any2md 1.2.0__tar.gz → 1.2.1__tar.gz

{any2md-1.2.0 → any2md-1.2.1}/CHANGELOG.md

@@ -4,6 +4,117 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+## [1.2.1] — 2026-11-10
+
+Security fixes from a full-repository scan (ReDoS, SSRF, symlink
+following, terminal escape injection) and fixes for nested `--meta`,
+text-lane dehyphenation, `--strip-links`, and structured-lane headings.
+
+### Security
+
+- **Regex denial of service on crafted documents (CWE-1333, CWE-407).**
+  Several patterns that run on converted text backtracked in quadratic,
+  cubic, or exponential time on hostile input, so a document of a few KB
+  to a few MB could hang a conversion for hours and stall the rest of a
+  batch. Fixed sites: the academic byline (exponential), the first-H1
+  title, TOC-line and TOC-hint detection, body-heading collection, the
+  `Contact:` byline check, trailing-whitespace trimming in C5, inline-link
+  stripping in C9 and in abstract cleanup, the S1 image and `<figure>`
+  handlers, the S4 heading matcher, and a blank-line rescan in the TXT
+  structurizer. Each now runs in linear time, through procedural parsing
+  or unambiguous, bounded patterns, plus length caps where real input is
+  short (TOC lines and author lists, which are cut at a comma rather than
+  dropped). Escaped brackets in link text are kept, and backslash parity
+  decides whether a bracket opens a link. Behavior on normal
+  input is unchanged: a fuzz test compares every rewrite against the
+  regex it replaced. Known differences are limited to degenerate input.
+  A bare `#` line no longer turns the next line into the H1, empty or
+  dots-only TOC titles no longer count, and 2-letter byline names
+  written with a space before the comma are no longer matched.
+
+- **SSRF guard accepted IPv6 forms that embed an internal IPv4 address
+  (CWE-918).** NAT64 (`64:ff9b::/96`), 6to4 (`2002::/16`), SIIT, and on
+  some Python builds IPv4-mapped addresses passed the URL guard even when
+  the embedded IPv4 was private, loopback, or a cloud metadata address.
+  The guard now extracts the embedded address and applies the IPv4 policy,
+  with the same verdict on Python 3.11 through 3.13. Teredo, NAT64
+  local-use, and deprecated IPv4-compatible addresses are rejected.
+- **DOCX image links could make mammoth read local files or fetch URLs
+  (CWE-918, CVE-2025-11849).** The minimum mammoth version is now 1.11.0,
+  the mammoth lane passes `external_file_access=False`, and image bytes
+  are not read at all unless `--save-images` is set.
+- **Docling treated local paths as URLs (CWE-918).** A file named like
+  `http:host#.pdf` was resolved as a URL. Both Docling call sites now pass
+  a `Path`, which Docling reads from disk.
+- **Directory scans followed symlinks (CWE-59, CWE-61).** A link such as
+  `report.txt -> ~/.ssh/id_rsa` in a scanned tree copied its target into
+  the output. Scans now skip symlinked files, never enter symlinked
+  directories, and skip FIFOs and device nodes, each with a `SKIP` line.
+  A symlink named on the command line still converts. Extension matching
+  keeps the platform's case rules. Known limit: a file swapped for a link
+  between the scan and the read is not caught.
+- **Terminal escape injection through filenames and error text (CWE-117,
+  CWE-150).** Filenames, output paths, and Docling exception messages in
+  `OK`, `SKIP`, `FAIL`, `WARN`, and `FALLBACK` lines reached the terminal
+  raw, so a crafted name could emit ANSI or OSC sequences, bidi
+  overrides, or forge extra status lines. Every such line now goes
+  through `safe_oneline`.
+
+### Fixed
+
+- **Text-lane dehyphenation never ran.** T1 `repair_line_wraps` ran before
+  T2 `dehyphenate` and joined `co-\noperation` into `co- operation`, so T2
+  never saw a line-end hyphen. T2 now runs first and decides from evidence
+  in the same document. It merges the word when the joined form appears
+  elsewhere (`cooperation`), keeps the hyphen when the hyphenated form
+  appears elsewhere (`co-pilot`), and leaves suspended hyphens
+  (`first- and second-order`) and breaks with no evidence as they were.
+  It also tolerates trailing spaces after the hyphen, handles non-ASCII
+  letters and capitalized words, and no longer rewrites fenced code.
