[dependabot]

Bumps pdfminer-six from 20251230 to 20260107.

Release notes

Sourced from pdfminer-six's releases.

20260107

Added

• Support cmap types 6, 10 and 12 (#598)

Fixed

• Encapsulate error when failing to get attribute or data from stream (#1225, #1226)
• Validate maximum size of xref start (#1227)
• Use lazy %-style formatting for logging (#1234)

Removed

• Unused methods close, tell and poll on PSBaseParser (#1230)

Changelog

Sourced from pdfminer-six's changelog.

[20260107]

Added

• Support cmap types 6, 10 and 12 (#598)

Fixed

• Encapsulate error when failing to get attribute or data from stream (#1225, #1226)
• Validate maximum size of xref start (#1227)
• Use lazy %-style formatting for logging (#1234)

Removed

• Unused methods close, tell and poll on PSBaseParser (#1230)

Commits

• 9e1243c chore: bump version
• 0d38cef perf: use lazy %-style logging (#1234)
• 3067706 remove: unused methods close, tell and poll on PSBaseParser (#1230)
• c706bdc fix: validate maximum size of xref start (#1227)
• 48f3404 fix: encapsulate error when parsing data from stream (#1226)
• 426116f fix: encapsulate errors when failing to get attribute from stream (#1225)
• a2a353f feat: add support for cmap types 6, 10 and 12 (#1213)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Closing automatically: stale bot PR, not merge-clean, and older than the allowed age threshold. A fresh bot PR can be regenerated later if the update is still desired.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

[code-genius-code-coverage]

The files' contents are under analysis for test generation.

[seoguard]

🔍 SEO Review — 4 issues found

🔴 Critical (4)

File	Issue	Fix
.claude/plugins/marketplaces/claude-plugins-official/plugins/session-report/skills/session-report/template.html	Missing meta description Meta descriptions are used as SERP snippets. Without one, Google auto-generates one from page content, which is typical…	Add <meta name="description" content="Your description here (150-160 chars)" /> inside <head>
.claude/plugins/marketplaces/claude-plugins-official/plugins/session-report/skills/session-report/template.html	Missing <h1> tag Every page must have exactly one <h1> tag. It signals the primary topic of the page to search engines.	Add exactly one <h1>Your Primary Topic</h1> tag to the page
.claude/plugins/marketplaces/claude-plugins-official/plugins/skill-creator/skills/skill-creator/assets/eval_review.html	Missing meta description Meta descriptions are used as SERP snippets. Without one, Google auto-generates one from page content, which is typical…	Add <meta name="description" content="Your description here (150-160 chars)" /> inside <head>
.claude/plugins/marketplaces/claude-plugins-official/plugins/skill-creator/skills/skill-creator/eval-viewer/viewer.html	Missing meta description Meta descriptions are used as SERP snippets. Without one, Google auto-generates one from page content, which is typical…	Add <meta name="description" content="Your description here (150-160 chars)" /> inside <head>

✅ 24 checks passed

• missing-title
• multiple-h1
• image-missing-alt
• missing-lang
• missing-viewport
• accidental-noindex
• invalid-json-ld
• back-button-hijacking
• missing-title
• missing-h1
• multiple-h1
• image-missing-alt
• missing-lang
• missing-viewport
• accidental-noindex
• invalid-json-ld
• back-button-hijacking
• missing-title
• image-missing-alt
• missing-lang
• missing-viewport
• accidental-noindex
• invalid-json-ld
• back-button-hijacking

---

SEOCode Free — running 10 core rules. Upgrade to Pro ($29/mo) to unlock all 86 rules including performance, structured data, and internationalisation checks.

---

Rule set v1.2.4 · Updated 2026-05-24

[haiec-no-ai-testing-ai]

🛡️ HAIEC Attestation Readiness: 60 → 60 (0)

Frameworks Evaluated: SOC2, ISO27001, PCI-DSS
Progress: ██████░░░░ 60%

HAIEC scans your repository for compliance evidence across multiple frameworks simultaneously.

⚠️ 2 Compliance Gaps Found

across 3 frameworks

🟡 Change documentation not maintained [MEDIUM]

Affects: ISO27001 · PCI-DSS

Why This Matters: CRITICAL VIOLATION: Uncontrolled changes to payment systems can result in immediate suspension of payment processing privileges and fines up to $100,000 per month until fixed.

How to Fix:

1. IMMEDIATELY enable branch protection
2. Require 2+ approvals for payment code
3. Enable required status checks
4. Document all changes

⏱️ ~10 min to fix

---

⚪ Missing CHANGELOG.md [LOW]

Affects: SOC2

Why This Matters: Code can be merged without any review. A single developer mistake could deploy a bug that crashes your service or leaks customer data. No second pair of eyes = no safety net.

