build(deps): bump ocrmypdf from 17.8.1 to 17.10.0 in /pdf

[dependabot]

Bumps ocrmypdf from 17.8.1 to 17.10.0.

Release notes

Sourced from ocrmypdf's releases.

v17.10.0

• The watcher.py watched-folder helper (the watcher extra) has been modernized and security-hardened:

  • It now uses watchfiles instead of watchdog. Installing ocrmypdf[watcher] now pulls in watchfiles; native OS filesystem notifications are used by default, with OCR_USE_POLLING=1 to force polling.
  • It enforces a "Harvard architecture" separation between data and code: at startup it refuses to run (exit code 9) if the input, output or archive directory overlaps any Python interpreter path (sys.path, the virtual environment, site-packages, or $PATH), if OCR_JSON_SETTINGS points at a file inside a data directory or one that is group/world-writable, or if it specifies a plugin located inside a data directory. It also refuses to run when the output or archive directory is the input directory or a subdirectory of it, which would otherwise cause OCRmyPDF output to be reprocessed in an endless loop.
  • At runtime it no longer follows symlinks or processes non-regular files (fifos, devices, etc.) in the watched directory, and refuses to write output onto a destination occupied by a non-regular file.
  • A password-protected PDF dropped into the watched folder no longer stops the watcher ({issue}1715). pikepdf.PasswordError does not derive from pikepdf.PdfError, so it escaped the handler that waits for a file to be fully written and tore down the watch loop, leaving files that arrived afterwards unprocessed. Encrypted files are now logged and skipped immediately — no amount of retrying will supply the password. More generally, no per-file error can stop the watcher now: failures are logged and watching continues. Thanks @​christophdb for the report and a fix ({issue}1716).

  See the "Watcher security model" section of the batch processing documentation for details. Existing deployments where the data directories are kept separate from the application are unaffected; deployments that co-located data with the interpreter or its environment will need to relocate one or the other.

• Ghostscript 10.7.0 and later are no longer treated as affected by the JPEG passthrough truncation bug, which Ghostscript fixed in 10.07.0 ({issue}1726). The version check had no upper bound, so users on a fixed Ghostscript still saw the "JPEG encoding errors" warning and, worse, silently had every JPEG lossily re-encoded at --optimize 1 (the default) to work around a bug their Ghostscript did not have. Thanks @​zuentec-droid for the detailed measurements and upstream analysis.

• The same JPEG re-encoding workaround no longer applies when Ghostscript did not produce the file at all. It was previously triggered by the mere presence of an affected Ghostscript, so --output-type pdf and files converted by the speculative PDF/A path — neither of which runs Ghostscript — paid the quality loss for nothing.

Commits

• 1d3bae7 Keep the watcher alive when a file cannot be processed
• 5352139 Reject watcher configs where output/archive is under input
• bea94fe Harden and modernize the watched-folder helper (watcher.py)
• c94d37a Bound Ghostscript JPEG truncation workarounds to 10.6.x (closes #1726)
• 4942751 Add v17.9.0 release notes for #1723, #1713, and CI release-draft fix
• 39bf09f docs: format
• 5d49f75 Use any installed Noto font when named families lack glyphs (closes #1722)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

pdf/requirements.txt

Package	Version	License	Issue Type
ocrmypdf	17.10.0	MPL-2.0	Incompatible License

Allowed Licenses:

0BSD, Apache-2.0, BSD-2-Clause, BSD-3-Clause, CC0-1.0, MIT, MIT-0

OpenSSF Scorecard

Package	Version	Score	Details
pip/ocrmypdf	17.10.0	Unknown	Unknown

Scanned Files

• pdf/requirements.txt