deps(deps): Bump the python-patch group across 1 directory with 4 updates

[dependabot]

Bumps the python-patch group with 4 updates in the / directory: striprtf, rapidfuzz, py7zr and fpdf2.

Updates striprtf from 0.0.29 to 0.0.33

Release notes

Sourced from striprtf's releases.

new release v0.0.33

new version v.0.0.33

new release v0.0.32

No release notes provided.

new release

Fixes #66

new release

Fixed joshy/striprtf#63

Changelog

Sourced from striprtf's changelog.

v0.0.33 - 17.08.26

• Bytes after the document closing brace are no longer part of the output. An rtf file is a single { <header> <document> } group, everything after it is discarded like Word and WordPad do. Fixes #69. Note that this also ends support for parsing several rtf documents concatenated into one string, only the first one is returned now. See test_issue_69.py
• Fixed a bottleneck where the font table regex was applied to the whole document instead of only the {\fonttbl ...} group. Parsing a 2.4 MB document went from 140s down to 0.37s. See test_large_rtf.py

v0.0.32 - 27.04.206

• Wrong _version file

v0.0.31 - 23.04.206

• Accidently added twine as runtime dependency

v0.0.30 - 23.04.206

• Fixed joshy/striprtf#63
• Added py.typed for MyPy support

Commits

• 4f856ae twine fix
• 890a959 new version v.0.0.33
• 756a2fb Discard bytes after the document closing brace
• 617abf0 Read expected text fixtures as utf-8 in tests
• 8b3ec9c Fix font table regex bottleneck on large documents
• f95578f new version v.0.0.32
• b49e251 new version
• 39792ef new version
• 2bc1f3a Merge pull request #62 from babenek/master
• be57917 copy py.typed into build package
• Additional commits viewable in compare view

Updates rapidfuzz from 3.14.3 to 3.14.5

Release notes

Sourced from rapidfuzz's releases.

Release 3.14.5

Fixed

• fix release ci attempting to upload a pyodide wheel

Release 3.14.4

Added

• add risc64 wheels
• add support for taskflow 4.0.0

Changed

• upgrade to Cython==3.2.4.

Fixed

• fix type hints for extractOne when no score_cutoff is provided

Changelog

Sourced from rapidfuzz's changelog.

Changelog

[3.14.6] - 2026-08-30 ^^^^^^^^^^^^^^^^^^^^^ Fixed

* fix some divergences in the pure Python fallback
* fix compatibility with new Cython versions
* fixed potential out of bound access inside Editops.remove_subsequence
* fixed handling python fallback implementation of Editops.remove_subsequence
Removed

• dropped support for Python 3.10
• dropped wheels for experimental Python 3.13 free threaded

[3.14.5] - 2026-04-07 ^^^^^^^^^^^^^^^^^^^^^ Fixed

* fix release ci attempting to upload a pyodide wheel
[3.14.4] - 2026-04-06
^^^^^^^^^^^^^^^^^^^^^
Added

• add risc64 wheels
• add support for taskflow 4.0.0

Changed

* upgrade to ``Cython==3.2.4``.
Fixed
* fix type hints for extractOne when no score_cutoff is provided
[3.14.3] - 2025-11-01

^^^^^^^^^^^^^^^^^^^^^

Fixed



add missing pypy and freethreaded linux wheels

Removed

• drop s390x and ppc64le wheels since they are virtually unused and require extremely long to build under emulation

[3.14.2] - 2025-10-30 ^^^^^^^^^^^^^^^^^^^^^

... (truncated)

Commits

• edf9f3c fix release ci
• 3d8470b enable verbose publish
• 7fd4ee2 Bump the github-actions group across 1 directory with 3 updates
• 9691cf1 tag release
• fd16748 ci: switch riscv64 from QEMU to native RISE runner
• 7f7d58b ci: add riscv64 wheel builds via QEMU
• f4b5694 Bump pypa/cibuildwheel from 3.3.1 to 3.4.0 in the github-actions group
• f2873ce Bump the github-actions group across 1 directory with 3 updates
• 4e48509 support Taskflow 4.0.0
• 7048039 Bump the github-actions group across 1 directory with 4 updates
• Additional commits viewable in compare view

Updates py7zr from 1.1.0 to 1.1.3

Release notes

Sourced from py7zr's releases.