How to Fix:

1. Go to Settings > Branches > Edit main protection
2. Enable "Require approvals" and set to at least 1
3. Enable "Dismiss stale approvals when new commits are pushed"

⏱️ ~3 min to fix

---

💡 Quick Wins: 2 issues fixable in ~8 minutes

---

💡 First scan complete. Showing top 2 priority items. View complete analysis →

🎯 Next Steps

1. View Complete Report → - See all findings and recommendations
2. Run Detailed Scan → - Get comprehensive compliance analysis

💡 Quick wins: Add the missing files shown above to improve your score to 100%

---

🔍 Free AI Code Security Scan

This scan checked repository metadata. Upgrade to AI Code Analysis (free for public repos) to scan your code for:

Category	Examples
Prompt Injection	User input reaching system prompts
Data Leakage	PII/secrets in AI responses
Access Control	Missing auth on AI endpoints
82+ AI Security Rules	OWASP Top 10 for LLMs

Enable Free Code Analysis → | Learn More →

---

_{🤖 Automated by HAIEC — AI Compliance & Security Platform | Documentation | Support}

[precogs-ai]

✅ Precogs scan complete — No security issues found

_{Commit b361c1a on dependabot/pip/pdfminer-six-20260107 · 1 files scanned}

🔴 Critical	🟠 High	🔵 Medium	🟢 Low	🎯 Risk Score
0	0	0	0	0.0

---

✅ All clear. We scanned for SQL injection, XSS, hardcoded secrets, vulnerable dependencies, IaC misconfigurations, and PII exposure. No security vulnerabilities were detected in this PR.

✅ Passed checks (3)

Check	Status	Details
Code scan (SAST)	✅ Passed	No vulnerabilities detected
Secrets scan	✅ Passed	No hardcoded credentials found
Dependency audit	✅ Passed	No known CVEs

---

_{💬 @precogs-ai help for commands · 🔗 View report}

_{Precogs.ai · Detect. Fix. Merge.}

[codereviewbot-ai]

🤖 Review skipped: Repository rate limit exceeded. Free accounts are limited to 2 reviews per 4 hours per repository. Upgrade to a paid plan for unlimited reviews.

[coderifts]

🔍 CodeRifts — API Contract Check

No OpenAPI schemas found in this repository.

While no schema is found, this check completes neutral, which GitHub treats as non-blocking — so if CodeRifts is a required status check, it is not currently blocking anything on this branch.

To get started, either:

• Name your OpenAPI schema file openapi.yaml (or openapi.json, swagger.yaml, etc.)
• Or add a .coderifts.yml to specify the path:

schema:
  - path/to/your/openapi.yaml

📖 Documentation · 💬 Get help

---

☁️ You're on the Free plan. Pro features (risk scoring, governance, deprecation enforcement) are included during the beta. Lock in Pro pricing →

[qwed-security]

🛠️ What to fix

• Dockerfile:0 — Docker build context has no .dockerignore while sensitive files exist in the repository.
• .factory/certs/factory-ai-root.pem:0 — Sensitive file '.factory/certs/factory-ai-root.pem' is not excluded from Docker build context.
• .claude/plugins/marketplaces/claude-plugins-official/external_plugins/discord/.npmrc:0 — Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/discord/.npmrc' is not excluded from Docker build context.
• .claude/plugins/marketplaces/claude-plugins-official/external_plugins/imessage/.npmrc:0 — Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/imessage/.npmrc' is not excluded from Docker build context.
• .claude/plugins/marketplaces/claude-plugins-official/external_plugins/telegram/.npmrc:0 — Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/telegram/.npmrc' is not excluded from Docker build context.
• .ollama/id_ed25519:0 — Sensitive file '.ollama/id_ed25519' is not excluded from Docker build context.
• .claude/plugins/marketplaces/claude-plugins-official/external_plugins/fakechat/.npmrc:0 — Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/fakechat/.npmrc' is not excluded from Docker build context.
• debug (2).log:0 — Test or debug file 'debug (2).log' is present in Docker build context.
• debug__src_scratch-folder__09216a85.log:0 — Test or debug file 'debug__src_scratch-folder__09216a85.log' is present in Docker build context.
• debug.log:0 — Test or debug file 'debug.log' is present in Docker build context.
• ...and 1 more

