any2md 1.0.4__tar.gz → 1.0.6__tar.gz

{any2md-1.0.4 → any2md-1.0.6}/CHANGELOG.md

@@ -4,6 +4,126 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.0.6] — 2026-04-27
+
+Security hardening release. Closes 8 actionable findings from the
+2026-04-27 multi-tool audit (semgrep + trivy + gitleaks + bandit +
+pip-audit + manual review by the security-engineer agent + Opus 4.7).
+No public API changes; behavior unchanged for legitimate inputs.
+
+### Security
+
+- **F1 (HIGH)** SSRF: replaced `trafilatura.fetch_url` and the bare
+  `urllib.request.urlopen` paths with a new `any2md/_http.py` module
+  that does manual redirect walking with per-hop revalidation. Defends
+  against DNS-rebinding and redirect-based bypass of the IP-class
+  check. New `validate_url` rejects non-http(s) schemes and
+  private/loopback/link-local/reserved targets. 20 MB body cap, 3-hop
+  redirect cap, redirect-loop detection. Applied to `convert_url`,
+  `_http_last_modified`, and `arxiv_lookup`.
+- **F5 (MED)** `--meta` integrity: `content_hash`, `extracted_via`,
+  `source_file`, `lane`, `token_estimate`, `recommended_chunk_level`
+  are now **reserved** and silently filtered from `--meta` /
+  `--meta-file` / `.any2md.toml` overrides with a stderr `WARN` per
+  drop. Defense-in-depth filter also runs inside `frontmatter.compose`.
+- **F3 (MED)** TOML auto-discovery now stops at the first ancestor
+  containing `.git` / `pyproject.toml` / `setup.py` / `setup.cfg` /
+  `package.json` / `.any2md.toml.boundary`. New `--no-config` flag
+  fully disables discovery.
+- **F4 (MED)** DOCX zip-bomb: `_safe_zip_open` enforces a 1 MB cap on
+  the declared uncompressed size of `core.xml` and `app.xml` before
+  parsing. Oversized members raise `ValueError` → clean per-file FAIL.
+- **F-CVE (MED)** Dependency floors bumped: `lxml>=6.1.0,<7`
+  (CVE-2026-41066), `pillow>=12.2.0,<13` (CVE-2026-25990,
+  CVE-2026-40192), `urllib3>=2.6.3,<3` (CVE-2026-21441). All ranges
+  acquire upper bounds (compat envelope). `requirements.txt` becomes
+  a development/CI lockfile with exact pins.
+- **F6 (LOW)** Atomic writes: new `any2md.utils.atomic_write_text`
+  writes via `tempfile.mkstemp` + `os.replace`. Refuses to overwrite
+  a pre-existing symlink at the output path. Wired through
+  `pdf/docx/html/txt` converters; PDF image extraction adds a symlink
+  check before `pil_image.save`.
+- **F2 (LOW)** Control-char sanitizer strips C0/C1 controls (preserves
+  `\t`, `\n`) from captured Docling `msword_backend` warnings before
+  forwarding them to `collected_warnings()` and stderr. Defends
+  terminals from ANSI-escape spoofing.
+- **F11 (LOW)** PDF image-dir name now goes through `safe_dir_name`
+  (alphanumeric/`_`/`-` only). Closes a `Path.stem == ".."` corner
+  case that co-mingled images with markdown outputs.
+- **XXE defense-in-depth**: migrated `xml.etree.ElementTree` →
+  `defusedxml.ElementTree` in `docx.py` and `heuristics.py`. Stdlib
+  was already safe in Python 3.7+; this silences bandit B405/B314
+  permanently and protects against future stdlib regressions.
+
+### Added
+
+- New module `any2md/_http.py` (`validate_url`, `safe_fetch`).
+- New CLI flag `--no-config`.
+- New helpers `any2md.utils.atomic_write_text` and `safe_dir_name`.
+- New runtime dependency: `defusedxml>=0.7.1,<1`.
+
+### Tests
+
+- 7 new unit-test files (40 new tests): `test_http_safe.py`,
+  `test_meta_reserved_keys.py`, `test_config_walkup.py`,
+  `test_zipbomb_guard.py`, `test_atomic_write.py`,
+  `test_safe_dir_name.py`, `test_log_sanitizer.py`.
+- Existing 290 tests continue to pass.
+- Bandit audit went from **9 findings** (3 medium, 6 low) to **1 low**
+  (legitimate `try/except/pass` in arxiv `_warn`).
+- 5-DOCX regression run reproduces v1.0.5 word counts exactly
+  (978/6726/15566/7811/1477).
+
+### Audit summary
+
+| ID | Title | Severity |
+|----|-------|----------|
+| F1 | SSRF: DNS rebind + redirect bypass | High |
+| F5 | `--meta` clobbers reserved frontmatter | Medium |
+| F3 | TOML discovery walks above project root | Medium |
+| F4 | DOCX zip-bomb amplification | Medium |
+| F-CVE | Transitive deps with known CVEs | Medium |
+| F6 | Symlink-following on output writes | Low |
+| F2 | Control-char passthrough in Docling logs | Low |
+| F11 | PDF stem `..` corner case | Low |
+
+## [1.0.5] — 2026-04-27
+
+Patch release. Recovers DOCX content that Docling's msword backend
+silently drops on malformed list structures, by auto-retrying
+affected files through the mammoth lane and forwarding the
+captured Docling warnings into any2md's run-level warning bucket.
+Real-world impact observed during validation: a 12,740-word
+Docling output for a policy-template DOCX recovered to 15,566
+words (+22%) when re-rendered via mammoth.
+
+### Added
+- DOCX converter now auto-retries files through the mammoth lane
+  when Docling emits any warning from
+  `docling.backend.msword_backend` during conversion. Docling's
+  DOCX backend silently drops list items in a known
+  malformed-input path (`msword_backend.py:1377/1675` —
+  "Parent element of the list item is not a ListGroup. The list
+  item will be ignored."), so a warning means the Docling
+  Markdown is missing content. On fallback, `extracted_via` is
+  set to `"docling→mammoth (warning fallback)"`, the lane
+  switches to `text`, the captured Docling warnings are
+  forwarded into the run-level warning bucket (so `--strict`
+  still fails), and a `FALLBACK:` line is printed to stderr.
+  Default: enabled. Disable with `--no-docx-fallback-on-warn`
+  (e.g. when comparing backends explicitly).
+- New `PipelineOptions.docx_fallback_on_warn: bool = True`.
+- New CLI flag pair `--docx-fallback-on-warn` /
+  `--no-docx-fallback-on-warn`.
+
+### Tests
+- New `tests/integration/test_docx_fallback_on_warn.py` covers
+  the warning-capture context manager, the default-on fallback
+  path (output swap, `extracted_via`, captured warning forwarded
+  into `collected_warnings()`, user-visible message), the
+  `--no-docx-fallback-on-warn` opt-out, the no-warning
+  fast-path, and the explicit `--backend docling` interaction.
+
 ## [1.0.4] — 2026-04-26
 