+- **T1 joined setext underlines and rules onto the line above.** A `---`,
+  `===`, `***`, or `___` line under text came out as `Heading ---`. These
+  lines are now structural, so T1 leaves them alone.
+- **`--strip-links` and `--profile maximum` left links in place.** The
+  flag reached `PipelineOptions`, but no stage read it, so link URLs
+  always survived. A new shared cleanup stage, C9 `strip_links`, runs
+  after entity decoding in both lanes. It replaces `[text](url)` with
+  `text` and keeps images, fenced code, and inline code. The unused
+  `any2md.utils.strip_links()` helper is removed.
+- **Tables lost their header row on the DOCX mammoth fallback and the
+  HTML bs4 fallback.** mammoth never emits `<thead>`, and many web tables
+  omit it. markdownify 1.x then wrote an empty header row (`| | |`) and
+  demoted the real header to a data row. Both call sites now pass
+  `table_infer_header=True`, so the first row stays the header. The
+  stale `table_heavy.fallback.md` snapshot is regenerated (the table
+  matches the original snapshot again, and two stray blank lines are gone).
+
+- **Nested `--meta` lists crashed the batch.** `--meta a.b=x,y` (and any
+  list or table below the top level) raised `TypeError` in the
+  frontmatter emitter, and the txt, docx, and pdf converters did not catch
+  it, so one flag ended the whole run. Nested values now render like
+  top-level ones, an empty table renders as `{}`, and an unsupported value
+  fails only its own file with a `FAIL:` line.
+- **Structured-lane S4 turned sibling headings into parent and children.**
+  `# T`, `### A`, `### B` came out as `## A`, `### B`. S4 now ranks
+  headings with the same stack the HTML lane uses, so siblings stay
+  siblings and nesting is kept. Both lanes share one block scanner
+  that follows CommonMark block rules (fence delimiter character and
+  length, indentation and tab stops, list items, paragraph interruption,
+  thematic breaks, and raw HTML blocks), so headings inside fenced code
+  or raw HTML blocks such as `<pre>` are never rewritten, and real
+  headings after them are never skipped.
+
+### Changed
+
+- **CI runs the full test suite** (`pytest -q`: unit, CLI, and
+  integration) instead of `tests/unit` only. `test_flags_compose` now
+  asserts the documented pre-flight exit 1 when `--save-images` /
+  `--ocr-figures` are given without Docling, instead of exit 0.
+  CONTRIBUTING drops a stale test count and a reference to a
+  network test file that does not exist.
+
 ## [1.2.0] — 2026-11-09
 
 Drops Python 3.10 to take the Pillow 13 security fixes, and fixes

{any2md-1.2.0 → any2md-1.2.1}/CONTRIBUTING.md

@@ -33,7 +33,8 @@ Python 3.11 or later is required.
 
 ## Running tests
 
-The default invocation runs the whole suite (currently 172 tests):
+The default invocation runs the whole suite. CI runs the same command on
+Python 3.11, 3.12, and 3.13:
 
 ```bash
 pytest -v
@@ -59,13 +60,11 @@ UPDATE_SNAPSHOTS=1 pytest tests/integration/test_snapshots.py
 Then inspect the diff (`git diff tests/fixtures/snapshots/`) before
 committing — the snapshots are review material, not just bytes.
 
-A few tests are network-dependent (the URL converter integration suite)
-and opt-in. Run them explicitly when touching `converters/html.py` or the
-SSRF protection:
-
-```bash
-pytest tests/integration/test_url_wikipedia.py -v
-```
+The suite makes no network calls. URL and SSRF behavior is tested with
+stubbed DNS and a fake opener (`tests/unit/test_http_safe.py`,
+`tests/integration/test_html_trafilatura.py`), and HTML conversion with
+saved fixtures under `tests/fixtures/docs/`. When you change
+`converters/html.py`, also spot-check a few live pages by hand.
 
 ## Adding a new converter
 

{any2md-1.2.0 → any2md-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: any2md
-Version: 1.2.0
+Version: 1.2.1
 Summary: Convert PDF, DOCX, HTML, and TXT files — or web pages by URL — to clean, LLM-optimized Markdown with YAML frontmatter.
