Raise the pypdf floor and refresh the lock for open security alerts

utils/pdf opens caller-supplied PDFs, and every pypdf before 6.16.1 has
a malformed-file infinite loop or memory blow-up, so the pdf extra now
requires it. requirements.txt names pillow>=12.3.0 directly because the
dependency graph kept a Pillow 12.2.0 entry for that file from before
the je_auto_control floor. uv.lock picks up anyio 4.14.2, cryptography
50.0.1 and pypdf 6.19.0.

Author: JE-Chen

CHANGELOG.md

@@ -22,6 +22,25 @@ it shipped into a `## [x.y.z] - date` section of their own; the tag's
   generating values from the schema alone used to produce a plain string and
   get a `ValueError` out of `datetime.fromisoformat`.
 
+### Security
+
+- **The `pdf` extra now requires `pypdf>=6.16.1`** (was `>=4.0`).
+  `extract_pdf_text`, `pdf_metadata` and `assert_pdf_text` open whatever PDF
+  they are given, and every pypdf before 6.16.1 can be driven into an
+  infinite loop or unbounded memory by a malformed file (unterminated inline
+  images, repeated bad cross-reference entries, large `/ToUnicode` streams or
+  CID width ranges, `TreeObject.insert_child`, outlines, XForm objects).
+  Migration: `pip install -U "je_auto_control[pdf]"`.
+- **`requirements.txt` states `pillow>=12.3.0` directly.** It already
+  resolved 12.3.0 through the `je_auto_control>=0.0.216` floor; the direct
+  line is for the dependency graph, which still reported Pillow 12.2.0 for
+  this file from before that floor existed.
+- **`uv.lock` moves anyio 4.13.0 → 4.14.2, cryptography 49.0.0 → 50.0.1 and
+  pypdf 6.13.3 → 6.19.0.** anyio (through `starlette`, `[signaling]` extra)
+  fixes a TLS host-name encoding flaw that allowed certificate spoofing.
+  cryptography 50 fixes a PKCS#7 EnvelopedData decryption oracle; this
+  package does no PKCS#7 decryption, so the `>=48.0.1` floor is unchanged.
+
 ### Fixed
 
 - **On Windows the key name `down` pressed F17 instead of the Down arrow.**

docs/updates/2026-09.md

@@ -122,3 +122,10 @@ Index and query commands: [README.md](README.md). New entries go at the end.
 - **Downstream**: Jeffrey_RPA reads this tree through its editable install, so its override is stale at once. `Jeffrey_RPA/test/test_gui_control.py`: 588 passed, 1 failed — `test_every_library_name_override_is_still_needed`, the test built to go red when upstream is fixed; its message says to delete `down` from `_gui_control._LIBRARY_NAME_OVERRIDES`. Not changed from here: another session had uncommitted work in Jeffrey_RPA's progress and architecture files. The remaining half is root `progress.md` X-4.
 - **Files**: `je_auto_control/wrapper/_platform_windows.py`, `je_auto_control/windows/record/win32_input_hook.py`, `test/unit_test/headless/test_input_hook_wheel.py` (new), `test/unit_test/headless/test_win32_key_table.py` (new), `CHANGELOG.md`, `architecture_explore.md` (figures).
 - **Open items**: root `progress.md` X-4 (Jeffrey_RPA side).
+
+## U-20260922-16 · 2026-09-22 · Dependabot S-11: pypdf floor, direct pillow floor, lock refresh · #incident #security #deps
+
+- **What**: The AutoControlGUI half of root `progress.md` S-11: 26 open Dependabot alerts on `main` (1 critical, 13 high), checked one by one for reachability. Three groups. (1) **pypdf** (12 alerts, 2 high, all fixed by 6.16.1): malformed-PDF infinite loops and memory blow-ups; reachable, because `utils/pdf/pdf_reader.py` opens caller-supplied files. The `pdf` extra's floor goes `>=4.0` → `>=6.16.1`. (2) **Pillow in `requirements.txt`** (13 alerts, created 2026-07-21): the file has never listed Pillow; GitHub resolved the then-unbounded `je_auto_control` to 0.0.214 (pillow 12.2.0), and the floor added in `5958292` never replaced that recorded entry (the SBOM still lists pillow 12.2.0 as a direct dependency next to 12.3.0). Added `pillow>=12.3.0` as a direct line so the file's own entry is non-vulnerable. (3) **`uv.lock`**: anyio 4.13.0 → 4.14.2 (critical, TLS host-name encoding; pulled by `starlette`), cryptography 49.0.0 → 50.0.1 (high, PKCS#7 EnvelopedData decryption oracle — not reachable, the package does no PKCS#7 decryption, so the `>=48.0.1` floor stays), pypdf → 6.19.0; uv also moved pyopenssl 26.3.0 → 26.4.0 and the stale project entry 0.0.195 → 0.0.221.
+- **Result / numbers**: alerts close only once this reaches `main`. Tests selected by `pdf or arm64 or dependency or marker`: 40 passed, 3 skipped, with pypdf 6.19.0 installed. Windows arm64 re-probed the same day: `opencv-python` still has no win_arm64 wheel and `cryptography` still stops at 46.0.3, so that `Progress.md` item is unchanged.
+- **Files**: `pyproject.toml`, `requirements.txt`, `uv.lock`, `CHANGELOG.md`.
+- **Open items**: none here; the Dependabot PRs #478 (cryptography), #487 (pypdf) and #488 (anyio) are superseded by this change once it merges (root `progress.md` X-16).

docs/updates/README.md

@@ -58,6 +58,7 @@ In the same commit: delete the item from `Progress.md`, add a `#done` entry here
 
 | ID | Date | Title | Tags | Batch |
 |---|---|---|---|---|
+| U-20260922-16 | 2026-09-22 | Dependabot S-11: pypdf floor, direct pillow floor, lock refresh | #incident #security #deps | [2026-09](2026-09.md) |
 | U-20260922-15 | 2026-09-22 | Windows key table: `down` is VK_DOWN; touchpad wheel accumulates | #incident #input #recording | [2026-09](2026-09.md) |
 | U-20260922-14 | 2026-09-22 | Scheduler: never start a job that is still running | #incident #scheduler | [2026-09](2026-09.md) |
 | U-20260922-13 | 2026-09-22 | Remote desktop host/relay/viewer: per-run events on restart | #incident #remote-desktop | [2026-09](2026-09.md) |
@@ -104,7 +105,7 @@ In the same commit: delete the item from `Progress.md`, add a `#done` entry here
 
 | File | Period | Entries |
 |---|---|---:|
-| [2026-09.md](2026-09.md) | 2026-09 | 15 |
+| [2026-09.md](2026-09.md) | 2026-09 | 16 |
 | [2026-08-f.md](2026-08-f.md) | 2026-08 | 1 |
 | [2026-08-e.md](2026-08-e.md) | 2026-08 | 2 |
 | [2026-08-d.md](2026-08-d.md) | 2026-08 | 2 |

pyproject.toml

@@ -100,7 +100,10 @@ gui = ["PySide6==6.11.1", "qt-material==2.17"]
 webrtc = ["aiortc>=1.14.0", "av>=14.0.0"]
 signaling = ["fastapi>=0.115", "uvicorn>=0.32"]
 discovery = ["zeroconf>=0.130"]
-pdf = ["pypdf>=4.0"]
+# Security floor: utils/pdf opens PDFs the caller hands it, and every pypdf
+# before 6.16.1 has a malformed-file infinite loop or memory blow-up
+# (inline images, xref entries, /ToUnicode, CID widths, outlines, XForms).
+pdf = ["pypdf>=6.16.1"]
 office = ["openpyxl>=3.1", "python-docx>=1.1", "python-pptx>=0.6"]
 fuzzy = ["rapidfuzz>=3.0"]
 s3 = ["boto3>=1.34"]

requirements.txt

@@ -2,6 +2,10 @@
 # carries 13 CVEs fixed in 12.3.0. A floor keeps the dependency graph honest
 # without needing a bump here on every release.
 je_auto_control>=0.0.216
+# Stated directly as well: the dependency graph recorded Pillow for this file
+# when je_auto_control was still unbounded here, and the floor above never
+# replaced that entry. A direct requirement does.
+pillow>=12.3.0
 qt-material==2.17
 mss==10.2.0
 PySide6==6.11.1