pdf-tooling 1.2.0__tar.gz → 1.2.1__tar.gz

{pdf_tooling-1.2.0 → pdf_tooling-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pdf-tooling
-Version: 1.2.0
+Version: 1.2.1
 Summary: One safe, permissively-licensed command-line tool for the common PDF chores.
 Project-URL: Homepage, https://armandoherra.github.io/pdf-tooling/
 Project-URL: Documentation, https://github.com/ArmandoHerra/pdf-tooling#readme
@@ -28,8 +28,8 @@ Classifier: Topic :: Utilities
 Requires-Python: >=3.11
 Requires-Dist: pdfplumber<0.12,>=0.11.10
 Requires-Dist: pikepdf<11,>=10.12.0
-Requires-Dist: pillow<13,>=12.3.0
-Requires-Dist: pypdf[crypto]<7,>=6.19.0
+Requires-Dist: pillow<14,>=13.0.0
+Requires-Dist: pypdf[crypto]<7,>=6.21.2
 Requires-Dist: pypdfium2<6,>=5.13.0
 Requires-Dist: pytesseract<0.4,>=0.3.13
 Requires-Dist: reportlab<6,>=5.0.1
@@ -366,7 +366,7 @@ A supplied password is checked even when the document would open without one: an
 
 ## Upgrading to 1.2
 
-A `1.1.x` invocation or script that relied on any of the following observes a different exit code or message at `1.2`. These changes are on `main` and ship in the first `1.2` release.
+A `1.1.x` invocation or script that relied on any of the following observes a different exit code or message at `1.2`. These changes shipped in `1.2.0` on 2026-10-08.
 
 | In 1.1 | In 1.2 | What to change |
 |---|---|---|

{pdf_tooling-1.2.0 → pdf_tooling-1.2.1}/README.md

@@ -324,7 +324,7 @@ A supplied password is checked even when the document would open without one: an
 
 ## Upgrading to 1.2
 
-A `1.1.x` invocation or script that relied on any of the following observes a different exit code or message at `1.2`. These changes are on `main` and ship in the first `1.2` release.
+A `1.1.x` invocation or script that relied on any of the following observes a different exit code or message at `1.2`. These changes shipped in `1.2.0` on 2026-10-08.
 
 | In 1.1 | In 1.2 | What to change |
 |---|---|---|

{pdf_tooling-1.2.0 → pdf_tooling-1.2.1}/THIRD_PARTY_LICENSES

@@ -62,7 +62,7 @@ THE SOFTWARE.
 
 
 brotli
-1.2.0
+1.2.1
 MIT
 Copyright (c) 2009, 2010, 2013-2016 by the Brotli Authors.
 
@@ -760,7 +760,7 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 
 
 pillow
-12.3.0
+13.0.0
 MIT-CMU
 The Python Imaging Library (PIL) is
 
@@ -2405,7 +2405,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 
 pypdf
-6.19.0
+6.21.2
 BSD-3-Clause
 Copyright (c) 2006-2008, Mathieu Fenniak
 Some contributions copyright (c) 2007, Ashish Kulkarni <kulkarni.ashish@gmail.com>

{pdf_tooling-1.2.0 → pdf_tooling-1.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "pdf-tooling"
-version = "1.2.0"
+version = "1.2.1"
 description = "One safe, permissively-licensed command-line tool for the common PDF chores."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -54,13 +54,20 @@ dependencies = [
   # lifting it needs the suite run against 7.x). The lock was refreshed
   # targeted (pypdf and urllib3 only); urllib3 >= 2.8.0 clears three more
   # advisories in the dev-only closure (requests <- pip-audit).
-  "pypdf[crypto]>=6.19.0,<7",
+  # 2026-10-24 (ledger 9a0daae8ee follow-up): floor 6.19.0 -> 6.21.2, the
+  # lowest version that fixes all 11 pip-audit advisories published against
+  # 6.19.0; the `<7` ceiling stays (no fix needs 7.x).
+  "pypdf[crypto]>=6.21.2,<7",
   "pypdfium2>=5.13.0,<6",
   "reportlab>=5.0.1,<6",
   "pikepdf>=10.12.0,<11",
   "pdfplumber>=0.11.10,<0.12",
   "pytesseract>=0.3.13,<0.4",
-  "pillow>=12.3.0,<13",
+  # 2026-10-24: 13.0.0 is the only release that fixes the 37 advisories
+  # pip-audit reports against 12.3.0, so the `<13` ceiling held every user on
+  # a vulnerable Pillow. Floor and ceiling move together to >=13.0.0,<14; the
+  # full suite was run against 13.0.0 before the move.
+  "pillow>=13.0.0,<14",
   "typer>=0.12,<1",
 ]
 
@@ -83,6 +90,19 @@ Repository = "https://github.com/ArmandoHerra/pdf-tooling"
 Changelog = "https://github.com/ArmandoHerra/pdf-tooling/blob/main/changelog.md"
 Issues = "https://github.com/ArmandoHerra/pdf-tooling/issues"
 
+# CI uv pin (ledger 9a0daae8ee, B-461). uv 0.13 stopped writing the
+# `_virtualenv.pth` startup shim, so a bare venv interpreter loads 12 fewer
+# modules (45 -> 33 locally; CI's recorded floor 36 -> 24). That floor is the
+# DENOMINATOR of test_total_startup_import_cost_stays_under_its_ceiling, so
+# every Linux 3.11/3.12 cell read 27-30 against the 26.5 ceiling with no
+# change in this project's own import cost. CI therefore pins uv 0.12.24 in
+# every `astral-sh/setup-uv` step's `version:` input. It is deliberately NOT
+# a `[tool.uv] required-version` here: Dependabot's uv updater runs only the
+# newest uv and drops every update with `tool_version_not_supported` when the
+# project declares an older range. Lifting the pin needs the ceiling
+# re-derived under uv 0.13 with a fresh measured distribution, never a
+# widened constant. A local `make test` under uv 0.13 reds the same arm.
+
 [dependency-groups]
 dev = [
   "ruff>=0.6",