Skip to content

fix(deps): require pdfminer-six >=20251107 for VULN-92490 #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shuningc merged 3 commits into from
Aug 5, 2026
Merged

fix(deps): require pdfminer-six >=20251107 for VULN-92490 #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
bda20c4
fix(VULN-92490): require pdfminer-six >=20251107 for unsafe pickle CVE
shuningc Jul 30, 2026
4b6999a
Merge branch 'main' into VULN-92490-pdfminer-six-upgrade
shuningc Aug 4, 2026
7dd9a43
Merge branch 'main' into VULN-92490-pdfminer-six-upgrade
shuningc Aug 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 40 additions & 33 deletions poetry.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ packages = [
[project.optional-dependencies]
langchain = ["langchain-core", "langchain", "langsmith (>=0.8.0)"]
openai = ["openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)"]
crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'"]
crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "pdfminer-six (>=20251107)"]
middleware = ["starlette"]
all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'"]
all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "pdfminer-six (>=20251107)"]
Comment on lines +31 to +33

@fercor-cisco fercor-cisco Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 minor (design): Same gap as line 63, on the PEP 621 side: pdfminer-six (>=20251107) has no environment marker while crewai and litellm in the same list both carry ; python_version < '3.14'.

Since [project.optional-dependencies] is what ends up in the published wheel metadata, a downstream pip install splunk-ao[crewai] on Python 3.14 gets pdfminer.six + cryptography with no crewai and no pdfplumber to use them. Adding the marker here (in both crewai and all) keeps the extra internally consistent — pdfminer.six only ships where the thing that needs it ships.

Note both this and the line 63 change are needed; they feed different consumers (published metadata vs. Poetry's resolution/lock).

Suggested change
crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "pdfminer-six (>=20251107)"]
middleware = ["starlette"]
all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'"]
all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "pdfminer-six (>=20251107)"]
crewai = ["crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "pdfminer-six (>=20251107); python_version < '3.14'"]
middleware = ["starlette"]
all = ["langchain-core", "langchain", "langsmith (>=0.8.0)", "openai (>=2.8.0,<3.0.0)", "packaging (>=24.2,<25.0)", "openai-agents (>=0.4.0,<1.0.0)", "crewai (>=0.152.0,<2.0.0); python_version < '3.14'", "starlette", "litellm (>=1.83.14,<2.0.0); python_version < '3.14'", "pdfminer-six (>=20251107); python_version < '3.14'"]

🤖 Generated by the Astra agent




Expand Down Expand Up @@ -60,6 +60,7 @@ opentelemetry-exporter-otlp-proto-http = "^1.38.0"
filelock = ">=3.20.1"
idna = ">=3.15,<4"
requests = ">=2.33.0"
pdfminer-six = { version = ">=20251107", optional = true }

@fercor-cisco fercor-cisco Aug 4, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 major (design): pdfminer-six is declared optional = true here but is not referenced by any entry in [project.optional-dependencies] (the crewai/all lists). This makes it a dead/orphaned dependency:

  • poetry install --all-extras (used by invoke install and CI) will NOT install it via this declaration — it's only pulled transitively through pdfplumber, so the direct floor never gates an install.
  • poetry check (the poetry-check pre-commit hook) warns about an optional dependency that isn't part of any extra.
  • Poetry omits unreferenced optional deps from the published package metadata, so a downstream pip install splunk-ao[crewai] would get no floor from this SDK. The vuln is currently avoided only because the regenerated lock happens to pin pdfplumber 0.11.10, which pins pdfminer to 20260107 transitively — not because of this line.

The stated goal ("guarantee a safe floor regardless of extras") isn't achieved by this declaration. Since the project uses PEP 621 [project.optional-dependencies], add the constraint to the crewai and all extras lists (e.g. "pdfminer.six>=20251107"), matching where the package actually ships. Alternatively, if you intend to rely purely on the transitive lock pin, remove this orphaned line to avoid the poetry check warning. Please confirm the intended approach.

🤖 Generated by the Astra agent

@shuningc shuningc Aug 4, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

@fercor-cisco fercor-cisco Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 minor (design): Missing the python = ">=3.11,<3.14" constraint that its siblings carry.

crewai (line 54) and litellm (line 49) are both gated to <3.14, and pdfplumber/pypdfium2/Pillow all retain python_version <= "3.13" markers in the regenerated lock. This declaration has no such gate, and the lock diff shows the effect: pdfminer-six's marker went from

python_version <= "3.13" and (extra == "crewai" or extra == "all")

to

extra == "crewai" or extra == "all"

and cryptography (pdfminer's native dep) likewise lost its python_version <= "3.13" guard for the crewai extra.

Concretely: on Python 3.14, poetry install --all-extras (CI, and invoke install) previously installed none of the PDF stack — crewai, pdfplumber, and pdfminer were all gated out. It now installs pdfminer.six plus cryptography on 3.14, where crewai and pdfplumber are still absent and nothing can use them. Not a break (pdfminer 20260107 needs >=3.10, and cryptography 49.0.0 ships cp314 wheels), just a compiled dependency added to a Python version that has no consumer for it.

Gating it matches the surrounding declarations and keeps the 3.14 install profile unchanged.

Suggested change
pdfminer-six = { version = ">=20251107", optional = true }
pdfminer-six = { version = ">=20251107", optional = true, python = ">=3.11,<3.14" }

🤖 Generated by the Astra agent

@fercor-cisco fercor-cisco Aug 5, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a minor edge case.


[tool.poetry.group.test.dependencies]
pytest = ">=9.0.3"
Expand Down
Loading