Skip to content

deps: bump docling and docling-slim to 2.132.0 in lockfiles - #29

Open
katsugtgz wants to merge 1 commit into
LoredCast:mainfrom
katsugtgz:deps/docling-2.132.0
Open

katsugtgz wants to merge 1 commit into
LoredCast:mainfrom
katsugtgz:deps/docling-2.132.0

Conversation

@katsugtgz

Copy link
Copy Markdown

Updates docling to 2.132.0 and docling-slim to 2.132.0 in locks/cuda.txt and locks/full.txt.

Evidence:

  • both lockfiles pinned docling==2.130.0 and docling-slim==2.130.0
  • pip-audit reported CVE-2026-105748, PYSEC-2026-4189, PYSEC-2026-4190, PYSEC-2026-4191, PYSEC-2026-4192, PYSEC-2026-4193, PYSEC-2026-4194, PYSEC-2026-4195 for docling 2.130.0 before the update
  • updated versions: docling 2.132.0, docling-slim 2.132.0, hashes taken from PyPI

Validation:

  • pip-audit no longer reports advisories for docling or docling-slim after the update
  • pip install --dry-run with the new pinned hashes resolves both packages

Companion pins stay compatible with docling 2.132.0: docling-core 2.98.1 (needs >=2.98.0,<3), docling-ibm-models 4.0.3 (needs >=4.0.2,<5), docling-parse 7.21.0.

Scope: lockfile update only.

@LoredCast

Copy link
Copy Markdown
Owner

Thanks, this is a worthwhile security update, and the replacement hashes match PyPI. However, Docling 2.132.0’s standard PDF dependencies require docling-parse>=7.22.1,<8.0.0, while both lockfiles still pin 7.21.0. Please update that dependency and its hashes, validate the complete lockfiles, and confirm that the full/cuda images build and a Docling PDF conversion succeeds before I can merge. I will look into it otherwise

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants