chore(deps): bump the docling-python group in /eval/docling with 2 updates

[dependabot]

Bumps the docling-python group in /eval/docling with 2 updates: docling and pymupdf.

Updates docling from 2.120.2 to 2.124.0

Release notes

Sourced from docling's releases.

v2.124.0

Feature

• cli: Add latex output format (#4101) (c4b0fc7)
• Add terminal task callback event (#4095) (d2283ad)

Fix

• service_client: Handle Retry-After HTTP-date with unknown timezone (#3786) (3bba8da)
• Silence transformers generation-config deprecation warning and add max_new_tokens CLI overrides (#4115) (01fc722)
• Drop the UTF-8 BOM when decoding webvtt, markdown and asciidoc (#4109) (4e34e7b)

v2.123.1

Fix

• vlm: Preserve spacing for Chandra br tags (#4092) (3a2aca4)
• cli: Defer heavy imports so CLI works on lightweight installs (#4100) (21aa5c9)
• csv: Drop the UTF-8 BOM instead of keeping it in the first cell (#4098) (0865b9a)

v2.123.0

Feature

• Default to threaded docling-parse across SDK, CLI, service, and extraction (#3764) (feb0f26)

Fix

• Avoid pipeline option cache key collisions (#4076) (4c28ee6)
• csv: Detect the dialect when a quoted field spans several lines (#3985) (6b7dc94)
• Improvements (layout element shuffling and allow more strategies) in experimental two-stages pipeline + define base prompt as constant (#2723) (3c77e26)
• layout: Nest tables and pictures in form regions (#4064) (aaa4e28)

Documentation

• Add labelstudio to featured integrations (#4072) (6de1318)

v2.122.0

Feature

• Add compact_tables to ConvertDocumentsOptions (#4032) (e1965bc)
• iwork: Recover titles, headings and iWork '09 tables (#4031) (9e73870)

Fix

• pdf: Preserve a line-final hyphen that does not split a word (#4043) (#4052) (49579ee)
• asciidoc: Stop a dedented list from crashing the backend (#3826) (72fb46d)
• docx: Keep node identity for textboxes instead of id() of transient proxies (#4036) (f3f48eb)
• Skip the native segmented-page decode in full-page OCR mode (#4061) (963564c)
• vlm: Use official Unlimited-OCR prompt (#4037) (214ac8c)
• Handle various cross-type overlap cleanups in layout processing (#4059) (d807d37)
• tesseract: Normalize the script pack separator from --list-langs (#4022) (#4033) (33d8eee)

... (truncated)

Changelog

Sourced from docling's changelog.

v2.124.0 - 2026-08-31

Feature

• cli: Add latex output format (#4101) (c4b0fc7)
• Add terminal task callback event (#4095) (d2283ad)

Fix

• service_client: Handle Retry-After HTTP-date with unknown timezone (#3786) (3bba8da)
• Silence transformers generation-config deprecation warning and add max_new_tokens CLI overrides (#4115) (01fc722)
• Drop the UTF-8 BOM when decoding webvtt, markdown and asciidoc (#4109) (4e34e7b)

v2.123.1 - 2026-08-28

Fix

• vlm: Preserve spacing for Chandra br tags (#4092) (3a2aca4)
• cli: Defer heavy imports so CLI works on lightweight installs (#4100) (21aa5c9)
• csv: Drop the UTF-8 BOM instead of keeping it in the first cell (#4098) (0865b9a)

v2.123.0 - 2026-08-26

Feature

• Default to threaded docling-parse across SDK, CLI, service, and extraction (#3764) (feb0f26)

Fix

• Avoid pipeline option cache key collisions (#4076) (4c28ee6)
• csv: Detect the dialect when a quoted field spans several lines (#3985) (6b7dc94)
• Improvements (layout element shuffling and allow more strategies) in experimental two-stages pipeline + define base prompt as constant (#2723) (3c77e26)
• layout: Nest tables and pictures in form regions (#4064) (aaa4e28)

Documentation

• Add labelstudio to featured integrations (#4072) (6de1318)

v2.122.0 - 2026-08-25

Feature

• Add compact_tables to ConvertDocumentsOptions (#4032) (e1965bc)
• iwork: Recover titles, headings and iWork '09 tables (#4031) (9e73870)

Fix

• pdf: Preserve a line-final hyphen that does not split a word (#4043) (#4052) (49579ee)
• asciidoc: Stop a dedented list from crashing the backend (#3826) (72fb46d)
• docx: Keep node identity for textboxes instead of id() of transient proxies (#4036) (f3f48eb)