 Project-URL: Homepage, https://github.com/rocklambros/any2md
 Project-URL: Issues, https://github.com/rocklambros/any2md/issues
@@ -15,7 +15,7 @@ Requires-Python: >=3.11
 Requires-Dist: beautifulsoup4<5,>=4.12.0
 Requires-Dist: defusedxml<1,>=0.7.1
 Requires-Dist: lxml<7,>=6.1.0
-Requires-Dist: mammoth<2,>=1.6.0
+Requires-Dist: mammoth<2,>=1.11.0
 Requires-Dist: markdownify<2,>=0.13.0
 Requires-Dist: pillow<14,>=13.0.0
 Requires-Dist: pymupdf4llm<1,>=0.0.17
@@ -516,8 +516,8 @@ any2md uses a two-lane post-processing pipeline: one lane for layout-trustworthy
                      │
         ┌────────────┴────────────┐
         │     pipeline/text.py    │   text lane
-        │  T1 line-wrap repair    │
         │  T2 dehyphenate         │
+        │  T1 line-wrap repair    │
         │  T9 strip repeated      │   ◀ NEW (E1)
         │     byline              │
         │  T3 dedupe paragraphs   │

{any2md-1.2.0 → any2md-1.2.1}/SECURITY.md

@@ -4,9 +4,8 @@
 
 | Version | Status |
 |---|---|
-| 1.0.x   | ✅ Supported (current stable). Patch releases for security and quality fixes are published as needed. |
-| 0.7.x   | ⚠️ Receives critical security fixes only until 2026-10-26 (six months after the v1.0.0 GA on 2026-04-26). |
-| < 0.7   | ❌ Not supported. Please upgrade. |
+| 1.2.x   | ✅ Supported (current stable). Patch releases for security and quality fixes are published as needed. |
+| < 1.2   | ❌ Not supported. Please upgrade to the latest 1.2.x release. |
 
 ## Reporting a vulnerability
 

{any2md-1.2.0 → any2md-1.2.1}/any2md/__init__.py

@@ -2,7 +2,7 @@
 
 from any2md._docling_cache import docling_session, release_models
 
-__version__ = "1.2.0"
+__version__ = "1.2.1"
 
 __all__ = [
     "__version__",

{any2md-1.2.0 → any2md-1.2.1}/any2md/_http.py

@@ -3,6 +3,8 @@
 Defenses against:
   - non-http(s) schemes
   - URLs resolving to non-public addresses (private, multicast, CGNAT, etc.)
+  - IPv6 forms that embed an internal IPv4 target (IPv4-mapped, NAT64,
+    6to4, Teredo, IPv4-compatible)
   - DNS rebinding via redirect (per-hop revalidation)
   - DNS rebinding INTRA-hop (IP pinned through to socket.create_connection,
     so the IP we validated is the IP we connect to)
@@ -28,8 +30,57 @@ _MAX_RESPONSE_BYTES = 20 * 1024 * 1024  # 20 MB cap on body read
 _USER_AGENT = f"any2md/{__version__}"
 
 
+# Shared address space (RFC 6598). Cloud providers host metadata services
+# here, for example Alibaba's 100.100.100.200. ``is_global`` already
+# excludes it, but the explicit check keeps the rule visible and stable.
+_CGNAT_V4 = ipaddress.IPv4Network("100.64.0.0/10")
+
+# IPv6 prefixes whose low 32 bits carry an IPv4 destination. A socket or
+# translator delivers the packet to that IPv4 address, so the IPv4 policy
+# decides. Python's ``is_global`` does not unwrap NAT64 or IPv4-translated
+# forms on any version, and unwraps IPv4-mapped forms only on builds with
+# the CVE-2024-4032 fix, so the guard extracts the address itself.
+_V4_IN_LOW_32 = (
+    ipaddress.IPv6Network("::ffff:0:0/96"),  # IPv4-mapped
+    ipaddress.IPv6Network("::ffff:0:0:0/96"),  # SIIT IPv4-translated
+    ipaddress.IPv6Network("64:ff9b::/96"),  # NAT64 well-known prefix
+)
+_SIXTOFOUR = ipaddress.IPv6Network("2002::/16")
+
+# Rejected outright. Teredo (2001::/32) tunnels to an obfuscated IPv4
+# client through a relay. NAT64 local-use (64:ff9b:1::/48) maps into a
+# site's own IPv4 space by definition. IPv4-compatible (::/96) is
+# deprecated by RFC 4291 and has no legitimate use in a DNS answer.