Release version 1.1.3: Fix multiple vulnerabilities

• CVE-2026-23879: Arbitrary File Write Vulnerability in py7zr (high severity)
  • Harden check of path traversal and enhance test cases to reproduce many attack scenarios.
• CVE-2026-55206: O(n^2) algorithmic complexity DoS in PackInfo._read() in py7zr
  • Enforced variation of the parameter with a limit and optimized calculation algorithm to prevent excessive CPU consumption.
• CVE-2026-55195: py7zr <= 1.1.2: Decompression bomb (zip bomb) denial of service via unchecked extraction size
  • Added check of extraction size and introduced max_extract_size as constructor parameter to guard against excessive decompression.

Update path sanitize

No release notes provided.

Changelog

Sourced from py7zr's changelog.

v1.1.3_

Security

• CVE-2026-23879: Arbitrary File Write Vulnerability in py7zr (high severity)
  • Harden check of path traversal and enhance test cases to reproduce many attack scenarios.
• CVE-2026-55206: O(n^2) algorithmic complexity DoS in PackInfo._read() in py7zr
  • Enforced variation of the parameter with a limit and optimized calculation algorithm to prevent excessive CPU consumption.
• CVE-2026-55195: py7zr <= 1.1.2: Decompression bomb (zip bomb) denial of service via unchecked extraction size
  • Added check of extraction size and introduced max_extract_size as constructor parameter to guard against excessive decompression.

Notes:

• Fixed three security vulnerabilities in the py7zr library.
• Improvements made include path traversal hardening, optimization of CPU-intensive algorithms, and protection against zip bombs.

Fixed

• BufferError when calling Py7zBytesIO.size() (#736,#737)
• fix: extractall() raises TypeError: int() argument must be a string, a bytes-like object or a real number, not 'NoneType' (#734,#735)

Changed

• feat(io): add Py7zIO.close() lifecycle hook called once per extracted file (#699,#732)
• test: Bump dependency libarchive@3.8.7
• ci: bump numerous actions with SHA256 hash and newer versions (#729,#730)

v1.1.2_

Security

• security: fix Zip-Slip vulnerability by symlink

Removed

• Remove Code of Conduct from repository.

Changed

• remove unused _lzma imports

v1.1.1_

Fixed

• fix: default unix file attributes with proper permissions (#705)

... (truncated)

Commits

• e278bc0 Release v1.1.3: Multiple security fixes
• e4a225b docs: update authors and changelog with recent contributions and security fixes
• 94db766 Merge commit from fork
• d9ee25c Merge commit from fork
• c1c8001 Merge commit from fork
• 7e03185 Merge pull request #732 from SAY-5/feat/issue-699-py7zio-close
• 2de71fb Merge pull request #735 from gaoflow/fix-734-missing-lastwritetime
• f429952 Merge branch 'master' into fork/SAY-5/feat/issue-699-py7zio-close
• b181a4b Merge branch 'master' into fork/gaoflow/fix-734-missing-lastwritetime
• 1534b3f Merge pull request #737 from miurahr/topic/miurahr/fix-pypy-getbuffer
• Additional commits viewable in compare view

Updates fpdf2 from 2.8.7 to 2.8.8

Release notes

Sourced from fpdf2's releases.

Add resource access controls, SVG complexity limits, Optional Content Groups, and other features and bug fixes

[2.8.8] - 2026-08-09

[!WARNING] Upgrading to fpdf2 2.8.8 is strongly recommended for applications that render user-provided images, SVGs, or HTML content.

Added

• Punjabi (pa) tutorial translation - thanks to @​Pawansingh3889
• FPDF.svg_limits and SVGLimits to configure SVG complexity limits while rendering SVG images
• resource_access_policy and Security considerations documentation
• FPDF.optional_content() context manager to mark content as visible on screen only or in print only, using PDF Optional Content Groups - cf. [issue #441](py-pdf/fpdf2#441), based on a recipe by @​digidigital - thanks to @​eugen-goebel
• basic support for SVG <symbol> elements in the SVG parser - thanks to @​Theo1335
• basic support for SVG <switch> elements in the SVG parser - cf. [issue #537](py-pdf/fpdf2#537) - thanks to @​dannymaaz
• support for keeping aspect ratio for images in templates - cf. [issue #1118](py-pdf/fpdf2#1118) - thanks to @​prateek-dagar

