From 625e62c4ca7fd37ab7a05d55428058625c8f3b62 Mon Sep 17 00:00:00 2001
From: "andrew.zhang" <andrew.zhang@datarobot.com>
Date: Mon, 3 Nov 2025 10:45:44 -0500
Subject: [PATCH 1/4] pypdf as dependency in pyproject.toml

---
 pyproject.toml | 4 ++++
 uv.lock        | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/pyproject.toml b/pyproject.toml
index 29445796f..380b6f17c 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,6 +17,10 @@ dependencies = [
   "openai>=1.76.2",
   "pandas>=2.2.3",
   "ragas>=0.3.8",
+  "pypdf>=6.1.3",
+]
+exclude-dependencies = [
+    "uv",
 ]
 
 [project.urls]
diff --git a/uv.lock b/uv.lock
index 4ea554070..69b485ee9 100644
--- a/uv.lock
+++ b/uv.lock
@@ -946,6 +946,7 @@ dependencies = [
     { name = "datarobot-predict" },
     { name = "openai" },
     { name = "pandas" },
+    { name = "pypdf" },
     { name = "ragas" },
     { name = "requests" },
 ]
@@ -1057,6 +1058,7 @@ requires-dist = [
     { name = "pydantic-ai", marker = "extra == 'pydanticai'", specifier = ">=1.0.5" },
     { name = "pydantic-settings", marker = "extra == 'drmcp'", specifier = ">=2.1.0" },
     { name = "pylance", marker = "extra == 'crewai'", specifier = "<=0.38.1" },
+    { name = "pypdf", specifier = ">=6.1.3" },
     { name = "pypdf", marker = "extra == 'llamaindex'", specifier = ">=6.0.0" },
     { name = "python-dotenv", marker = "extra == 'drmcp'", specifier = ">=1.1.0" },
     { name = "ragas", specifier = ">=0.3.8" },

From 57db45d22b676f1004fb0774c140e6917c7251b5 Mon Sep 17 00:00:00 2001
From: "andrew.zhang" <andrew.zhang@datarobot.com>
Date: Mon, 3 Nov 2025 10:48:50 -0500
Subject: [PATCH 2/4] pyproject.toml version bump

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 380b6f17c..53cec6dc3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "datarobot-genai"
-version = "0.1.22"
+version = "0.1.23"
 description = "Generic helpers for GenAI"
 readme = "README.md"
 requires-python = ">=3.10, <3.13"

From ad7cbeda3c7671ed81d81d674c2e947876e4897d Mon Sep 17 00:00:00 2001
From: "andrew.zhang" <andrew.zhang@datarobot.com>
Date: Thu, 6 Nov 2025 11:04:17 -0500
Subject: [PATCH 3/4] cve comment

---
 pyproject.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pyproject.toml b/pyproject.toml
index 53cec6dc3..19e055c91 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -17,7 +17,7 @@ dependencies = [
   "openai>=1.76.2",
   "pandas>=2.2.3",
   "ragas>=0.3.8",
-  "pypdf>=6.1.3",
+  "pypdf>=6.1.3",  # CVE BUZZOK-28182
 ]
 exclude-dependencies = [
     "uv",

From 6aac38b4db9951d12ee7840bd7448b3beee29197 Mon Sep 17 00:00:00 2001
From: "andrew.zhang" <andrew.zhang@datarobot.com>
Date: Thu, 6 Nov 2025 16:02:52 -0500
Subject: [PATCH 4/4] temporarily remove exclude-dependencies

---
 pyproject.toml | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 19e055c91..f32606ed2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -19,9 +19,6 @@ dependencies = [
   "ragas>=0.3.8",
   "pypdf>=6.1.3",  # CVE BUZZOK-28182
 ]
-exclude-dependencies = [
-    "uv",
-]
 
 [project.urls]
 Homepage = "https://github.com/datarobot-oss/datarobot-genai"