 Patch release. Two follow-ups deferred from v1.0.3 (#17): the T7

{any2md-1.0.4 → any2md-1.0.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: any2md
-Version: 1.0.4
+Version: 1.0.6
 Summary: Convert PDF, DOCX, HTML, and TXT files — or web pages by URL — to clean, LLM-optimized Markdown with YAML frontmatter.
 Project-URL: Homepage, https://github.com/rocklambros/any2md
 Project-URL: Issues, https://github.com/rocklambros/any2md/issues
@@ -12,13 +12,16 @@ Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: Text Processing :: Markup :: Markdown
 Requires-Python: >=3.10
-Requires-Dist: beautifulsoup4>=4.12.0
-Requires-Dist: lxml>=5.0.0
-Requires-Dist: mammoth>=1.6.0
-Requires-Dist: markdownify>=0.13.0
-Requires-Dist: pymupdf4llm>=0.0.17
-Requires-Dist: pymupdf>=1.24.0
-Requires-Dist: trafilatura>=1.12.0
+Requires-Dist: beautifulsoup4<5,>=4.12.0
+Requires-Dist: defusedxml<1,>=0.7.1
+Requires-Dist: lxml<7,>=6.1.0
+Requires-Dist: mammoth<2,>=1.6.0
+Requires-Dist: markdownify<2,>=0.13.0
+Requires-Dist: pillow<13,>=12.2.0
+Requires-Dist: pymupdf4llm<1,>=0.0.17
+Requires-Dist: pymupdf<2,>=1.24.0
+Requires-Dist: trafilatura<3,>=1.12.0
+Requires-Dist: urllib3<3,>=2.6.3
 Provides-Extra: dev
 Requires-Dist: pytest-snapshot>=0.9.0; extra == 'dev'
 Requires-Dist: pytest>=8.0.0; extra == 'dev'

{any2md-1.0.4 → any2md-1.0.6}/any2md/__init__.py

@@ -1,3 +1,3 @@
 """Convert PDF, DOCX, HTML, and TXT files to LLM-optimized Markdown."""
 
