⬆ Bump unstructured from 0.16.23 to 0.21.5

[dependabot]

Bumps unstructured from 0.16.23 to 0.21.5.

Release notes

Sourced from unstructured's releases.

0.21.5

What's Changed

• feat: custom fallback for language detection by @​claytonlin1110 in Unstructured-IO/unstructured#4238
• Add Github action for time regressions by @​aadland6 in Unstructured-IO/unstructured#4261
• fix: relax lower bound for pdfminer.six by @​badGarnet in Unstructured-IO/unstructured#4262

New Contributors

• @​claytonlin1110 made their first contribution in Unstructured-IO/unstructured#4238
• @​aadland6 made their first contribution in Unstructured-IO/unstructured#4261

Full Changelog: Unstructured-IO/unstructured@0.21.2...0.21.5

0.21.2

No release notes provided.

0.21.1

What's Changed

• bump version by @​badGarnet in Unstructured-IO/unstructured#4257

Full Changelog: Unstructured-IO/unstructured@0.21.0...0.21.1

0.21.0

Fixes

• Replace NLTK with spaCy to remediate CVE-2025-14009: NLTK's downloader uses zipfile.extractall() without path validation, enabling RCE via malicious packages (CVSS 10.0, no patch available). spaCy models install as pip packages, eliminating the vulnerable downloader entirely.

0.20.8

What's Changed

• fix: set max decompressed size for elements JSON by @​qued in Unstructured-IO/unstructured#4244
• fix: update depdencies by @​badGarnet in Unstructured-IO/unstructured#4247

Full Changelog: Unstructured-IO/unstructured@0.20.6...0.20.8

0.20.6

What's Changed

• Automate pypi publishing by @​PastelStorm in Unstructured-IO/unstructured#4239
• fix: remove duplicate characters caused by fake bold rendering in PDFs by @​bittoby in Unstructured-IO/unstructured#4215
• Improve fast partition cold start by @​CyMule in Unstructured-IO/unstructured#4242
• fix: gracefully handle invalide html string during chunking by @​badGarnet in Unstructured-IO/unstructured#4243
• fix: remap parent id after hashing by @​badGarnet in Unstructured-IO/unstructured#4245

New Contributors

• @​bittoby made their first contribution in Unstructured-IO/unstructured#4215

Full Changelog: Unstructured-IO/unstructured@0.20.1...0.20.6

0.20.2

Release 0.20.2

... (truncated)

Changelog

Sourced from unstructured's changelog.

0.21.5

Fixes

• Lower the requirement for pdfminer.six to >=20251230

0.21.4

Enhancements

• Add a github action for testing time regressions

0.21.3

Enhancements

• Custom fallback for language detection (fixes #4091): Add optional language_fallback callable for short ASCII text (e.g. when detection would default to English). Callable receives the text and may return a list of ISO 639-3 codes or None to leave language unspecified; return value is validated and invalid entries are filtered out. language_fallback is passed through partition(), PDF/image partitioners, and partition_html; partition_md now accepts languages (use [""] to disable detection). Language-related parameters (languages, detect_language_per_element, language_fallback) are documented as top-level options and exposed explicitly on partition_html.

0.21.2

Fixes

• Self-install pinned spaCy model at runtime with SHA256 verification: Replace the en-core-web-sm direct URL dependency in pyproject.toml with the installer library. The spaCy model is now downloaded and installed on first use with hash verification, removing the need for [tool.uv.sources] and making the install more portable.

0.21.1

• Bump version to create a new release

0.21.0

Fixes

• Replace NLTK with spaCy to remediate CVE-2025-14009: NLTK's downloader uses zipfile.extractall() without path validation, enabling RCE via malicious packages (CVSS 10.0, no patch available). spaCy models install as pip packages, eliminating the vulnerable downloader entirely.

0.20.8

Fixes

• downgrade wrapt so it is compatible with opentelemetry-instrumentation-httpx
• resolve lock issue with windows and python 3.13

0.20.7

Fixes

• Cap size when decompressing elements JSON file: Prevents situations where decompression can consume an arbitrarily large portion in memory and on the filesystem.

0.20.6

Fixes

• fix: remap parent id after hashing to preserve right reference

0.20.5

Fixes

• Gracefully handle invalid text_as_html during chunking: _TableChunker now catches parse errors (e.g. lxml.etree.ParserError when text_as_html contains a markdown code-fence like ```html\n) and returns None instead of raising, allowing chunking to continue using plain-text fallback. A WARNING log is emitted with a truncated preview of the offending value.

... (truncated)

Commits

• 5302352 fix: relax lower bound for pdfminer.six (#4262)
• 16482f9 Add Github action for time regressions (#4261)
• afbda95 feat: custom fallback for language detection (#4238)
• 4a77a8c fix: self-install pinned spaCy model at runtime with SHA256 verification (#4258)
• 47b8b5e bump version (#4257)
• 3db7b4f Fix: replace nltk with spacy CVE 2025 14009 (#4255)
• a8f14ba fix: update depdencies (#4247)
• c6c7462 fix: set max decompressed size for elements JSON (#4244)
• e2d8b7a fix: remap parent id after hashing (#4245)
• c1f819c fix: gracefully handle invalide html string during chunking (#4243)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)