chore(deps): update pymupdf requirement from >=1.24 to >=1.28.0

[dependabot]

Updates the requirements on pymupdf to permit the latest version.

Changelog

Sourced from pymupdf's changelog.

Change Log

Fixed issues:

• Fixed 4670 <https://github.com/pymupdf/PyMuPDF/issues/4670>_: scrub fails to remove hidden text after clean_contents stopped including line breaks (\u2265 1.24.0)
• Fixed 4943 <https://github.com/pymupdf/PyMuPDF/issues/4943>_: enh: applying redactions with image cropping for currently unsupported colorspaces
• Fixed 5030 <https://github.com/pymupdf/PyMuPDF/issues/5030>_: find_tables() with layout enabled can return a zero-cell Table, and Table.bbox then raises "ValueError: min() iterable argument is empty"
• Fixed 5044 <https://github.com/pymupdf/PyMuPDF/issues/5044>_: Outline (TOC) parsing bug
• Fixed 5049 <https://github.com/pymupdf/PyMuPDF/issues/5049>_: font subsetting segfaults in 1.28.0, regression from 1.27.2.2 #5049
• Fixed 5042 <https://github.com/pymupdf/PyMuPDF/issues/5042>_: Page.get_texttrace() leaks None references \u2014 Fatal Python error (none_dealloc) in long-running processes (1.27.2.3 & 1.28.0)

Other:

• Output warning when legacy fitz module is imported.
• Cope better with markdown containing illegal utf8 sequences.
• Fixed building with PYMUPDF_SETUP_MUPDF_VS_UPGRADE.
• pymupdf.Page.find_tables():
  • new args use_layout: bool = True union: bool = False refine: bool = False.
  • Improved speed.

Changes in version 1.28.0 (2026-06-29)

Fixed issues:

• Fixed 4114 <https://github.com/pymupdf/PyMuPDF/issues/4114>_: ComboBox choice_values full of empty strings despite PDF having valid choices.
• Fixed 4950 <https://github.com/pymupdf/PyMuPDF/issues/4950>_: remove_rotation() raises ValueError on widgets with empty/infinite rects
• Fixed 5001 <https://github.com/pymupdf/PyMuPDF/issues/5001>_: Formulae incorrectly rendered as black boxes
• Fixed 5033 <https://github.com/pymupdf/PyMuPDF/issues/5033>_: Annot.set_rotation(0) followed by Annot.update() throws AttributeError

Other:

• Use MuPDF-1.28.0.
• pymupdf.Document.init(): new arg archive to support documents with archives.
• pymupdf.Document.convert_to_pdf(): also generate links.
• Fixed MacOS x64 platform tag - used to be macosx_10_9_x86_64, but we actually require MacOS 10.15, so platform tag is now macosx_10_15_x86_64.
• Support Windows builds with free thread python.
• pymupdf.Document.save() now saves non-PDF documents in PDF format.
• New method pymupdf.Document.apply_css().
• Pyodide wheel is available on pypi.org.

Changes in version 1.27.2.3 (2026-04-24)

• Fixed issues:

... (truncated)

Commits

• e9cdfc9 changes.txt: fix mupdf version number.
• 629a358 docs/document.rst: add new in 1.28.0 to init's archive.
• 7264f27 README.md: updated example conversion from md to pdf.
• 119a0bc docs/document.rst: document that save() now also works for non-pdf documents.
• 5ebfc4c setup.py: use mupdf-1.28.0.
• 14d8fac changes.txt: removed bogus #4423 entry, added #5033.
• d961616 tests/test_annots.py: added test_5033() for setRect() vs set_rect() bug.
• d91bd63 changes.txt: added note about save() and non-pdf documents.
• fd409de .github/workflows/: updated to use mupdf branch 1.28.x.
• 04aa7dd Remove old setRect Name
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

Quality Report

• Generated (UTC): 2026-08-03T06:46:05Z
• Repo: /home/runner/work/ARI/ARI
• Checkers: 1 run, 6 unavailable
• Findings: 21 total; 0 net-new vs baseline

Checkers

checker	status	findings	allowlisted	Δ new	note
check_complexity	unavailable	0	0	0	no JSON for check_complexity in quality-artifacts
check_import_boundaries	unavailable	0	0	0	no JSON for check_import_boundaries in quality-artifacts
check_public_api_contracts	error	0	0	0	unparseable JSON (check_public_api_contracts.json): Expectin
check_viz_api_schema	ok	21	21	0
check_prompts	unavailable	0	0	0	no JSON for check_prompts in quality-artifacts
check_dead_code	unavailable	0	0	0	no JSON for check_dead_code in quality-artifacts
check_directory_policy	unavailable	0	0	0	no JSON for check_directory_policy in quality-artifacts

Areas

area	LOC	findings
ari-core/ari/agent	3319	0
ari-core/ari/cli	2599	0
ari-core/ari/clone	665	0
ari-core/ari/config	779	0
ari-core/ari/configs	69	0
ari-core/ari/evaluator	1300	0
ari-core/ari/llm	1246	0
ari-core/ari/mcp	495	0
ari-core/ari/memory	472	0
ari-core/ari/migrations	170	0
ari-core/ari/orchestrator	3157	0
ari-core/ari/pipeline	4180	0
ari-core/ari/prompts	420	0
ari-core/ari/protocols	410	0
ari-core/ari/public	148	0
ari-core/ari/publish	794	0
ari-core/ari/registry	511	0
ari-core/ari/schemas	20	0
ari-core/ari/viz	8532	21
ari-skill-benchmark/src	175	0
ari-skill-coding/src	644	0
ari-skill-evaluator/src	952	0
ari-skill-hpc/src	1004	0
ari-skill-idea/src	1916	0
ari-skill-memory/src	2876	0
ari-skill-orchestrator/src	1043	0
ari-skill-paper/src	4256	0
ari-skill-paper-re/src	5843	0
ari-skill-plot/src	802	0
ari-skill-replicate/src	1684	0
ari-skill-transform/src	3180	0
ari-skill-vlm/src	355	0
ari-skill-web/src	712	0

Dead code

• Source: check_dead_code (status: unavailable)
• Note: no JSON for check_dead_code in quality-artifacts
• Baseline: scripts/quality/baselines/dead_code_baseline.json
• Safe-to-delete surviving human review: 0

classification	count
SAFE_DELETE_CANDIDATE	0
QUARANTINE_CANDIDATE	0
TEST_ONLY	0
DOCS_ONLY	0
DYNAMIC_REFERENCE_RISK	0
PUBLIC_CONTRACT	0
REVIEW_REQUIRED	0