fix: pin cryptography for the Flatpak and bump pypdf past six CVEs

[nelsonduarte]

Why

The Flatpak manifest never listed cryptography, which leaves AES encryption and AES-encrypted PDF opening broken in the Flatpak build. pypdf declares cryptography only as the optional crypto extra, and flatpak/python-modules.yml installs with --no-index --find-links, so the extra is never resolved from PyPI and the wheel is simply absent from the sandbox.

The failure is asymmetric, which is why it went unnoticed for so long:

• The editor opens encrypted PDFs through PyMuPDF, which carries its own crypto, and kept working.
• The Encrypt tool goes through pypdf and raised DependencyError.

Only the pypdf path was dead, so the feature looked half-alive rather than broken.

Dependency floors

pypdf: 6.14.2 to 6.16.2. 6.14.2 was exposed to six advisories:

Advisory	Fixed in
PYSEC-2026-3655	6.15.0
PYSEC-2026-3656	6.15.0
CVE-2026-82398	6.15.0
CVE-2026-84309	6.16.0
CVE-2026-84310	6.16.1
CVE-2026-84311	6.16.1

6.15.0 still carried three of them, so the floor is 6.16.2 rather than the 6.15.0 the earliest advisory alone would suggest.

cryptography: 49.0.0 to 50.0.1. PYSEC-2026-3552 / CVE-2026-69247 is a Bleichenbacher oracle in PKCS#7 EnvelopedData decryption, introduced in 44.0.0 and fixed in 50.0.0. 49.0.0 is the only release in the 49 series and it is vulnerable, so the previous cryptography>=49.0.0 floor could never resolve to a safe version at all.

Tests

Adds tests/test_flatpak_dependency_pins.py with eight consistency tests tying requirements.txt, flatpak/requirements-pinned.txt and flatpak/python-modules.yml together. This matters because flatpak/python-modules.yml has no reference anywhere in .github/, so nothing in CI reads it and drift is otherwise invisible.

Also corrects flatpak/README.md, which claimed Dependabot keeps the shared packages in sync. It does not: .github/dependabot.yml declares the pip ecosystem only for directory: "/", so nothing under flatpak/ is ever bumped or added.

Verification

• Suite went from 592 to 600 passed, 2 skipped.
• AES-256 round trip on Linux using only the wheels in the manifest, confirming the fix addresses the real failure and not a proxy for it.
• Parsing comparison between 6.14.2 and 6.16.2 over 16 fixtures, with identical diffs, so the bump carries no behavioural regression.
• All 9 wheel hashes cross-checked against the PyPI API.

What this PR does NOT fix

Recorded deliberately so none of it is mistaken for solved:

• The security-deps.yml gate is weak by construction. pip-audit over open floors resolves to the newest version and never sees the minimum the floor actually permits. That blindness is exactly what let cryptography>=49.0.0 pass green with an open CVE. Needs its own PR.
• The Flatpak build remains broken. Eight wheels are still missing: PySide6_Essentials, PySide6_Addons, cffi, pycparser, qtpy, packaging, lxml, typing_extensions. A pip resolution run aborts at PySide6. This PR increases the deficit by 2 (cffi and pycparser, pulled in by cryptography), but the build was already failing beforehand, so nothing regresses in practice. Needs its own issue.
• Four mutations survive in python-modules.yml: corrupted SHA256, non-existent URL, wrong platform tag. Neither CI nor the tests verify wheel integrity.

Note on CI

This PR will trigger security-deps.yml, because it touches requirements.txt and flatpak/requirements-pinned.txt, both in the workflow's paths trigger. That is intended: it is precisely what the workflow exists to check, and it should now pass, since pip-audit over the pinned file came back clean.

🤖 Generated with Claude Code

[github-actions]

Python dependencies security check

pip-audit: requirements.txt

No known vulnerabilities.

pip-audit: flatpak/requirements-pinned.txt

No known vulnerabilities.

Outdated check (informational)

Package	Pin	Latest on PyPI	Status
PySide6	PySide6>=6.11.1	6.11.2	outdated
pypdf	pypdf>=6.16.2	6.16.2	up-to-date
cryptography	cryptography>=50.0.1	50.0.1	up-to-date
qtawesome	qtawesome>=1.4.2	1.4.2	up-to-date
pillow	pillow>=12.3.0	12.3.0	up-to-date
pymupdf	pymupdf>=1.28.0	1.28.2	outdated
pytesseract	pytesseract>=0.3.13	0.3.13	up-to-date
python-docx	python-docx>=1.2.0	1.2.0	up-to-date
python-pptx	python-pptx>=1.0.2	1.0.2	up-to-date
openpyxl	openpyxl>=3.1.5	3.1.5	up-to-date
beautifulsoup4	beautifulsoup4>=4.15.0	4.15.0	up-to-date
ebooklib	ebooklib>=0.20	0.20	up-to-date
lxml	lxml>=6.1.1	6.1.3	outdated
urllib3	urllib3>=2.7.0	2.7.0	up-to-date
idna	idna>=3.18	error (URLError)
pyinstaller	pyinstaller>=6.21.0	6.22.2	outdated

Auto-generated by security-deps workflow. Merge is blocked only when pip-audit --strict reports vulnerabilities.