPI hashes. This addresses CVE-2026-115572, CVE-2026-115585, and CVE-2026-115580 so the compliance Security Audit (pip-audit) can pass again.

The lockfile was regenerated via pip-compile for that package only; there are no new vulnerability ignore entries. packages/factory-local/requirements.lock is unchanged and still pins 6.21.1.

^{Reviewed by Cursor Bugbot for commit 7818f30. Bugbot is set up for automated code reviews on this repo. Configure here.}

PetrefiedThunder · 2026-10-23T21:20:10Z

@codex please review at head 7818f30.

vercel · 2026-10-23T21:20:13Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
regengine	Ready	Preview	Oct 23, 2026 10:49pm UTC

chatgpt-codex-connector · 2026-10-23T21:21:13Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T21:22:06.118996Z	`7818f30`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cursor · 2026-10-23T21:21:13Z

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: b5850826-ad2a-4b72-9bc8-ec4cb573581b)

coderabbitai · 2026-10-23T21:21:16Z

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector · 2026-10-23T21:22:04Z

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: 7818f30e9c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

github-actions · 2026-10-23T21:26:05Z

PR Blocker Checklist

Head SHA: 1e9494061cf1c7e8c066a8ca001843171e3d3060

Status: Ready

All review threads resolved
No reviews requesting changes
No blocked review engines

…3546 #3535) (#3552) * fix(epcis-export): return honest empty state instead of sample data Remove SAMPLE_EPCIS_EVENTS and the hardcoded FDA sample CSV. Tenants with no rows now get an empty eventList / header-only CSV, count 0, dataSource 'empty' and a 'No data yet' message. Tests are data-free. Drop the now-stale detect-secrets baseline entries for the sample hashes. Signed-off-by: Christopher Sellers <1@christophersellers.com> * fix(frontend): restore main build after SEL-410/SEL-414 ErrorState collision #3475 and #3479 merged back to back and both defined ErrorState. The surviving component lacked requestId/retrying used by #3479 callers, a test mock had a duplicate useQAHealth key, and suppliers/page.tsx used NO_DATA_YET without importing it. Vercel production builds for 03903ee and e7ee4a7 failed type check; prod is still on c7874cb. - ErrorState: optional requestId line, retrying disables Retry and shows Retrying..., support link, className kept on root - drop duplicate useQAHealth mock key - import NO_DATA_YET in suppliers page * test(epcis): drop SAMPLE_EPCIS_EVENTS patches; data-free empty-state and header-only FDA CSV assertions * ci: fix required gates on #3524 (pin copy-lint actions, inventory new workflows, allowlist false-positive secret, declare visual/capabilities knip entries) * chore(secrets): refresh .secrets.baseline (detect-secrets 1.5.0) * test(ingestion): make #2868 error-logging tests data-free to fix collection test_ingest_error_logging_2868.py imported _FakePersistence, _FakeSession, _client and _make_shipping_event from test_webhook_router_v2_1342.py, which the real-data-only cleanup removed, so collection failed on main. Drop the ingest-batch route cases that needed a fabricated event, test _failure_diagnostics directly with no payload, and keep the chain-verify case using MagicMock and a local app builder. Remove the stale detect-secrets baseline entry. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * fix(ci): scope suppliers no-data test; match uses: as YAML key in supply-chain checker * test(ingestion): restore data-free ingest_batch_failed route coverage for #2868 Mint TENANT_ID and KEY_ID with uuid4 at runtime. Re-add a POST /api/v1/webhooks/ingest failure test that uses caplog to check the traceback, tenant_id, event_count, source, error_type and correlation_id, and that the uuid4 canary lot code, product text and location never reach the log. A MagicMock persistence store raises to reach the handler's except block. Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * fix(frontend): show QA-signal loading row on dashboard; align qa-health test with ErrorState copy * fix(tenant): update route manifest expectations for two new tenant-scoped routes * ci: list 9 missing workflows in inventory; stop action-pin matching 'statuses:' permissions * ci(frontend): allowlist visual regression files in Knip unused file guard * test(ingestion): fix-forward email_ingest principal stub and sel409 admin DB env Signed-off-by: Christopher Sellers <1@christophersellers.com> * fix(deps): bump pypdf to 6.21.2 for CVE-2026-115572/115585/115580 * test(ingestion): fix suite A collection (2868 persistence import) and drop SAMPLE_EPCIS_EVENTS expectations Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com> * fix(ci): stop Head SHA Check Guard failing main on check_suite/workflow_run events Those events run in the default-branch context, so failed PR verdicts were attributed to main. Keep the failure commit status on the PR head SHA; only fail the job for pull_request events. * ci: clear detect-secrets false positive in vercel-preview-guard * test(ingestion): make 944/945 envelope test data-free after #3500 fixture removal * ci: refresh .secrets.baseline line numbers (detect-secrets 1.5.0, no new findings) * test(ingestion): capture ingest_batch_failed via dedicated logger; bump factory-local pypdf floor * ci: refresh .secrets.baseline after test change (drop stale entry) * fix: address CodeRabbit review on #3552 (checkout creds, retry a11y name, EDI envelope literals, duplicate test name) --------- Signed-off-by: Christopher Sellers <1@christophersellers.com> Signed-off-by: Christopher <131207452+PetrefiedThunder@users.noreply.github.com>

github-actions · 2026-10-23T22:46:20Z

Branch updated with main

Main was merged into gemini/pypdf-cve-bump at the new head (7818f30e9c06b516929662db692a62abbe617ddd).

Because merge commits created with GITHUB_TOKEN do not trigger workflows, a push to this branch or a manual CI re-run is needed for checks to run on it.

Last synced: 2026-10-23T22:46:19.914Z

PetrefiedThunder · 2026-10-23T23:07:16Z

Superseded by #3552 (squash 658bc7f). This PR was folded into #3552, and its current head (a merge of main) has a zero-file diff against main 658bc7f, so all of these changes are on main.

fix(deps): bump pypdf to 6.21.2 for CVE-2026-115572/115585/115580

7818f30

vercel Bot had a problem deploying to Preview October 23, 2026 21:21 Failure

github-actions Bot added the dependencies Pull requests that update a dependency file label Oct 23, 2026

PetrefiedThunder mentioned this pull request Oct 23, 2026

ci: combined main-unblock base (#3524 #3525 #3528 #3529 #3548 #3550 #3546 #3535) #3552

Merged

Merge branch 'main' into gemini/pypdf-cve-bump

1e94940

vercel Bot deployed to Preview October 23, 2026 22:49

View deployment

PetrefiedThunder closed this Oct 23, 2026

Navigation Menu

Repository navigation

fix(deps): bump pypdf to 6.21.2 for CVE-2026-115572/115585/115580 - #3550

fix(deps): bump pypdf to 6.21.2 for CVE-2026-115572/115585/115580#3550
PetrefiedThunder wants to merge 2 commits into
mainfrom
gemini/pypdf-cve-bump

PetrefiedThunder commented Oct 23, 2026 •

edited by cursor Bot

Loading

Uh oh!

PetrefiedThunder commented Oct 23, 2026

Uh oh!

vercel Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Oct 23, 2026

Uh oh!

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

PetrefiedThunder commented Oct 23, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

PetrefiedThunder commented Oct 23, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

PetrefiedThunder commented Oct 23, 2026

Uh oh!

vercel Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

cursor Bot commented Oct 23, 2026

Bugbot couldn't run - usage limit reached

Uh oh!

coderabbitai Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Blocker Checklist

Status: Ready

Uh oh!

github-actions Bot commented Oct 23, 2026

Branch updated with main

Uh oh!

PetrefiedThunder commented Oct 23, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

PetrefiedThunder commented Oct 23, 2026 •

edited by cursor Bot

Loading

vercel Bot commented Oct 23, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 23, 2026 •

edited

Loading

coderabbitai Bot commented Oct 23, 2026 •

edited

Loading

github-actions Bot commented Oct 23, 2026 •

edited

Loading