Bump pypdf from 6.9.1 to 6.9.2

[dependabot]

Bumps pypdf from 6.9.1 to 6.9.2.

Release notes

Sourced from pypdf's releases.

Version 6.9.2, 2026-03-23

What's new

Security (SEC)

• Avoid infinite loop in read_from_stream for broken files (#3693) by @​stefan6419846

Robustness (ROB)

• Resolve UnboundLocalError for xobjs in _get_image (#3684) by @​Yuki9814

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.9.2, 2026-03-23

Security (SEC)

• Avoid infinite loop in read_from_stream for broken files (#3693)

Robustness (ROB)

• Resolve UnboundLocalError for xobjs in _get_image (#3684)

Full Changelog

Commits

• da867f4 REL: 6.9.2
• 02b1345 SEC: Avoid infinite loop in read_from_stream for broken files (#3693)
• 3bef339 MAINT: Prefer bytearray over bytes in image_inline (#3692)
• 04b0a38 ROB: Resolve UnboundLocalError for xobjs in _get_image (#3684)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
pygments	2.19.2	CVE-2026-4539	No fix available on PyPI (latest is 2.19.2)

Why this cannot be auto-fixed

The vulnerability exists in pygments itself. A fix requires the upstream maintainers to release a new version. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

What was fixed automatically

• ✅ requests bumped from 2.32.5 → 2.33.0 to fix CVE-2026-25645

Recommended next steps

1. Monitor the CVE-2026-4539 advisory for a patch release
2. Consider whether a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether pygments can be replaced or pinned to a version unaffected by this vulnerability

This PR will not be auto-merged until the pygments vulnerability is resolved.

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
pygments	2.19.2	CVE-2026-4539	No fix available on PyPI

Why this cannot be auto-fixed

The vulnerability exists in pygments (inefficient regular expression complexity in AdlLexer in pygments/lexers/archetype.py). A fix requires the upstream maintainers to release a new version. The CVE description notes: "The project was informed of the problem early through an issue report but has not responded yet." Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

Recommended next steps

1. Monitor the vulnerability advisory for a patch release
2. Check if a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced with an alternative

This PR will not be auto-merged until the vulnerability is resolved.

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
pygments	2.19.2	CVE-2026-4539	No fix available on PyPI

Why this cannot be auto-fixed

The vulnerability exists in pygments itself (specifically in the AdlLexer function in pygments/lexers/archetype.py, which has inefficient regular expression complexity). A fix requires the upstream maintainers to release a new version. The advisory notes the project has been informed but has not responded yet. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

Recommended next steps

1. Monitor the vulnerability advisory (CVE-2026-4539) for a patch release
2. Check if a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced with an alternative

This PR will not be auto-merged until the vulnerability is resolved.

[amrit110]

Security Vulnerability — No Patch Available Yet

aieng-bot found the following security vulnerabilities reported by pip-audit, but cannot fix them automatically because no patched version has been released to PyPI yet:

Package	Version	Vulnerability	Status
pygments	2.19.2	CVE-2026-4539	No fix available on PyPI

Why this cannot be auto-fixed

The vulnerability exists in pygments itself. The CVE describes inefficient regular expression complexity in pygments/lexers/archetype.py. According to the report, the project has not yet responded to the issue. A fix requires the upstream maintainers to release a new version. Once a patched release is published to PyPI, aieng-bot can re-run and apply the update automatically.

Recommended next steps

1. Monitor the vulnerability advisory (CVE-2026-4539) for a patch release from the pygments maintainers
2. Check if a pip-audit ignore/exception can be added temporarily with justification (requires human review)
3. Consider whether this dependency can be replaced with an alternative

This PR will not be auto-merged until the vulnerability is resolved.