chore: dependency + CI modernization, security audit, GEO/SEO descriptions#898
Merged
Conversation
Several workflows lagged behind on older action SHAs, so the same action ran at two different majors across the repo — the drift that keeps regenerating dependabot noise and leaves node20-era stragglers. - actions/checkout v6.0.3 -> v7.0.0 (12 workflows) - actions/setup-python v5 -> v6.2.0 (3 workflows) - actions/setup-java: stale "# v4" comment -> "# v5.5.0" (SHA unchanged) Claude-Session: https://claude.ai/code/session_01QXMiKnxkmFs3tCQNz1vMc5
`cargo update` — ~50 in-semver dependency bumps. MSRV-safe: the one bump requiring newer Rust (kstring 2.0.4 -> 1.96) only enters via the optional tract-onnx OCR path, which is not in default features, so the `cargo build --lib` MSRV(1.88) job never compiles it. Claude-Session: https://claude.ai/code/session_01QXMiKnxkmFs3tCQNz1vMc5
Python 3.8 has been EOL since Oct 2024. - requires-python ">=3.8" -> ">=3.9"; drop 3.8 classifier - ruff target-version py38 -> py39; re-enable the UP (pyupgrade) rules - apply the resulting modernizations (forward-ref annotations, f-string) (pyproject also carries its GEO description update from the SEO pass.) Claude-Session: https://claude.ai/code/session_01QXMiKnxkmFs3tCQNz1vMc5
Propagate the README's data-backed positioning ("5x faster than the
industry leaders", 0.8ms mean, 100% pass rate on 3,830 real-world PDFs)
to every binding manifest that was still generic. No competitor named by
reference; all claims backed by the existing benchmark table.
- 13 manifests brought to one GEO formula (Rust, Node, WASM x3, Ruby,
PHP x2, ObjC, Kotlin, .NET, Dart, R)
- fix: wasm-pkg-web* mislabeled themselves "Rust library"; root
composer.json mislabeled "for PHP"
- R DESCRIPTION kept pure-ASCII for CRAN
Claude-Session: https://claude.ai/code/session_01QXMiKnxkmFs3tCQNz1vMc5
# Conflicts: # Cargo.lock
#898's stricter ruff config + py3.9 floor flagged pre-existing scripts: Tuple/Dict/List -> tuple/dict/list, Optional[X] -> X | None, and collections.abc imports. Both remain runtime-clean (from __future__ import annotations present). Type hints only, no behavior change. Claude-Session: https://claude.ai/code/session_01VfT1dvLWaMNh4SpaXV8kcp
#898 raised the Python floor to 3.9 (3.8 is EOL) but left 3.8 in the CI test matrices, so the 3.8 job built the abi3 wheel then failed to install it ("3.8.10 not in '>=3.9'"). Remove 3.8 from python.yml and ci.yml matrices. abi3 wheels remain forward-compatible; no code change. Claude-Session: https://claude.ai/code/session_01VfT1dvLWaMNh4SpaXV8kcp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Housekeeping sweep: unify CI action versions, refresh dependencies, drop EOL Python 3.8, and standardize package descriptions for SEO/GEO — all claims data-backed by the existing benchmark table.
CI — unify pinned action versions (14 workflows)
Several workflows lagged on older action SHAs, so the same action ran at two majors across the repo — the drift that keeps regenerating dependabot noise and leaves node20-era stragglers.
actions/checkoutv6.0.3 → v7.0.0 (12 workflows)actions/setup-pythonv5 → v6.2.0 (3 workflows)actions/setup-javastale# v4comment →# v5.5.0(SHA unchanged)Dependencies
Cargo.lockrefreshed (~50 in-semver bumps). MSRV-safe:kstring 2.0.4(needs Rust 1.96) only enters via optionaltract-onnxOCR, not indefaultfeatures, so thecargo build --libMSRV(1.88) job never compiles it.Security audit — all clean
rustybuzz,ttf-parser,macro_rules_attribute; bothttf-parser 0.25/rustybuzz 0.20are already latest, no upgrade path.brace-expansionflag was a stale localnode_modules, the committed lockfile already pins the fixed 5.0.7.Python — drop EOL 3.8
requires-python >=3.8 → >=3.9, drop 3.8 classifiertarget-version py38 → py39, re-enableUP(pyupgrade); applied the resulting modernizations (forward-ref annotations, f-string)SEO/GEO — standardize descriptions (13 tracked manifests)
Propagate the README's data-backed positioning ("5× faster than the industry leaders", 0.8ms mean, 100% pass rate on 3,830 real-world PDFs) to every binding that was still generic. No competitor named by reference (no PyMuPDF / pdf_extract / oxidize_pdf); the
pymupdf-alternativesearch keyword is kept (migration-intent SEO). README left as-is.wasm-pkg-web*mislabeled themselves "Rust library"; rootcomposer.jsonmislabeled "for PHP".Note:
wasm-pkg-web/andwasm-pkg-web-ocr/are fully gitignored build-output dirs — theirpackage.jsondescriptions are generated at build time, so those two need the build/publish pipeline updated separately to take effect.https://claude.ai/code/session_01QXMiKnxkmFs3tCQNz1vMc5