... (truncated)

Commits

• 699e20f chore: bump version to 2.124.0 [skip ci]
• c4b0fc7 feat(cli): add latex output format (#4101)
• 3bba8da fix(service_client): handle Retry-After HTTP-date with unknown timezone (#3786)
• 01fc722 fix: silence transformers generation-config deprecation warning and add max_n...
• 4e34e7b fix: drop the UTF-8 BOM when decoding webvtt, markdown and asciidoc (#4109)
• d2283ad feat: add terminal task callback event (#4095)
• d745e97 chore: bump version to 2.123.1 [skip ci]
• 3a2aca4 fix(vlm): preserve spacing for Chandra br tags (#4092)
• 21aa5c9 fix(cli): defer heavy imports so CLI works on lightweight installs (#4100)
• 0865b9a fix(csv): drop the UTF-8 BOM instead of keeping it in the first cell (#4098)
• Additional commits viewable in compare view

Updates pymupdf from 1.28.0 to 1.28.2

Release notes

Sourced from pymupdf's releases.

PyMuPDF-1.28.2 released

Wheels for Windows, Linux and MacOS, and the sdist, are available on https://pypi.org and can be installed in the usual way, for example:

python -m pip install --upgrade pymupdf

Changes in version 1.28.2 ()

Fixed issues:

• Fixed #4670
• Fixed #4943
• Fixed #5030
• Fixed #5042
• Fixed #5044
• Fixed #5049

Other:

• Use MuPDF-1.28.2.
• Output warning when legacy fitz module is imported.
• Cope better with markdown containing illegal utf8 sequences.
• Fixed building with PYMUPDF_SETUP_MUPDF_VS_UPGRADE.
• pymupdf.Page.find_tables():
  • new args use_layout: bool = True union: bool = False refine: bool = False.
  • Improved speed.
• Retrospectively added fix for #4936 in release 1.28.0 below.

Changelog

Sourced from pymupdf's changelog.

Change Log

**Changes in version

Fixed issues:

Other:

• Retrospectively marked #4896 fixed in 1.28.0.
• Retrospectively marked #4918 fixed in 1.28.0.

Changes in version 1.28.2 (2026-08-06)

Fixed issues:

• Fixed 4670 <https://github.com/pymupdf/PyMuPDF/issues/4670>_: scrub fails to remove hidden text after clean_contents stopped including line breaks (\u2265 1.24.0)
• Fixed 4943 <https://github.com/pymupdf/PyMuPDF/issues/4943>_: enh: applying redactions with image cropping for currently unsupported colorspaces
• Fixed 5030 <https://github.com/pymupdf/PyMuPDF/issues/5030>_: find_tables() with layout enabled can return a zero-cell Table, and Table.bbox then raises "ValueError: min() iterable argument is empty"
• Fixed 5042 <https://github.com/pymupdf/PyMuPDF/issues/5042>_: Page.get_texttrace() leaks None references \u2014 Fatal Python error (none_dealloc) in long-running processes (1.27.2.3 & 1.28.0)
• Fixed 5044 <https://github.com/pymupdf/PyMuPDF/issues/5044>_: Outline (TOC) parsing bug
• Fixed 5049 <https://github.com/pymupdf/PyMuPDF/issues/5049>_: font subsetting segfaults in 1.28.0, regression from 1.27.2.2 #5049
• Fixed 5056 <https://github.com/pymupdf/PyMuPDF/issues/5056>_: Option for reproducible/deterministic save output (omit MuPDF version banner + Producer)

Other:

• Use MuPDF-1.28.2.
• Output warning when legacy fitz module is imported.
• Cope better with markdown containing illegal utf8 sequences.
• Fixed building with PYMUPDF_SETUP_MUPDF_VS_UPGRADE.
• pymupdf.Page.find_tables():
  • new args use_layout: bool = True union: bool = False refine: bool = False.
  • Improved speed.
• Retrospectively added fix for #4936 in release 1.28.0 below.
• Added windows-arm64 wheel.

