⬆️ chore(deps): upgrade all dependencies to latest versions - #1
Merged
Conversation
PyMuPDF >=1.23.0 -> >=1.28.0 (resolves to 1.28.0, MuPDF 1.29.0). This is the only runtime dependency; there are no transitive deps. No code changes were required. The extractors use a small, stable slice of the API (fitz.open, page.get_text, page.find_tables, page.number, doc.close, Document indexing/slicing), all unchanged across 1.23 -> 1.28. The `import fitz` alias still works on 1.28. Verified by re-running both PDF extractors against the committed source PDFs and diffing the output: extracted_cnssi_1253.json (1189 controls) and extracted_classified_information.json are byte-identical to the JSON already in the repo. Also gitignores .venv so the local uv environment is never committed.
Org-wide standardization on Python 3.13 (3.13 rather than 3.14 because whisperx in a sibling repo caps at <3.14). - Add .python-version pinning 3.13 - README + CLAUDE.md: document 3.13 and switch setup/run commands to uv - Note the extractors' write-to-CWD behavior so verification runs don't clobber the committed JSON No pyproject.toml exists here, so there is no requires-python to change. Verified on 3.13: PyMuPDF 1.28.0 resolves; both extractors regenerate output byte-identical to the committed JSON (diff clean, sha256 match); nist_sorter reports ordering already correct; all 11 tracked .py files compile. No test suite and no CI exist in this repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proactive "update everything" pass. No open Dependabot alerts; this is hygiene, not a security fix.
Dependency changes
>=1.23.0>=1.28.0PyMuPDF is the repo's only dependency and it has no transitive dependencies, so this is the complete upgrade surface. Kept the existing
>=style rather than converting to a==pin, since the file was not previously pinned.Code changes required
None. The extractors touch a small and stable slice of the API —
fitz.open,page.get_text,page.find_tables,page.number,doc.close, andDocumentindexing/slicing. All behave identically on 1.28, and the legacyimport fitzalias still resolves.Also added
.venvto.gitignoreso the local uv environment can't be committed.Verification
No automated test suite exists in this repo (
CLAUDE.mdstates this explicitly: "No automated tests exist"), and there are no GitHub Actions workflows. So instead of a test run, the upgrade was verified end-to-end against the real PDFs, with the regenerated JSON diffed against the JSON already committed to the repo. That is the strongest available signal: it proves 1.28.0 produces bit-for-bit identical extraction output.Pinned back / skipped / left broken
Nothing. No package needed to be held back and nothing is left failing.
Follow-up commit: standardize on Python 3.13
Second commit on this branch (
⬆️ chore: standardize on Python 3.13), part of the org-wide move to a single Python version. 3.13 rather than 3.14 because whisperx in a sibling repo caps at<3.14.Changes
.python-version3.13.README.mduv venv --python 3.13+uv pip install -r requirements.txtinstead of barepip install PyMuPDF; run commands useuv run python. Dependencies table:Python 3→Python 3.13.CLAUDE.mduvtreatment for the development commands, plus a note on the extractors' write-to-CWD behavior.No
requires-pythonchange — this repo hasrequirements.txtonly, nopyproject.toml, so there is nothing to bump and none was invented.No
.pyfiles were modified by this commit. The version standardization is config and docs only.Verification
Same approach as the dependency commit above, re-run on 3.13. Extractor scripts write to the current working directory with hardcoded filenames, so every regeneration was run from a scratch directory and diffed against the committed JSON, leaving the repo copies untouched.
Both JSON diffs were byte-identical, confirmed independently by
diffand by sha256. Python 3.13 changes nothing about extraction output.Not run
There is no test suite in this repo (
CLAUDE.md: "No automated tests exist") and no CI — no.github/directory and no workflow files exist. So no tests and no pipeline were run, because there are none to run. The extraction diff above is the substitute signal.Pinned back / skipped / left broken
Nothing. One deliberate non-change:
README.mdstill showspython -m http.server 8000for serving the static site locally. That is a generic static file server forindex.html, unrelated to the extraction toolchain and to any pinned version, so it was left alone.