build(deps): bump pypdf from 6.14.2 to 6.15.0 in /mlperf-edu

[dependabot]

Bumps pypdf from 6.14.2 to 6.15.0.

Release notes

Sourced from pypdf's releases.

Version 6.15.0, 2026-08-06

What's new

Security (SEC)

• Improve performance of read_until_whitespace (#3947) by @​stefan6419846
• Limit CID width range and width count when loading fonts (#3946) by @​stefan6419846
• Limit token length for ToUnicode entries (#3944) by @​stefan6419846

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#3897) by @​stefan6419846

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#3901) by @​PJBrs
• Allow keeping original PDF header in non-incremental clone mode (#3918) by @​pctablet505
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831) by @​PJBrs
• Add actions base class (#3552) by @​j-t-1

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#3938) by @​RavSinghChandan
• Decode low-bit DeviceRGB images as RGB instead of palette (#3929) by @​RavSinghChandan
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#3937) by @​stefan6419846

Documentation (DOC)

• Image and attachment filenames are unsanitized (#3942) by @​stefan6419846

Maintenance (MAINT)

• Update charset mappings (#3935) by @​stefan6419846

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.15.0, 2026-08-06

Security (SEC)

• Improve performance of read_until_whitespace (#3947)
• Limit CID width range and width count when loading fonts (#3946)
• Limit token length for ToUnicode entries (#3944)

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#3897)

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#3901)
• Allow keeping original PDF header in non-incremental clone mode (#3918)
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#3831)
• Add actions base class (#3552)

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#3938)
• Decode low-bit DeviceRGB images as RGB instead of palette (#3929)
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#3937)

Documentation (DOC)

• Image and attachment filenames are unsanitized (#3942)

Maintenance (MAINT)

• Update charset mappings (#3935)

Full Changelog

Commits

• 7f226a2 REL: 6.15.0
• 4959848 SEC: Improve performance of read_until_whitespace (#3947)
• 51cb6ac SEC: Limit CID width range and width count when loading fonts (#3946)
• afba808 SEC: Limit token length for ToUnicode entries (#3944)
• aa2f37d DOC: Image and attachment filenames are unsanitized (#3942)
• 760ba28 DOC: Further clarify security policy
• 55bd85c BUG: Expand low-bit samples for images without a filter (#3938)
• 4807cb4 ROB: Tolerate malformed /FontBBox when building font descriptors (#3895)
• ce9320b DEV: Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 (#3941)
• 8b6f6fd ENH: Add ActualText tag when we produce RTL appearance stream (#3901)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[Shashank-Tripathi-07]

Things changed in this dependency bump: Patch release. Three security hardening fixes (bounded font-width/CID parsing, bounded ToUnicode token length, faster whitespace scanning), a few bug fixes for low-bit image decoding and FlateDecode param handling, and a deprecation of an already-unused inline_images setter. No API removals.

Components this dependency touches: mlperf-edu/paper/check_paper_pdf.py, the only real usage, imports PdfReader to check a submitted paper PDF. Direct dependency in mlperf-edu/pyproject.toml.

Downstream components that may break (if merged): None identified. The changed code paths (font/CID parsing edge cases, low-bit images) aren't in the surface check_paper_pdf.py exercises.

What to do before merging: Nothing beyond normal CI. Optional: run check_paper_pdf.py against one real submitted PDF locally to confirm page/text extraction still matches.

Final decision: Let's get this merged.

[Shashank-Tripathi-07]

CI is red here, but not because of this bump. The failing jobs (Tests, Audit, and Package Portability, and everything downstream of it) fail with ModuleNotFoundError: No module named 'matplotlib' in tests/test_paper_figures.py, matplotlib is imported by tools/generate_paper_figures.py but was never added to mlperf-edu/pyproject.toml or uv.lock. Same failure is hitting #2000, #1993, and #1992 right now, so this is repo-wide, not specific to this bump.

Once matplotlib is added as a dependency and this PR rebases onto that fix, CI should go green and this can be merged.