---

QWED Security Verification Report

14 files scanned | 11 blocked | 2 warnings | 0 info | 0 suppressed | 1 verified

Blocked Findings

File	Line	Context	Issue
Dockerfile	L1	RUNTIME_CODE	Docker build context has no .dockerignore while sensitive files exist in the repository.
.factory/certs/factory-ai-root.pem	L1	UNKNOWN	Sensitive file '.factory/certs/factory-ai-root.pem' is not excluded from Docker build context.
.claude/plugins/marketplaces/claude-plugins-official/external_plugins/discord/.npmrc	L1	UNKNOWN	Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/discord/.npmrc' is not excluded from Docker build context.
.claude/plugins/marketplaces/claude-plugins-official/external_plugins/imessage/.npmrc	L1	UNKNOWN	Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/imessage/.npmrc' is not excluded from Docker build context.
.claude/plugins/marketplaces/claude-plugins-official/external_plugins/telegram/.npmrc	L1	UNKNOWN	Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/telegram/.npmrc' is not excluded from Docker build context.
.ollama/id_ed25519	L1	UNKNOWN	Sensitive file '.ollama/id_ed25519' is not excluded from Docker build context.
.claude/plugins/marketplaces/claude-plugins-official/external_plugins/fakechat/.npmrc	L1	UNKNOWN	Sensitive file '.claude/plugins/marketplaces/claude-plugins-official/external_plugins/fakechat/.npmrc' is not excluded from Docker build context.
debug (2).log	L1	UNKNOWN	Test or debug file 'debug (2).log' is present in Docker build context.
debug__src_scratch-folder__09216a85.log	L1	UNKNOWN	Test or debug file 'debug__src_scratch-folder__09216a85.log' is present in Docker build context.
debug.log	L1	UNKNOWN	Test or debug file 'debug.log' is present in Docker build context.
debug-35a82d.log	L1	UNKNOWN	Test or debug file 'debug-35a82d.log' is present in Docker build context.

Advisory Warnings

File	Line	Context	Issue
!/tests/test_app.py	L1	TEST_CODE	Test or debug file '!/tests/test_app.py' is present in Docker build context.
src/idaho_vault/mock_llm.py	L1	RUNTIME_CODE	Test or debug file 'src/idaho_vault/mock_llm.py' is present in Docker build context.

Engines

• dependency_scan: ✅
• entropy_scan: ✅
• pattern_scan: ✅
• release_boundary: ⚠️ 13 finding(s)

Verified Files

• requirements.txt

---

Verified by QWED — deterministic security verification. No LLM used.

Verification Context v1.0

{
  "spec_version": "1.0",
  "object": {
    "formal_statement": "LAF-US/IDAHO-VAULT@b361c1af (PR #316) is safe to merge"
  },
  "context": {
    "interpretation": {
      "theory": "deterministic security verification",
      "logic": "evidence-context-policy pipeline"
    },
    "proof": {
      "verifier": "QWED Security",
      "verifier_version": "qwed-security-ruleset/1",
      "configuration": {
        "repo": "LAF-US/IDAHO-VAULT",
        "head_sha": "b361c1afd8e0cde160de32e267e42d5b9b458e06",
        "files_scanned": 14
      },
      "theory_scope": "PR security scan against QWED deterministic rule set",
      "trusted_dependencies": [
        "qwed-security"
      ],
      "outcome_treatment": "unknown/timeout/error resolve to UNVERIFIABLE or BLOCKED"
    },
    "evidence": {
      "evidence": {
        "status": "BLOCKED",
        "agent_message": "PR blocked: 11 execution boundary violation(s) detected.",
        "developer_fields": {
          "total_blocked": 11,
          "total_warnings": 1,
          "boundaries_violated": [],
          "advisory_checks": [
            {
              "name": "docker-test-context",
              "advisory_only": true,
              "constraint_id": "artifact_boundary_ambiguity",
              "details": {
                "line": 0,
                "message": "Test or debug file '!/tests/test_app.py' is present in Docker build context."
              }
            }
          ]
        },
        "is_authoritative": false,
        "scan_evidence": {
          "repo": "LAF-US/IDAHO-VAULT",
          "head_sha": "b361c1afd8e0cde160de32e267e42d5b9b458e06",
          "pr_number": 316,
          "files_scanned": 14,
          "engine_results": 16,
          "conclusion": "failure",
          "rule_set": "qwed-security-ruleset/1",
          "engines": [
            "dependency_scan",
            "entropy_scan",
            "pattern_scan",
            "release_boundary"
          ]
        },
        "repo": "LAF-US/IDAHO-VAULT",
        "head_sha": "b361c1afd8e0cde160de32e267e42d5b9b458e06",
        "files_scanned": 14
      },
      "proof_ref": null
    },
    "decision": {
      "admission": "DENY"
    }
  },
  "verdict": "BLOCKED"
}

[devactivity-app]

Pull Request Summary by devActivity

Metrics

null

[revieko-architecture-drift-radar]

Revieko — PR review

• Status: Pass
• Action: Merge allowed
• Structural risk: 0.00 / 100
• Confidence: N/A (no matching hunks for selected extensions)
• Scope: PR diff hunks only (changed code in this PR)

No matching hunks for extensions: .py

Full report: HTML · Markdown · JSON

Details

• CI status: Ok
• Analysis: full
• Model: Calibrated
• Control risk: Low
• ignored_files: 4 (non-matching extensions)

— Generated by Revieko · Install GitHub App · Documentation

Link details

• Expires at UTC: 2026-08-27 22:58:02Z
• Remaining: 168h from now