Fixed

• custom height passed to Paragraph.ln() in a text region is now applied to the line it terminates instead of the first line of the following paragraph - cf. [issue #1786](py-pdf/fpdf2#1786) - thanks to @​Sanjays2402
• the optional numpy import in image_parsing.py no longer crashes on CPUs unsupported by numpy's manylinux wheel baseline; RuntimeError is now treated the same as ImportError, so numpy degrades to unavailable instead of taking down import fpdf - cf. [issue #1908](py-pdf/fpdf2#1908) - thanks to @​stumpylog
• font state (family, style, size, current font, and the page-level "font is set" flag) no longer leaks back onto the FPDF instance after a text_columns() / text_region() context exits, so a subsequent pdf.cell() / pdf.write() renders at the caller's font instead of the last paragraph's - cf. [issue #1804](py-pdf/fpdf2#1804) - thanks to @​Pawansingh3889
• text rendering when the first text on a page starts with a fallback glyph - cf. [issue #1772](py-pdf/fpdf2#1772)
• preserve boundary-neutral formatting during bidirectional text preprocessing - cf. [issue #1779](py-pdf/fpdf2#1779)
• transform application on user space gradients - cf. [issue #1784](py-pdf/fpdf2#1784)
• dependency extras for camelot-py and endesive on pyproject.toml - cf. [issue #1792](py-pdf/fpdf2#1792)
• preserve link annotations during dry-run of FPDF.multi_cell - cf. [issue #1807](py-pdf/fpdf2#1807) - thanks to @​CoLa5
• preserve two consecutive markdown links (without space inbetween) - cf. [issue #1814](py-pdf/fpdf2#1814) - thanks to @​CoLa5
• support markdown style around markdown links - cf. [issue #1826](py-pdf/fpdf2#1826) - thanks to @​CoLa5
• Reset gstate for ToC-rendering - cf. [issue #1837](py-pdf/fpdf2#1837) - thanks to @​CoLa5
• preserve markdown format in FPDF.multi_cell in dry-run - cf. [issue #1840](py-pdf/fpdf2#1840) - thanks to @​CoLa5
• fix page order after dry-run of FPDF.multi_cell in ToC - cf. [issue #1836](py-pdf/fpdf2#1836) - thanks to @​CoLa5
• rendering SVG arcs with very small sweeps that previously rounded to zero - cf. [issue #1831](py-pdf/fpdf2#1831)
• spurious "Not enough horizontal space to render a single character" error when text without break opportunities is split into many small fragments, e.g. by a fallback font alternating with the main font - cf. [issue #1250](py-pdf/fpdf2#1250) - thanks to @​uttam12331
• number of surviving escape characters - cf. [issue #1215](py-pdf/fpdf2#1215) - thanks to @​amidou-naba
• leading spaces on new lines inside <pre> and <pre><code> blocks are no longer dropped - cf. [issue #1063](py-pdf/fpdf2#1063) - thanks to @​eugen-goebel
• FPDF.set_font() can restore current_font when the selected font state diverged - cf. [PR #1872](py-pdf/fpdf2#1872) - thanks to @​gaoflow
• embed CID-keyed CFF fonts as raw CFF programs so browser PDF viewers render them correctly - cf. [issue #1874](py-pdf/fpdf2#1874)
• fixed broken links on documentation not directly leading to the API reference - cf. [issue #1876](py-pdf/fpdf2#1876) - thanks to @​iamfazakb
• reject SVG <use> cycles and excessive nested expansion to prevent resource exhaustion in FPDF.image()
• count SVG <switch> elements in SVG complexity limits
• declare the default base state and display order for Optional Content Groups so PDF viewers can list layers correctly - cf. [issue #1895](py-pdf/fpdf2#1895)

Changed

• skip byte-for-byte compressed data comparison when zlib-ng is detected, regardless of OS

Changelog

Sourced from fpdf2's changelog.

[2.8.8] - 2026-08-09

Added

• Punjabi (pa) tutorial translation - thanks to @​Pawansingh3889
• FPDF.svg_limits and SVGLimits to configure SVG complexity limits while rendering SVG images
• resource_access_policy and Security considerations documentation
• FPDF.optional_content() context manager to mark content as visible on screen only or in print only, using PDF Optional Content Groups - cf. [issue #441](py-pdf/fpdf2#441), based on a recipe by @​digidigital - thanks to @​eugen-goebel
• basic support for SVG <symbol> elements in the SVG parser - thanks to @​Theo1335
• basic support for SVG <switch> elements in the SVG parser - cf. [issue #537](py-pdf/fpdf2#537) - thanks to @​dannymaaz
• support for keeping aspect ratio for images in templates - cf. [issue #1118](py-pdf/fpdf2#1118) - thanks to @​prateek-dagar

