[dependabot]

Bumps pymupdf from 1.27.2.3 to 1.28.2.

Release notes

Sourced from pymupdf's releases.

PyMuPDF-1.28.2 released

Wheels for Windows, Linux and MacOS, and the sdist, are available on https://pypi.org and can be installed in the usual way, for example:

python -m pip install --upgrade pymupdf

Changes in version 1.28.2 ()

Fixed issues:

• Fixed #4670
• Fixed #4943
• Fixed #5030
• Fixed #5042
• Fixed #5044
• Fixed #5049

Other:

• Use MuPDF-1.28.2.
• Output warning when legacy fitz module is imported.
• Cope better with markdown containing illegal utf8 sequences.
• Fixed building with PYMUPDF_SETUP_MUPDF_VS_UPGRADE.
• pymupdf.Page.find_tables():
  • new args use_layout: bool = True union: bool = False refine: bool = False.
  • Improved speed.
• Retrospectively added fix for #4936 in release 1.28.0 below.

PyMuPDF-1.28.0 released.

Wheels for Windows, Linux and MacOS, and the sdist, are available on https://pypi.org and can be installed in the usual way, for example:

python -m pip install --upgrade pymupdf

Changes in version 1.28.0

Fixed issues:

• Fixed #4114
• Fixed #4950
• Fixed #5001
• Fixed #5033

Other:

... (truncated)

Changelog

Sourced from pymupdf's changelog.

Change Log

Changes in version 2.0

Fixed issues:

• Fixed 4994 <https://github.com/pymupdf/PyMuPDF/issues/4994>_: Dehyphenate does no longer work since 1.27.1
• Fixed 5054 <https://github.com/pymupdf/PyMuPDF/issues/5054>_: clean_contents(sanitize=True) drops glyph positioning, duplicating an overprinted leading glyph (regression in 1.28.0 from 1.27.2.3)
• Fixed 5055 <https://github.com/pymupdf/PyMuPDF/issues/5055>_: insert_file(...) breaks radio button groups
• Fixed 5059 <https://github.com/pymupdf/PyMuPDF/issues/5059>_: Annotations disappear or move when using Page.remove_rotation() for 90 or 270 rotated pages
• Fixed 5067 <https://github.com/pymupdf/PyMuPDF/issues/5067>_: Memory leak in extractBLOCKS (_as_blocks): text object reference never released
• Fixed 5077 <https://github.com/pymupdf/PyMuPDF/issues/5077>_: Page.remove_rotation() takes minutes on pages with thousands of links
• Fixed 5082 <https://github.com/pymupdf/PyMuPDF/issues/5082>_: Regression in 1.28.x: get_pixmap() and get_text() hang at 100% CPU on a specific PDF; works in 1.27.2.3
• Fixed 5100 <https://github.com/pymupdf/PyMuPDF/issues/5100>_: Import of fitz prints to console instead of generating a DeprecationWarning
• Fixed 5101 <https://github.com/pymupdf/PyMuPDF/issues/5101>_: Cyclic Widget /Parent makes page operations fail with FzErrorFormat: code=7: cycle in resources
• Fixed 5108 <https://github.com/pymupdf/PyMuPDF/issues/5108>_: Page.clip_to_rect() drops 'sh' (shading) operators
• Fixed 5112 <https://github.com/pymupdf/PyMuPDF/issues/5112>_: Stack-based buffer overflow in JM_set_annot_callout_line
• Fixed 5122 <https://github.com/pymupdf/PyMuPDF/issues/5122>_: get_drawings() reports a wrong start point for a subpath following a re with negative width/height
• Fixed 5125 <https://github.com/pymupdf/PyMuPDF/issues/5125>_: get_pixmap() never returns on a tagged PDF page with many MCIDs - pdf_lookup_mcid_in_mcids is a linear scan, making rendering O(n**2) per page
• Fixed 5140 <https://github.com/pymupdf/PyMuPDF/issues/5140>_: Page.get_label() raises IndexError when the page precedes the first label definition
• Fixed 5152 <https://github.com/pymupdf/PyMuPDF/issues/5152>_: apply_redactions() does not remove text shown with the ' operator after TL + Td (regression in 1.28)
• Fixed 5154 <https://github.com/pymupdf/PyMuPDF/issues/5154>_: insert_pdf raises ValueError: is not in list when a widget's /Parent does not list it in /Kids
• Fixed 5165 <https://github.com/pymupdf/PyMuPDF/issues/5165>_: Page.add_widget fails for radio buttons

Other:

• Use MuPDF-1.28.5.
• Added support for form field hierarchies.
• Added support for radio button groups.
• Added support for widget aliases.
• Fixed builds with swig-4.5.
• Fixed CVE-2026-82035.
• Fixed ignoring aspect ratio for square images.
• Fixed potential SEGV in pymupdf.Page.get_cdrawings() if callback raises exception.
• Fixed use with python-3.15.
• Remove the debug timing loop from Annot.update().
• Retrospectively marked #3478 fixed in 1.25.3.
• Retrospectively marked #4896 fixed in 1.28.0.
• Retrospectively marked #4918 fixed in 1.28.0.
• Retrospectively marked #4158 fixed in 1.27.2.2
• Warning for use of deprecated fitz API now uses warnings.warn() with FutureWarning.

Changes in version 1.28.2 (2026-08-06)

Fixed issues:

... (truncated)

Commits

• 12786d1 tests/test_general.py:test_5054(): expect success after recent fix in mupdf m...
• 6adaca9 src/init.py:JM_get_font(): cope with mupdf master fz_lookup_noto_font()'s...
• 59525c7 changes.txt: updates for 1.28.2.
• 948bfba tests/test_pynone.py: renamed test to test_5042() to match github issue.
• 48b26ea .github/ISSUE_TEMPLATE/bug_report.yml: added 1.28.2.
• 6f98b39 setup.py: increment version to 1.28.2.
• 32eacbf tests/test_font.py:test_5049(): don't overwrite input file.
• 1ef7703 setup.py: misc cleanups.
• eb32057 tests/: added test_5054().
• c47e4c1 Add test for fixing #5056
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)