-__version__ = "1.0.4"
+__version__ = "1.0.6"

any2md-1.0.6/any2md/_http.py

@@ -0,0 +1,106 @@
+"""SSRF-safe HTTP fetching utilities for any2md.
+
+Centralizes URL scheme + IP validation and provides a fetcher that
+walks redirects manually and revalidates the host on each hop. This
+defends against:
+  - DNS rebinding (host -> public IP for validator, private IP for fetch)
+  - Redirect-based SSRF (public landing page -> 302 to 169.254.169.254)
+  - Non-http(s) schemes (file://, gopher://, etc.)
+  - Decompression / huge-response DoS (response-size cap)
+"""
+
+from __future__ import annotations
+
+import ipaddress
+import socket
+import urllib.error
+import urllib.parse
+import urllib.request
+
+_MAX_REDIRECT_HOPS = 3
+_FETCH_TIMEOUT = 15  # seconds
+_MAX_RESPONSE_BYTES = 20 * 1024 * 1024  # 20 MB cap on body read
+_USER_AGENT = "any2md/1.0.6"
+
+
+def validate_url(url: str) -> str | None:
+    """Validate URL scheme + host. Returns an error message or None.
+
+    One-shot DNS lookup; rebind protection requires re-checking on
+    every redirect hop (handled by ``safe_fetch``).
+    """
+    parsed = urllib.parse.urlparse(url)
+    if parsed.scheme not in ("http", "https"):
+        return f"unsupported scheme: {parsed.scheme!r}"
+    if not parsed.hostname:
+        return f"no hostname in URL: {url}"
+    try:
+        infos = socket.getaddrinfo(parsed.hostname, None, type=socket.SOCK_STREAM)
+    except socket.gaierror:
+        return f"cannot resolve host: {parsed.hostname}"
+    for *_, sockaddr in infos:
+        try:
+            addr = ipaddress.ip_address(sockaddr[0])
+        except ValueError:
+            continue
+        if (
+            addr.is_private
+            or addr.is_reserved
+            or addr.is_loopback
+            or addr.is_link_local
+        ):
+            return f"URL resolves to disallowed address: {addr}"
+    return None
+
+
+class _NoFollowRedirect(urllib.request.HTTPRedirectHandler):
+    """Disable urllib's automatic redirect following."""
+
+    def redirect_request(self, *args, **kwargs):  # noqa: ARG002
+        return None
+
+
+def safe_fetch(
+    url: str,
+    *,
+    method: str = "GET",
+    max_hops: int = _MAX_REDIRECT_HOPS,
+) -> tuple[bytes | None, dict | None, str | None]:
+    """Fetch ``url`` with manual redirect walking + per-hop revalidation.
+
+    Returns ``(body, headers, None)`` on 2xx, or ``(None, None, error)``
+    on rejection / failure. ``headers`` is the response headers as a
+    plain ``dict``.
+    """
+    visited: list[str] = []
+    current = url
+    opener = urllib.request.build_opener(_NoFollowRedirect())
+    for hop in range(max_hops + 1):
+        if current in visited:
+            return None, None, "redirect loop"
+        visited.append(current)
+        err = validate_url(current)
+        if err:
+            return None, None, err
+        req = urllib.request.Request(
+            current, method=method, headers={"User-Agent": _USER_AGENT}
+        )
+        try:
+            resp = opener.open(req, timeout=_FETCH_TIMEOUT)
+        except urllib.error.HTTPError as e:
+            if e.code in (301, 302, 303, 307, 308):
+                if hop >= max_hops:
+                    return None, None, f"too many redirects (>{max_hops})"
+                location = e.headers.get("Location") if e.headers else None
+                if not location:
+                    return None, None, f"HTTP {e.code} without Location"
+                current = urllib.parse.urljoin(current, location)
+                continue
+            return None, None, f"HTTP {e.code}"
+        except (urllib.error.URLError, OSError, TimeoutError) as e:
+            return None, None, f"fetch error: {e}"
+        body = resp.read(_MAX_RESPONSE_BYTES + 1)
+        if len(body) > _MAX_RESPONSE_BYTES:
+            return None, None, f"response exceeds {_MAX_RESPONSE_BYTES} bytes"
+        return body, dict(resp.headers), None
+    return None, None, f"too many redirects (>{max_hops})"

