build(deps): keep PySide6 below 6.12 for 1.15.1

[nelsonduarte]

Summary

Temporary PySide6>=6.11.1,<6.12 cap in requirements.txt for the 1.15.1 release.

PySide6 6.12.0, uploaded to PyPI on 2026-10-08, moved WebEngine and Pdf into wheels of their own (PySide6_WebEngine==6.12.0.140 and PySide6_Pdf==6.12.0.140), which it now requires; 6.11 already shipped both inside PySide6_Addons. With only a floor, requirements.txt resolved to 6.12.0, so build.yml, tests.yml, the AppImage and the snap would all install it.

A Windows PyInstaller build barely changes: PDFApps.exe is 95,893,742 bytes with 6.11.2 and 96,414,643 with 6.12.0 (+0.54%). Neither bundle contains WebEngine; both contain Qt6Pdf.dll, pulled in by the imageformats/qpdf.dll plugin. The frozen macOS and Linux builds, the snap and the AppImage have not been tested with 6.12, hence the cap.

Removal condition

The cap is temporary: it goes, together with its guard test, once the frozen Windows, macOS and Linux builds, the snap and (while it ships) the AppImage all pass the smoke test with 6.12. Until then, Dependabot PRs that widen it are closed by hand.

Tests

• Shared parser. The parser test_dependency_security_floors.py already had moves to tests/_requirements_parsing.py, so the three dependency test files share it; pytest does not collect that module.
• _stale_pins(root_text, pin_text), fail-closed. The cap broke test_flatpak_pins_satisfy_the_root_requirements_floor: it read everything after >= as the floor, so >=6.11.1,<6.12 became (6, 11, 1, 6) and the 6.11.1 Flatpak pin looked stale. The check now strips inline comments, parses each line with packaging.Requirement, takes the highest floor of any clause and compares packaging Versions. A root line with an environment marker or with no floor, and a pin that is not an exact ==, are reported instead of skipped. Parametrized tests cover comments, markers, ~=, reordered clauses, the cap, two floors on one line, no floor, a pin that is not exact, and the real files with and without the cap.
• Ceiling guard, tests/test_pyside6_ceiling.py. Fails if the PySide6 specifier admits 6.12.0rc1, 6.12.0.dev0, 6.12.0, 6.12.1, 6.13.0 or 7.0.0 (pre-releases count), admits no 6.11.x release, or carries an environment marker.
• pypdf comment. The comment above the pypdf floor in requirements.txt is corrected: since ci: run the test suite on pull requests and pushes to main #190, tests.yml runs pytest on every pull request to main and every push to main.

Verification

Resolved before and after with pip install --dry-run --ignore-installed --report report.json -r requirements.txt:

• cp314 win_amd64: PySide6, Addons, Essentials and shiboken6 go from 6.12.0 to 6.11.2, and PySide6_WebEngine / PySide6_Pdf drop out (35 packages -> 33). Nothing else changes.
• cp310 (snap), adding --only-binary=:all: --python-version 3.10 and one --platform each for manylinux_2_34_x86_64, manylinux_2_28_x86_64 and manylinux2014_x86_64: the same diff (35 -> 33). Environment markers are still evaluated against the host interpreter, not the target.

pip-audit -r requirements.txt --strict: no known vulnerabilities.

Mutations in a scratch copy, all now caught: the pin comparison replaced by if False, lowest_admitted() always None, markers accepted (in each of the three test files), and in requirements.txt the cap widened to <6.13, replaced by !=6.12.0, or removed. Dropping prereleases=True from the guard is caught with packaging 25.0 but not 26.3, where contains() already counts pre-releases by default.

Full suite on PySide6 6.11.2: Windows (Py 3.14.6) 876 passed, 2 skipped; Linux (Ubuntu, Py 3.14.4) 875 passed, 3 skipped.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying pdfapps with    Cloudflare Pages

Latest commit:	744ab65
Status:	✅  Deploy successful!
Preview URL:	https://3e1796b8.pdfapps.pages.dev
Branch Preview URL:	https://build-cap-pyside6-below-6-12.pdfapps.pages.dev

View logs

[github-actions]

Python dependencies security check

pip-audit: requirements.txt

No known vulnerabilities.

pip-audit: flatpak/requirements-pinned.txt

No known vulnerabilities.

Outdated check (informational)

Package	Pin	Latest on PyPI	Status
PySide6	PySide6>=6.11.1,<6.12	6.12.0	outdated
pypdf	pypdf>=6.19.0	6.20.0	outdated
cryptography	cryptography>=50.0.1	50.0.2	outdated
qtawesome	qtawesome>=1.4.2	1.4.2	up-to-date
pillow	pillow>=12.3.0	12.3.0	up-to-date
pymupdf	pymupdf>=1.28.0	1.28.2	outdated
pytesseract	pytesseract>=0.3.13	0.3.13	up-to-date
python-docx	python-docx>=1.2.0	1.2.0	up-to-date
python-pptx	python-pptx>=1.0.2	1.0.2	up-to-date
openpyxl	openpyxl>=3.1.5	3.1.5	up-to-date
beautifulsoup4	beautifulsoup4>=4.15.0	4.15.0	up-to-date
ebooklib	ebooklib>=0.20	0.20	up-to-date
lxml	lxml>=6.1.3	6.1.3	up-to-date
urllib3	urllib3>=2.8.0	2.8.0	up-to-date
idna	idna>=3.18	3.20	outdated
pyinstaller	pyinstaller>=6.22.3	6.22.3	up-to-date

Auto-generated by security-deps workflow. Merge is blocked only when pip-audit --strict reports vulnerabilities.