+_V6_DENY = (
+    ipaddress.IPv6Network("2001::/32"),
+    ipaddress.IPv6Network("64:ff9b:1::/48"),
+    ipaddress.IPv6Network("::/96"),
+)
+
+
+def _v4_allowed(addr: ipaddress.IPv4Address) -> bool:
+    return (
+        bool(addr.is_global)
+        and addr not in _CGNAT_V4
+        and not addr.is_multicast
+        and not addr.is_unspecified
+    )
+
+
 def _addr_allowed(addr) -> bool:
-    """Allowlist policy: globally routable, non-multicast, non-unspecified."""
+    """Allowlist policy: globally routable, non-multicast, non-unspecified.
+
+    IPv6 addresses that embed an IPv4 destination are judged by the IPv4
+    policy alone, so the verdict does not vary with the Python version.
+    """
+    if addr.version == 4:
+        return _v4_allowed(addr)
+    if any(addr in net for net in _V6_DENY):
+        return False
+    if any(addr in net for net in _V4_IN_LOW_32):
+        return _v4_allowed(ipaddress.IPv4Address(int(addr) & 0xFFFFFFFF))
+    if addr in _SIXTOFOUR:
+        return _v4_allowed(ipaddress.IPv4Address((int(addr) >> 80) & 0xFFFFFFFF))
     return bool(addr.is_global) and not addr.is_multicast and not addr.is_unspecified
 
 

{any2md-1.2.0 → any2md-1.2.1}/any2md/cli.py

@@ -1,6 +1,7 @@
 """CLI entry point for any2md."""
 
 import argparse
+import os
 import sys
 import time
 from pathlib import Path
@@ -74,6 +75,63 @@ def _deep_merge_overrides(
     return out
 
 
+def _scan_directory(root: Path, recursive: bool) -> list[Path]:
+    """Return supported regular files under ``root``, sorted.
+
+    Never follows symlinks below ``root``. An untrusted document tree can
+    hold a link such as ``report.txt -> ~/.ssh/id_rsa``, and following it
+    would copy the target into the output (F14 CWE-59, F22 CWE-61).
+    ``Path.glob`` and ``Path.rglob`` return file links, and their handling
+    of directory links has changed across Python releases, so the walk
+    uses ``os.scandir`` with ``follow_symlinks=False`` to get one answer
+    on every supported version. Skipping directory links also rules out
+    symlink loops. ``root`` itself is followed when it is a link,
+    because the user named it.
+
+    Suffixes are compared after ``os.path.normcase``, which matches the
+    old glob semantics: case-insensitive on Windows, case-sensitive on
+    POSIX.
+    """
+    suffixes = tuple(os.path.normcase(ext) for ext in SUPPORTED_EXTENSIONS)
+    found: list[Path] = []
+    # An explicit stack instead of recursion keeps deep trees clear of
+    # the interpreter recursion limit.
+    pending = [root]
+    while pending:
+        current = pending.pop()
+        try:
+            with os.scandir(current) as entries:
+                children = list(entries)
+        except OSError as e:
+            _logging.warn(f"{current} -- {e}", prefix="SKIP (unreadable)")
+            continue
+        for entry in children:
+            path = Path(entry.path)
+            try:
+                if entry.is_symlink():
+                    # Report only links the old scan would have picked up,
+                    # so unrelated links in a tree do not flood stderr.
+                    wanted = os.path.normcase(entry.name).endswith(suffixes)
+                    if wanted or (recursive and entry.is_dir()):
+                        _logging.warn(str(path), prefix="SKIP (symlink)")
+                    continue
+                if entry.is_dir(follow_symlinks=False):
+                    if recursive:
+                        pending.append(path)
+                    continue
+                if not os.path.normcase(entry.name).endswith(suffixes):
+                    continue
+                # FIFOs and device nodes can hang the read or never end.
