fix: raise the pypdf and urllib3 security floors

[nelsonduarte]

What changes

• requirements.txt: the pypdf floor moves from >=6.16.2 to >=6.19.0, and the urllib3 floor from >=2.7.0 to >=2.8.0. The comments above both entries are rewritten (see below).
• flatpak/requirements-pinned.txt: the Flatpak pin moves from pypdf==6.16.2 to pypdf==6.19.0.
• flatpak/python-modules.yml: the pypdf wheel URL and sha256 are updated to match the 6.19.0 pin.
• tests/test_dependency_security_floors.py (new): fails when a requirements.txt floor for pypdf, cryptography, urllib3, lxml or idna admits a release below the first one clear of every advisory OSV listed on 2026-10-05, or admits a release listed as affected. It also rejects a floor conditioned by an environment marker, since pip skips that line wherever the marker is false.

Why

pypdf. Releases 6.16.2 through 6.18.1 carry some or all of PYSEC-2026-4153 to PYSEC-2026-4160, all memory or runtime exhaustion on crafted PDFs. 6.19.0 is the first release clear of all eight (and of the six earlier advisories the old floor already covered).

This is not theoretical for shipped builds. Builds resolve dependencies at build time, and build.yml installed pypdf 6.18.1 for every v1.15.0 binary (run 34720950897), which still carries three of these advisories.

PYSEC-2026-4157 is reachable from the app. The editor's form tab sends every field back through PdfWriter.update_page_form_field_values (app/editor/tab.py:1399) with auto_regenerate=True and flatten=False. That path still regenerates the appearance stream of /Tx and /Ch fields, although the advisory says it "requires updating form field values with flattening enabled". Measured: a 1.4 MB PDF whose multiline /Tx value has 100,000 lines held the GUI thread for 51 s on 6.18.1 against 1.5 s on 6.19.0, and the cost grows quadratically with the line count. PYSEC-2026-4159 and PYSEC-2026-4160 are not reachable: app/ never calls PdfReader.page_labels or .attachments, the only entry points to the fixed code.

Why the audit did not catch the floor. pip-audit -r requirements.txt audits the newest release that satisfies >=, not the floor itself. A floor that admits vulnerable releases therefore audits clean for as long as a fixed release exists. The new test closes that blind spot for the five packages it covers.

urllib3. PYSEC-2026-4175, PYSEC-2026-4176 and PYSEC-2026-4177 (published 2026-10-01) all affect 2.7.0 and are fixed in 2.8.0. The Flatpak build does not install urllib3.

The old comments called urllib3 a transitive dependency of cryptography and requests, and idna one of urllib3 and requests. In a venv installed from requirements.txt alone, pip show reports an empty Required-by for both, urllib3 does not depend on idna, and app/ imports neither. Only requests, pulled in by pip-audit from requirements-dev.txt, depends on them. The comments now say so.

Fixes the red scheduled security-deps run on main

The scheduled security-deps.yml run on main (run 37313643981, 2026-10-05) failed its strict gate on the Flatpak pin pypdf==6.16.2, with eight findings. This PR moves that pin to 6.19.0 and should turn the gate green. The requirements.txt half of the same gate passed on that run, for the reason described above.

Limits of the new test

• It only knows the advisories it lists, as published on OSV on 2026-10-05. An advisory published later is not covered until the test is updated.
• It does not run in CI yet: as of today no workflow on main runs pytest. That changes once ci: run the test suite on pull requests and pushes to main #190 is merged.

Left open (not in this PR)

• Whether urllib3 and idna should move from requirements.txt to requirements-dev.txt, given that only a dev dependency needs them.

🤖 Generated with Claude Code

[github-actions]

Python dependencies security check

pip-audit: requirements.txt

No known vulnerabilities.

pip-audit: flatpak/requirements-pinned.txt

No known vulnerabilities.

Outdated check (informational)

Package	Pin	Latest on PyPI	Status
PySide6	PySide6>=6.11.1	6.11.2	outdated
pypdf	pypdf>=6.19.0	6.19.0	up-to-date
cryptography	cryptography>=50.0.1	50.0.2	outdated
qtawesome	qtawesome>=1.4.2	1.4.2	up-to-date
pillow	pillow>=12.3.0	12.3.0	up-to-date
pymupdf	pymupdf>=1.28.0	1.28.2	outdated
pytesseract	pytesseract>=0.3.13	0.3.13	up-to-date
python-docx	python-docx>=1.2.0	1.2.0	up-to-date
python-pptx	python-pptx>=1.0.2	1.0.2	up-to-date
openpyxl	openpyxl>=3.1.5	3.1.5	up-to-date
beautifulsoup4	beautifulsoup4>=4.15.0	4.15.0	up-to-date
ebooklib	ebooklib>=0.20	0.20	up-to-date
lxml	lxml>=6.1.1	6.1.3	outdated
urllib3	urllib3>=2.8.0	2.8.0	up-to-date
idna	idna>=3.18	3.20	outdated
pyinstaller	pyinstaller>=6.21.0	6.22.3	outdated

Auto-generated by security-deps workflow. Merge is blocked only when pip-audit --strict reports vulnerabilities.