Bump pypdf floor past six DoS advisories

[ayushcodes10]

pypdf 6.13.3 (the version uv.lock pinned) carries six known advisories,
every one an unbounded-CPU or unbounded-memory bug in PDF text
extraction -- exactly and only what graphify uses pypdf for, via
extract_pdf_text() in detect.py. Two are infinite loops that the
existing 50 MiB size cap and broad except Exception do not catch: the
cap only rejects large files on disk, but these are amplification bugs
where a small, well-formed-looking PDF triggers the runaway behavior,
and a hang never raises to be caught.

Raise the floor to >=6.15.0 (the highest "fixed in" version across all
six advisories) in both the pdf and all extras, and refresh uv.lock,
which resolves to the current latest (6.16.1, zero known advisories).

Fixes #2658.

[graphify-labs]

Graphify reviewed this change.

Worth a look — the grounded gate found no coupling regressions or blocking issues, but 1 advisory finding(s) below merit a look before merge.

---

Graphify review — findings

This PR bumps the minimum pypdf version constraint from >=6.12.0 to >=6.15.0 for both the pdf and all optional dependency extras in pyproject.toml, adding a comment citing six DoS advisories as the motivation. The uv.lock file is regenerated to reflect this change, which also includes incidental churn to resolution markers and transitive dependency markers for various packages (e.g., numpy, contourpy, gensim, graspologic). The surface area is limited to dependency metadata and lockfile updates; no application source code is modified.

Worth a look

• all extra now rejects previously supported pypdf 6.12–6.14 — pyproject.toml:95 · Escalate · medium
  • agreed by 2 of 2 members but NOT verified (no proof, no reproducing execution) — consensus is not a verdict; needs human review Execution auto-disposal is off for this run; enable it (with sandbox isolation) to have Graphify try to confirm or refute this automatically.

Analysis details — impact, health, verification

Impact & health

Graphify review

Impact — 1 function depends on the 1 function this change touches.

Health — grade A; no new coupling hotspots.

Verification — 1 function in the blast radius was not formally verified this run (proofs are advisory here).

Gate & verification

graphify gate

PASS — objectively clean (no health regressions, tests not run — proofs not run this pass (advisory)). Grounded, not self-assessed.

Advisory (not blocking):

• verification_scope: 1 function(s) in the blast radius were not formally verified this run

[ayushcodes10]

Re: "all extra now rejects previously supported pypdf 6.12–6.14" — this is the intended effect of the fix, not a regression. 6.12–6.14 are exactly the vulnerable range the six advisories in the issue affect; raising the floor to >=6.15.0 is what excludes them.

Compatibility-wise, graphify's only pypdf surface is PdfReader(path) → .pages → page.extract_text() (detect.py:540-554), the most basic and stable part of pypdf's public API — unchanged across 6.x. I also ran the full test suite with pypdf 6.16.1 actually installed (not just the version bump on paper): 4314 passed, 0 failed, including tests/test_office_limits.py and tests/test_image_vision.py, both of which exercise extract_pdf_text() directly. pip-audit confirms zero pypdf advisories remain after the bump.