+                if not entry.is_file(follow_symlinks=False):
+                    _logging.warn(str(path), prefix="SKIP (not a regular file)")
+                    continue
+            except OSError as e:
+                _logging.warn(f"{path} -- {e}", prefix="SKIP (unreadable)")
+                continue
+            found.append(path)
+    return sorted(found)
+
+
 def main():
     script_dir = Path.cwd()
     default_output_dir = script_dir / "Text"
@@ -325,14 +383,7 @@ def main():
                 _logging.fail(f"{f}", prefix="NOT FOUND")
                 continue
             if p.is_dir():
-                glob_method = p.rglob if args.recursive else p.glob
-                file_paths.extend(
-                    sorted(
-                        fp
-                        for ext in SUPPORTED_EXTENSIONS
-                        for fp in glob_method(f"*{ext}")
-                    )
-                )
+                file_paths.extend(_scan_directory(p, args.recursive))
                 continue
             if p.suffix.lower() not in SUPPORTED_EXTENSIONS:
                 _logging.fail(f"{f}", prefix="UNSUPPORTED FORMAT")
@@ -344,22 +395,18 @@ def main():
                 f"Error: not a directory: {_logging.safe_oneline(str(args.input_dir))}\n"
             )
             sys.exit(1)
-        glob_method = args.input_dir.rglob if args.recursive else args.input_dir.glob
-        file_paths = sorted(
-            p for ext in SUPPORTED_EXTENSIONS for p in glob_method(f"*{ext}")
-        )
+        file_paths = _scan_directory(args.input_dir, args.recursive)
     else:
-        glob_method = script_dir.rglob if args.recursive else script_dir.glob
-        file_paths = sorted(
-            p for ext in SUPPORTED_EXTENSIONS for p in glob_method(f"*{ext}")
-        )
+        file_paths = _scan_directory(script_dir, args.recursive)
 
     if not file_paths and not urls:
         print("No supported files to process.")
         sys.exit(0)
 
     total = len(file_paths) + len(urls)
-    print(f"Processing {total} file(s) → {args.output_dir}/\n")
+    print(
+        f"Processing {total} file(s) → {_logging.safe_oneline(str(args.output_dir))}/\n"
+    )
     start = time.time()
     ok = 0
     fail = 0
@@ -370,7 +417,7 @@ def main():
         out_name = url_to_filename(url)
         out_path = args.output_dir / out_name
         if out_path.exists() and not args.force:
-            print(f"  SKIP (exists): {out_name}")
+            print(f"  SKIP (exists): {_logging.safe_oneline(out_name)}")
             skip += 1
             continue
 
@@ -387,10 +434,13 @@ def main():
 
     # Process local files
     for file_path in file_paths:
+        # sanitize_filename strips only C0 and DEL, so C1 controls and bidi
+        # overrides survive into out_name. Every status line that prints it
+        # goes through safe_oneline as well.
         out_name = sanitize_filename(file_path.name)
         out_path = args.output_dir / out_name
         if out_path.exists() and not args.force:
-            print(f"  SKIP (exists): {out_name}")
+            print(f"  SKIP (exists): {_logging.safe_oneline(out_name)}")
             skip += 1
             continue
 
@@ -403,9 +453,9 @@ def main():
             continue
 
         if file_size > args.max_file_size:
-            print(
-                f"  SKIP (too large): {file_path.name} ({file_size} bytes, max {args.max_file_size})",
-                file=sys.stderr,
+            _logging.warn(
+                f"{file_path.name} ({file_size} bytes, max {args.max_file_size})",
+                prefix="SKIP (too large)",
             )
             skip += 1
             continue

{any2md-1.2.0 → any2md-1.2.1}/any2md/converters/docx.py

@@ -9,8 +9,9 @@ produces the markdown body.
 
 from __future__ import annotations
 
+import importlib.metadata
 import logging
-import sys
+import re
 import zipfile
 
 from defusedxml.ElementTree import ParseError as _XmlParseError
@@ -174,21 +175,65 @@ def _extract_via_docling(docx_path: Path) -> tuple[str, str, list[str]]:
     converter = get_docx_converter()
     with _DoclingMswordWarningCapture() as cap:
         try:
-            result = converter.convert(str(docx_path))
+            # Docling resolves a str source as a URL first, so a file named
+            # ``http:host#.docx`` would be fetched. A Path is read from disk.
+            result = converter.convert(Path(docx_path))
         except Exception:
             evict_on_convert_failure("docx", None)
             raise
     return result.document.export_to_markdown(), "docling", list(cap.messages)
 
 
+# mammoth 1.11.0 added ``external_file_access`` and turned it off by
+# default (CVE-2025-11849). Earlier releases open a linked image's target
+# with ``urlopen`` or ``open`` and accept no switch to stop it.
+_MAMMOTH_SAFE_VERSION = (1, 11)
+
+
+def _installed_mammoth_version() -> str:
+    try:
+        return importlib.metadata.version("mammoth")
+    except importlib.metadata.PackageNotFoundError:
+        return ""
+
+
+def _mammoth_blocks_external_files() -> bool:
+    match = re.match(r"(\d+)\.(\d+)", _installed_mammoth_version())
+    if match is None:
+        # Unknown version: assume the unsafe behavior.