{any2md-1.0.4 → any2md-1.0.6}/any2md/cli.py

@@ -20,6 +20,7 @@ from any2md.converters import (
     set_output_mode,
 )
 from any2md.converters.html import convert_url
+from any2md.frontmatter import filter_reserved_overrides
 from any2md.pipeline import PipelineOptions
 from any2md.utils import sanitize_filename, url_to_filename
 
@@ -169,6 +170,21 @@ def main():
         action="store_true",
         help="Promote pipeline validation warnings to errors (exit 3).",
     )
+    parser.add_argument(
+        "--no-config",
+        action="store_true",
+        help="Skip .any2md.toml auto-discovery (overrides default walk-up).",
+    )
+    parser.add_argument(
+        "--docx-fallback-on-warn",
+        action=argparse.BooleanOptionalAction,
+        default=True,
+        help="DOCX-only. When Docling emits any msword_backend warning "
+        "during conversion, auto-retry the file through mammoth and use "
+        "that output instead. Docling silently drops list items on "
+        "malformed input, so a warning means content is missing. "
+        "Default: enabled. Disable with --no-docx-fallback-on-warn.",
+    )
     parser.add_argument(
         "--quiet",
         "-q",
@@ -212,7 +228,7 @@ def main():
     overrides: dict[str, Any] = {}
     auto_id_prefix, auto_id_type_code = "LOCAL", "DOC"
 
-    discovered = discover_config()
+    discovered = None if args.no_config else discover_config()
     if discovered is not None:
         cfg = load_toml(discovered)
         overrides = _deep_merge_overrides(overrides, extract_meta_overrides(cfg))
@@ -239,6 +255,9 @@ def main():
         print(f"Error: {e}", file=sys.stderr)
         sys.exit(1)
     overrides = _deep_merge_overrides(overrides, cli_meta)
+    overrides = filter_reserved_overrides(
+        overrides, source_label="--meta/--meta-file/.any2md.toml"
+    )
 
     if (
         args.high_fidelity
@@ -272,6 +291,7 @@ def main():
         frontmatter_overrides=overrides or None,
         backend=args.backend,
         arxiv_lookup=not args.no_arxiv_lookup,
+        docx_fallback_on_warn=args.docx_fallback_on_warn,
     )
 
     # CLI-only output controls (not part of PipelineOptions).

{any2md-1.0.4 → any2md-1.0.6}/any2md/config.py

@@ -42,17 +42,31 @@ def load_toml(path: Path) -> dict[str, Any]:
         return {}
 
 
+_PROJECT_BOUNDARY_MARKERS = (
+    ".git",
+    "pyproject.toml",
+    "setup.py",
+    "setup.cfg",
+    "package.json",
+    ".any2md.toml.boundary",
+)
+
+
 def discover_config(start: Path | None = None) -> Path | None:
     """Walk up from ``start`` (default: cwd) looking for ``.any2md.toml``.
 
-    Returns the first match found or ``None`` if no config exists in
-    any ancestor directory.
+    Stops at the first ancestor containing a project boundary marker
+    (``.git``, ``pyproject.toml``, ``setup.py``, ``setup.cfg``,
+    ``package.json``, or ``.any2md.toml.boundary``) so config in
+    unrelated parent directories cannot leak into a project's run.
     """
     cur = (start or Path.cwd()).resolve()
     while True:
         candidate = cur / ".any2md.toml"
         if candidate.is_file():
             return candidate
+        if any((cur / m).exists() for m in _PROJECT_BOUNDARY_MARKERS):
+            return None
         if cur.parent == cur:
             return None
         cur = cur.parent

{any2md-1.0.4 → any2md-1.0.6}/any2md/converters/docx.py

@@ -9,9 +9,13 @@ produces the markdown body.
 