Fixed

• custom height passed to Paragraph.ln() in a text region is now applied to the line it terminates instead of the first line of the following paragraph - cf. [issue #1786](py-pdf/fpdf2#1786) - thanks to @​Sanjays2402
• the optional numpy import in image_parsing.py no longer crashes on CPUs unsupported by numpy's manylinux wheel baseline; RuntimeError is now treated the same as ImportError, so numpy degrades to unavailable instead of taking down import fpdf - cf. [issue #1908](py-pdf/fpdf2#1908) - thanks to @​stumpylog
• font state (family, style, size, current font, and the page-level "font is set" flag) no longer leaks back onto the FPDF instance after a text_columns() / text_region() context exits, so a subsequent pdf.cell() / pdf.write() renders at the caller's font instead of the last paragraph's - cf. [issue #1804](py-pdf/fpdf2#1804) - thanks to @​Pawansingh3889
• text rendering when the first text on a page starts with a fallback glyph - cf. [issue #1772](py-pdf/fpdf2#1772)
• preserve boundary-neutral formatting during bidirectional text preprocessing - cf. [issue #1779](py-pdf/fpdf2#1779)
• transform application on user space gradients - cf. [issue #1784](py-pdf/fpdf2#1784)
• dependency extras for camelot-py and endesive on pyproject.toml - cf. [issue #1792](py-pdf/fpdf2#1792)
• preserve link annotations during dry-run of FPDF.multi_cell - cf. [issue #1807](py-pdf/fpdf2#1807) - thanks to @​CoLa5
• preserve two consecutive markdown links (without space inbetween) - cf. [issue #1814](py-pdf/fpdf2#1814) - thanks to @​CoLa5
• support markdown style around markdown links - cf. [issue #1826](py-pdf/fpdf2#1826) - thanks to @​CoLa5
• Reset gstate for ToC-rendering - cf. [issue #1837](py-pdf/fpdf2#1837) - thanks to @​CoLa5
• preserve markdown format in FPDF.multi_cell in dry-run - cf. [issue #1840](py-pdf/fpdf2#1840) - thanks to @​CoLa5
• fix page order after dry-run of FPDF.multi_cell in ToC - cf. [issue #1836](py-pdf/fpdf2#1836) - thanks to @​CoLa5
• rendering SVG arcs with very small sweeps that previously rounded to zero - cf. [issue #1831](py-pdf/fpdf2#1831)
• spurious "Not enough horizontal space to render a single character" error when text without break opportunities is split into many small fragments, e.g. by a fallback font alternating with the main font - cf. [issue #1250](py-pdf/fpdf2#1250) - thanks to @​uttam12331
• number of surviving escape characters - cf. [issue #1215](py-pdf/fpdf2#1215) - thanks to @​amidou-naba
• leading spaces on new lines inside <pre> and <pre><code> blocks are no longer dropped - cf. [issue #1063](py-pdf/fpdf2#1063) - thanks to @​eugen-goebel
• FPDF.set_font() can restore current_font when the selected font state diverged - cf. [PR #1872](py-pdf/fpdf2#1872) - thanks to @​gaoflow
• embed CID-keyed CFF fonts as raw CFF programs so browser PDF viewers render them correctly - cf. [issue #1874](py-pdf/fpdf2#1874)
• fixed broken links on documentation not directly leading to the API reference - cf. [issue #1876](py-pdf/fpdf2#1876) - thanks to @​iamfazakb
• reject SVG <use> cycles and excessive nested expansion to prevent resource exhaustion in FPDF.image()
• count SVG <switch> elements in SVG complexity limits
• declare the default base state and display order for Optional Content Groups so PDF viewers can list layers correctly - cf. [issue #1895](py-pdf/fpdf2#1895)

Changed

• skip byte-for-byte compressed data comparison when zlib-ng is detected, regardless of OS

Commits

• e1fc653 release v2.8.8 (#1916)
• 42ec664 add Sanjays2402 as a contributor for code (#1915)
• af9d7dc fix(text_region): apply Paragraph.ln(h) height to the line it terminates (#1904)
• 81951f8 add stumpylog as a contributor for bug, and code (#1913)
• b30c38c Fix: catch RuntimeError alongside ImportError for the optional numpy import (...
• 63df0d0 Update github/codeql-action action to v4.37.6 (#1910)
• 11a30e6 Update crate-ci/typos action to v1.49.0 (#1911)
• f65707b Update step-security/harden-runner action to v2.20.1 (#1912)
• a7f7c89 Update github/codeql-action action to v4.37.4 (#1907)
• fe9d8f5 Update pypa/gh-action-pypi-publish action to v1.14.2 (#1906)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.