Changes in version 1.28.0 (2026-06-29)

Fixed issues:

• Fixed 4114 <https://github.com/pymupdf/PyMuPDF/issues/4114>_: ComboBox choice_values full of empty strings despite PDF having valid choices.
• Fixed 4950 <https://github.com/pymupdf/PyMuPDF/issues/4950>_: remove_rotation() raises ValueError on widgets with empty/infinite rects
• Fixed 5001 <https://github.com/pymupdf/PyMuPDF/issues/5001>_: Formulae incorrectly rendered as black boxes
• Fixed 5033 <https://github.com/pymupdf/PyMuPDF/issues/5033>_: Annot.set_rotation(0) followed by Annot.update() throws AttributeError
• Fixed 4936 <https://github.com/pymupdf/PyMuPDF/issues/4936>_: bug: incomplete redaction of vector graphics (line art)
• Fixed 4896 <https://github.com/pymupdf/PyMuPDF/issues/4896>_: write_images() and saving with garbage>1 spoils fonts (xrefs)

... (truncated)

Commits

• 12786d1 tests/test_general.py:test_5054(): expect success after recent fix in mupdf m...
• 6adaca9 src/init.py:JM_get_font(): cope with mupdf master fz_lookup_noto_font()'s...
• 59525c7 changes.txt: updates for 1.28.2.
• 948bfba tests/test_pynone.py: renamed test to test_5042() to match github issue.
• 48b26ea .github/ISSUE_TEMPLATE/bug_report.yml: added 1.28.2.
• 6f98b39 setup.py: increment version to 1.28.2.
• 32eacbf tests/test_font.py:test_5049(): don't overwrite input file.
• 1ef7703 setup.py: misc cleanups.
• eb32057 tests/: added test_5054().
• c47e4c1 Add test for fixing #5056
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #16070 (failure).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[BigSimmo]

Recommendation: DEFER (do not merge)

Dependabot break-risk assessment for the docling-python group bump in /eval/docling.

Why DEFER (high break risk)

1. Not eval-isolated — worker image consumes this lock.
   Dockerfile.worker copies eval/docling/requirements.txt into /opt/docling-venv for Packet B4 shadow extraction, and documents the pin as docling==2.120.2 by construction so shadow measurements match the Gate B decision-record identity. Merging this PR would move production worker shadow tooling to docling 2.124.0 / docling-parse 7.17.0 / PyMuPDF 1.28.2 without a new Gate B evidence run.

2. Gate B evidence chain would silently invalidate.
   Recorded PASS (docs/rag-improvement/gate-b-decision-record-2026-08-18.*, evidence run 32176604314) is pinned to docling==2.120.2. B4 shadow mode was authorised only on that extractor identity. A lock bump without a fresh owner-dispatched docling-lab.yml run + decision record is an evidence break, not a routine deps refresh.

3. Upstream behavioural drift is non-trivial (2.120.2 → 2.124.0).
   Notable release changes include defaulting to threaded docling-parse, layout nesting changes (tables/pictures in form regions), PDF hyphenation behaviour, and docling-parse 7.13 → 7.17. These can change exactness / table F1 / resource profiles that Gate B scored at 0 pp margins.

4. PR CI cannot prove extraction safety.
   Offline contract (check:docling-lab / unit pin sync) only verifies the lab-config string matches the lock. The full sandboxed benchmark is dispatch-only and never part of pr-required. Green CI here does not mean non-inferiority still holds.

5. Comparator / pin hygiene.
   Lab legacy path remains documented as pymupdf==1.28.0 (worker OCR lock); this PR only moves the docling lab lock’s PyMuPDF to 1.28.2. That is fine for an intentional lab bump after evidence, but mixing it into an unmeasured Dependabot merge increases confusion about what identity shadow mode is running.

What was not done

• No branch update / push / force-push
• No merge / close / auto-merge changes
• No CloudAgent / Lighthouse / live / paid gates

Safe path to unblock later

1. Owner-dispatch docling-lab.yml against this lock (or a dedicated bump branch).
2. Compare against Gate B thresholds; if PASS, write a new decision-record (or explicit “extractor identity refresh” addendum) naming docling==2.124.0.
3. Only then refresh eval/docling/requirements* + lab-config.json, and update Dockerfile.worker commentary that still hard-names 2.120.2.
4. Treat worker shadow enablement as still operator-gated (WORKER_DOCUMENT_EXTRACTOR_MODE).

Adversarial skim (vs main)

Severity	Finding
BLOCKER	Merging changes worker shadow venv identity away from Gate B–proven 2.120.2 via COPY eval/docling/requirements.txt.
IMPORTANT	No re-run evidence for threaded-parse / layout behaviour deltas; CI cannot catch.
IMPORTANT	Dockerfile.worker header still documents 2.120.2; would become stale/misleading on merge.
NIT	Branch is ~405 commits behind main; update-branch alone does not fix the evidence gap.

Decision: DEFER / NO_GO for merge until a new Gate B-equivalent measurement exists.

The PR was not merged. Final merge is left to the user.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 8fcb8891-235d-4060-baad-c20b09063246

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}