 from __future__ import annotations
 
+import logging
+import re
 import sys
-import xml.etree.ElementTree as ET
 import zipfile
+
+from defusedxml.ElementTree import ParseError as _XmlParseError
+from defusedxml.ElementTree import parse as _xml_parse
 from datetime import date
 from pathlib import Path
 
@@ -24,7 +28,80 @@ from any2md.converters import add_warnings, is_quiet
 from any2md.frontmatter import SourceMeta, compose
 from any2md.heuristics import filter_organization
 from any2md.pipeline import PipelineOptions
-from any2md.utils import sanitize_filename
+from any2md.utils import atomic_write_text, sanitize_filename
+
+
+_DOCLING_MSWORD_LOGGER = "docling.backend.msword_backend"
+
+_LOG_CONTROL_CHARS_RE = re.compile(r"[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]")
+
+
+def _sanitize_log_text(s: str) -> str:
+    """Strip ASCII C0/C1 control chars from a log message before re-emission.
+
+    Defends terminals from ANSI-escape spoofing planted in malicious DOCX
+    content that surfaces as a Docling msword_backend warning. ``\\t``
+    and ``\\n`` are preserved (not in the strip class).
+    """
+    return _LOG_CONTROL_CHARS_RE.sub("", s)
+
+
+_MAX_DOCX_METADATA_SIZE = 1 * 1024 * 1024  # 1 MB; core.xml/app.xml are typically <10 KB
+
+
+def _safe_zip_open(
+    z: zipfile.ZipFile, name: str, max_size: int = _MAX_DOCX_METADATA_SIZE
+):
+    """Open a fixed-name DOCX member after a declared-size sanity check.
+
+    Defends against zip-bomb amplification: a malicious DOCX can declare
+    an uncompressed_size of 10 GB for ``core.xml`` and bomb the XML
+    parser. Raises ``ValueError`` (caught by ``convert_docx``'s existing
+    handler -> file fails cleanly).
+    """
+    info = z.getinfo(name)
+    if info.file_size > max_size:
+        raise ValueError(
+            f"{name} declared size {info.file_size} exceeds {max_size}-byte limit"
+        )
+    return z.open(name)
+
+
+class _DoclingMswordWarningCapture:
+    """Buffer WARNING+ records from Docling's DOCX backend logger.
+
+    Used as a context manager around a Docling DOCX conversion to detect
+    upstream's silent list-item-drop guard (msword_backend.py:1377/1675).
+    Any captured records signal that Docling's Markdown output is
+    incomplete; ``convert_docx`` consults this to decide whether to
+    auto-retry with the mammoth lane.
+    """
+
+    def __init__(self) -> None:
+        self._records: list[logging.LogRecord] = []
+        self._handler: logging.Handler | None = None
+
+    def __enter__(self) -> _DoclingMswordWarningCapture:
+        records = self._records
+
+        class _BufferHandler(logging.Handler):
+            def emit(self, record: logging.LogRecord) -> None:
+                records.append(record)
+
+        handler = _BufferHandler(level=logging.WARNING)
+        logging.getLogger(_DOCLING_MSWORD_LOGGER).addHandler(handler)
+        self._handler = handler
+        return self
+
+    def __exit__(self, *_exc: object) -> None:
+        if self._handler is not None:
+            logging.getLogger(_DOCLING_MSWORD_LOGGER).removeHandler(self._handler)
+            self._handler = None
+
+    @property
+    def messages(self) -> list[str]:
+        return [r.getMessage() for r in self._records]
+
 
 _NS_CORE = {
     "dc": "http://purl.org/dc/elements/1.1/",
@@ -48,8 +125,8 @@ def _read_docx_metadata(docx_path: Path) -> dict[str, object]:
     try:
         with zipfile.ZipFile(docx_path) as z:
             try:
-                with z.open("docProps/core.xml") as f:
-                    root = ET.parse(f).getroot()
+                with _safe_zip_open(z, "docProps/core.xml") as f:
+                    root = _xml_parse(f).getroot()
                 title = root.findtext("dc:title", namespaces=_NS_CORE)
                 if title:
                     out["title_hint"] = title.strip()
@@ -64,8 +141,8 @@ def _read_docx_metadata(docx_path: Path) -> dict[str, object]:
             except KeyError:
                 pass
             try:
-                with z.open("docProps/app.xml") as f:
-                    root = ET.parse(f).getroot()
+                with _safe_zip_open(z, "docProps/app.xml") as f:
+                    root = _xml_parse(f).getroot()
                 company = root.findtext("ext:Company", namespaces=_NS_APP)
                 application = root.findtext("ext:Application", namespaces=_NS_APP)
                 # v1.0.2: Company takes priority for `organization` (real
@@ -85,18 +162,24 @@ def _read_docx_metadata(docx_path: Path) -> dict[str, object]:
                     out["produced_by"] = app_result.produced_by
             except KeyError:
                 pass
-    except (zipfile.BadZipFile, ET.ParseError):
+    except (zipfile.BadZipFile, _XmlParseError):
         pass
     return out
 