+        return False
+    return (int(match.group(1)), int(match.group(2))) >= _MAMMOTH_SAFE_VERSION
+
+
+# Emits an <img> with alt text and no src, so mammoth never calls
+# ``image.open()``. markdownify strips the tag when images are not saved.
+_skip_image_bytes = mammoth.images.img_element(lambda image: {})
+
+
+def _mammoth_kwargs(save_images: bool) -> dict:
+    if not _mammoth_blocks_external_files():
+        # mammoth's image object does not say whether bytes come from the
+        # DOCX zip or from a link, so on an unsafe release no image is read.
+        return {"convert_image": _skip_image_bytes}
+    kwargs: dict = {"external_file_access": False}
+    if not save_images:
+        # The image is stripped from the output anyway, so reading and
+        # base64-encoding its bytes is wasted work.
+        kwargs["convert_image"] = _skip_image_bytes
+    return kwargs
+
+
 def _extract_via_mammoth(docx_path: Path, options: PipelineOptions) -> tuple[str, str]:
     with open(docx_path, "rb") as f:
-        html_result = mammoth.convert_to_html(f)
+        html_result = mammoth.convert_to_html(f, **_mammoth_kwargs(options.save_images))
     md = markdownify.markdownify(
         html_result.value,
         heading_style="ATX",
         strip=["img"] if not options.save_images else [],
         bullets="-",
+        # mammoth never emits <thead>; without inference markdownify 1.x
+        # writes an empty header row and demotes the real header.
+        table_infer_header=True,
     )
     return md, "mammoth+markdownify"
 
@@ -206,7 +251,7 @@ def convert_docx(
     out_name = sanitize_filename(docx_path.name)
     out_path = output_dir / out_name
     if out_path.exists() and not force:
-        print(f"  SKIP (exists): {out_name}")
+        print(f"  SKIP (exists): {_logging.safe_oneline(out_name)}")
         return True
 
     try:
@@ -214,10 +259,9 @@ def convert_docx(
         # caller's choice instead of the auto-select. ``pymupdf4llm`` is
         # invalid for DOCX — fail the file with a clear error.
         if options.backend == "pymupdf4llm":
-            print(
-                f"  FAIL: {docx_path.name} -- backend 'pymupdf4llm' is not "
-                f"valid for DOCX input (pymupdf4llm processes PDF only).",
-                file=sys.stderr,
+            _logging.fail(
+                f"{docx_path.name} -- backend 'pymupdf4llm' is not "
+                f"valid for DOCX input (pymupdf4llm processes PDF only)."
             )
             return False
 
@@ -235,10 +279,9 @@ def convert_docx(
                 )
                 lane = "structured"
             except Exception as e:  # noqa: BLE001 — fall back rather than fail
-                print(
-                    f"  WARN: Docling extraction failed for {docx_path.name}: {e}; "
-                    f"falling back to mammoth.",
-                    file=sys.stderr,
+                _logging.warn(
+                    f"Docling extraction failed for {docx_path.name}: {e}; "
+                    f"falling back to mammoth."
                 )
                 md_text, extracted_via = _extract_via_mammoth(docx_path, options)
                 lane = "text"
@@ -258,12 +301,12 @@ def convert_docx(
             and options.docx_fallback_on_warn
             and extracted_via == "docling"
         ):
-            print(
-                f"  FALLBACK: {docx_path.name} -- Docling emitted "
+            _logging.warn(
+                f"{docx_path.name} -- Docling emitted "
                 f"{len(docling_warnings)} msword_backend warning(s); "
                 f"re-running via mammoth (content may have been dropped "
                 f"by Docling).",
-                file=sys.stderr,
+                prefix="FALLBACK",
             )
             md_text, _ = _extract_via_mammoth(docx_path, options)
             extracted_via = "docling→mammoth (warning fallback)"
@@ -304,7 +347,10 @@ def convert_docx(
         wc = meta.word_count or 0
         suffix = f", {len(warnings)} warning(s)" if warnings else ""
         if not is_quiet():
-            print(f"  OK: {out_name} ({wc} words, via {extracted_via}{suffix})")
+            print(
+                f"  OK: {_logging.safe_oneline(out_name)} "
+                f"({wc} words, via {extracted_via}{suffix})"
+            )
         return True
 
     except (OSError, ValueError) as e: