# Temporary ceiling for the 1.15.1 release. PySide6 6.12.0 (2026-10-08)
# moved WebEngine and Pdf into wheels of their own; 6.11 already shipped
# both inside PySide6_Addons. A Windows PyInstaller build barely changes
# (PDFApps.exe +0.54%), but the frozen macOS and Linux builds, the snap
# and the AppImage have not been tested with 6.12. Remove the ceiling,
# together with tests/test_pyside6_ceiling.py, once the frozen Windows,
# macOS and Linux builds, the snap and (while it ships) the AppImage
# all pass the smoke test with 6.12. Until then, close by hand any
# Dependabot PR that widens it.
PySide6>=6.11.1,<6.12
# PYSEC-2026-3655 / PYSEC-2026-3656 (fixed in 6.15.0), CVE-2026-82398
# (6.15.0), CVE-2026-84309 (6.16.0) and CVE-2026-84310 / CVE-2026-84311
# (6.16.1). Then PYSEC-2026-4158 (6.17.0), PYSEC-2026-4153 (6.18.0),
# PYSEC-2026-4154 / PYSEC-2026-4155 / PYSEC-2026-4156 (6.18.1) and
# PYSEC-2026-4157 / PYSEC-2026-4159 / PYSEC-2026-4160 (6.19.0), all
# memory or runtime exhaustion on crafted PDFs. 6.19.0 is the first
# release clear of all fourteen; 6.18.1, which build.yml installed for
# every v1.15.0 binary it built (run 34720950897), still carries three.
# "pip-audit -r" audits the newest release that satisfies ">=", not the
# floor, so a floor that admits vulnerable releases audits clean for as
# long as a fixed release exists.
# tests/test_dependency_security_floors.py fails if the floor drops
# below 6.19.0, wherever pytest runs; tests.yml runs it on every pull
# request to main and every push to main. An advisory published later
# against the floor turns nothing that audits this file red once a
# fixed release exists. Do not lower it.
pypdf>=6.19.0
# GHSA-537c-gmf6-5ccf: signature verification bypass in legacy OpenSSL
# providers fixed in 48.0.1, and PYSEC-2026-3552 / CVE-2026-69247
# (Bleichenbacher oracle in PKCS#7 EnvelopedData decryption, introduced
# in 44.0.0) fixed in 50.0.0. 49.0.0 is the only 49.x release and it is
# vulnerable, so the floor must stay at 50 or above: do not lower it.
# Also the AES backend pypdf resolves at import time (pypdf declares it
# only as the optional `crypto` extra), so without it AES-encrypted PDFs
# raise DependencyError.
cryptography>=50.0.1
qtawesome>=1.4.2
pillow>=12.3.0
pymupdf>=1.28.0
pytesseract>=0.3.13
python-docx>=1.2.0
python-pptx>=1.0.2
openpyxl>=3.1.5
beautifulsoup4>=4.15.0
ebooklib>=0.20
# Transitive of python-docx, python-pptx, ebooklib, pikepdf.
# Pin to >=6.1.0 to fix PYSEC-2026-87 (XXE — lxml < 6.1.0 resolves
# external entities by default, allowing crafted DOCX/PPTX/EPUB/PDF-XMP
# files to read arbitrary local files).
lxml>=6.1.3
# No package in this file requires urllib3 and app/ does not import it;
# only requests, pulled in by pip-audit from requirements-dev.txt,
# depends on it. Floor for advisories
# PYSEC-2026-141 / 142 / GHSA series for urllib3 < 2.7.0, then
# PYSEC-2026-4175 / PYSEC-2026-4176 / PYSEC-2026-4177 (published
# 2026-10-01, all affecting 2.7.0), fixed in 2.8.0.
urllib3>=2.8.0
# Same as urllib3: no package in this file requires idna (urllib3 does
# not either) and app/ does not import it; only requests depends on it.
# Floor for PYSEC-2026-215, idna < 3.15.
idna>=3.18
pyinstaller>=6.22.3