 
-def _extract_via_docling(docx_path: Path) -> tuple[str, str]:
-    """Returns (markdown, 'docling'). Raises on Docling errors."""
+def _extract_via_docling(docx_path: Path) -> tuple[str, str, list[str]]:
+    """Returns (markdown, 'docling', captured_warnings).
+
+    ``captured_warnings`` is the list of WARNING+ messages emitted by
+    Docling's ``msword_backend`` logger during the conversion. It is
+    empty for clean runs. Raises on Docling errors.
+    """
     from docling.document_converter import DocumentConverter
 
     converter = DocumentConverter()
-    result = converter.convert(str(docx_path))
-    return result.document.export_to_markdown(), "docling"
+    with _DoclingMswordWarningCapture() as cap:
+        result = converter.convert(str(docx_path))
+    return result.document.export_to_markdown(), "docling", list(cap.messages)
 
 
 def _extract_via_mammoth(docx_path: Path, options: PipelineOptions) -> tuple[str, str]:
@@ -139,15 +222,18 @@ def convert_docx(
             )
             return False
 
+        docling_warnings: list[str] = []
         if options.backend == "mammoth":
             md_text, extracted_via = _extract_via_mammoth(docx_path, options)
             lane = "text"
         elif options.backend == "docling":
-            md_text, extracted_via = _extract_via_docling(docx_path)
+            md_text, extracted_via, docling_warnings = _extract_via_docling(docx_path)
             lane = "structured"
         elif has_docling():
             try:
-                md_text, extracted_via = _extract_via_docling(docx_path)
+                md_text, extracted_via, docling_warnings = _extract_via_docling(
+                    docx_path
+                )
                 lane = "structured"
             except Exception as e:  # noqa: BLE001 — fall back rather than fail
                 print(
@@ -157,10 +243,39 @@ def convert_docx(
                 )
                 md_text, extracted_via = _extract_via_mammoth(docx_path, options)
                 lane = "text"
+                docling_warnings = []
         else:
             md_text, extracted_via = _extract_via_mammoth(docx_path, options)
             lane = "text"
 
+        # v1.0.5: Docling's DOCX backend silently drops list items in a
+        # known malformed-input path. When any msword_backend warning
+        # fires, swap the Docling output for the mammoth lane (different
+        # parser, generally more permissive). Captured warnings are
+        # forwarded into the run-level warning bucket so --strict still
+        # fails on them.
+        if (
+            docling_warnings
+            and options.docx_fallback_on_warn
+            and extracted_via == "docling"
+        ):
+            print(
+                f"  FALLBACK: {docx_path.name} -- Docling emitted "
+                f"{len(docling_warnings)} msword_backend warning(s); "
+                f"re-running via mammoth (content may have been dropped "
+                f"by Docling).",
+                file=sys.stderr,
+            )
+            md_text, _ = _extract_via_mammoth(docx_path, options)
+            extracted_via = "docling→mammoth (warning fallback)"
+            lane = "text"
+            add_warnings(
+                [
+                    f"docling.msword_backend: {_sanitize_log_text(m)}"
+                    for m in docling_warnings
+                ]
+            )
+
         md_text, warnings = pipeline.run(md_text, lane, options)
         add_warnings(warnings)
 
@@ -186,7 +301,7 @@ def convert_docx(
         full = compose(md_text, meta, options, overrides=options.frontmatter_overrides)
 
         output_dir.mkdir(parents=True, exist_ok=True)
-        out_path.write_text(full, encoding="utf-8", newline="\n")
+        atomic_write_text(out_path, full)
         wc = meta.word_count or 0
         suffix = f", {len(warnings)} warning(s)" if warnings else ""
         if not is_quiet():