[Osiriss664]

What and why

How to see it

Evidence

Memory and compatibility

Screenshots

Not done or not tested

---

• No credentials, private paths, personal prompts, chats or model weights in the diff, logs or screenshots.
• I personally reviewed the diff and can explain the changes, including any work produced with AI tools.

[Osiriss664]

The one CI error is test_signing.py ReadDeadlineTests.test_a_body_dripped_slowly_is_cut_off_with_408 (ConnectionResetError: [Errno 54] at the recv). I don't think it's from this PR: test_signing.py uses only the standard library (no pypdf), and this PR changes only the pypdf pin and two version lines in docs. On my Mac the same branch passed test_signing.py (167 OK) and Scripts/sandbox_selftest.sh all (142/0).

It looks like a timing race on the runner: the server answers 408 and closes while the test is still sending the body, so macOS resets the connection before the test reads the reply. Could you re-run the job? If it keeps happening, I'm happy to send a small follow-up that treats a reset after the 408 as the expected outcome.

[rexmhall09]

Hey @Osiriss664, thanks for this! The bump looks good, the hashes match PyPI, and 6.20.0 has a bunch of the pypdf advisories from this week, so I definitely want it in.

The only problem is the sandbox just moved to its own repo, tuff-app/sandbox, so this can't merge here anymore. Could you open it over there instead? It's the same change, just without the Sandbox/ folder in front of the paths. Also, pypdf 6.21.2 is out now, so you might as well go straight to that.

The THIRD_PARTY_NOTICES.md change stays in TUFF. I'll do that in the PR that pins the new image after I publish it from the sandbox repo.

The test_signing.py 408 failure looks like the timing race you mentioned. The sandbox repo has its own CI now, so we'll see if it shows up there too.

I'll close this one once the sandbox PR is up.

[rexmhall09]

Actually, I went ahead and moved it over myself since it fixes security issues: tuff-app/sandbox@bad6aab, bumped to 6.21.2 and with you credited as co-author. Closing this one. Thanks again!