[dependabot]

Bumps kreuzberg from 4.3.8 to 4.10.4.

Release notes

Sourced from kreuzberg's releases.

v4.10.4

[4.10.4] - 2026-09-21

Patch release: CLI acceleration and output-formatting fixes, a dependency refresh, and a TLS advisory bump.

Fixed

• CLI release binaries honour ORT_DYLIB_PATH. The CLI statically linked its bundled CPU ONNX Runtime, so --acceleration cuda failed with "CUDA execution provider requested but not available" even when ORT_DYLIB_PATH pointed at a GPU-enabled runtime. Release artifacts now load ONNX Runtime dynamically and ship a CPU fallback next to the binary. (#8)
• Markdown formatting is no longer stripped from DOCX, EPUB and CSV output. (#5)
• kreuzberg-tesseract releases the native text array when UTF-8 conversion fails, closing an error-path leak. (#7)

Security

• rustls bumped past RUSTSEC-2026-0285. TLS 1.3 handshake messages were accepted across encryption-level boundaries; fixed in 0.23.45.

Changed

• Dependency refresh: liter-llm 1.19 → 2.0.3, tree-sitter-language-pack 1.16.1 → 1.20.0, html-to-markdown-rs 3.12.0 → 3.14.3, and in-range bumps to reqwest, toml, encoding_rs, mail-parser, rmcp and cc.
• Breaking dependency bumps: cfb 0.15, comrak 0.55, lzma-rust2 0.21, dirs 7, lopdf 0.45, jsonschema 0.56, bindgen 0.73.
• The Node package builds with pnpm 12 (two-document lockfile).
• Internal: shell sources are formatted by poly, and the script test suite gains Bats and Pester coverage.

v4.10.3

What's Changed

• fix(chart): harden defaults and add Artifact Hub README by @​Goldziher in kreuzberg-dev/kreuzberg-lts#1
• chore(ci): remove dead self-hosted runner config by @​Goldziher in kreuzberg-dev/kreuzberg-lts#2
• fix: read legacy DOC CLX from correct FIB pair by @​NiekNijland in kreuzberg-dev/kreuzberg-lts#3

New Contributors

• @​Goldziher made their first contribution in kreuzberg-dev/kreuzberg-lts#1
• @​NiekNijland made their first contribution in kreuzberg-dev/kreuzberg-lts#3

Full Changelog: kreuzberg-dev/kreuzberg-lts@v4.10.1...v4.10.3

v4.10.2

What's Changed

• fix(chart): harden defaults and add Artifact Hub README by @​Goldziher in kreuzberg-dev/kreuzberg-lts#1

New Contributors

• @​Goldziher made their first contribution in kreuzberg-dev/kreuzberg-lts#1

Full Changelog: kreuzberg-dev/kreuzberg-lts@v4.10.1...v4.10.2

v4.10.1

Full Changelog: kreuzberg-dev/kreuzberg-lts@v4.10.0...v4.10.1

v4.10.0

Full Changelog: https://github.com/kreuzberg-dev/kreuzberg-lts/commits/v4.10.0

Changelog

Sourced from kreuzberg's changelog.

[4.10.4] - 2026-09-21

Patch release: CLI acceleration and output-formatting fixes, a dependency refresh, and a TLS advisory bump.

Fixed

• CLI release binaries honour ORT_DYLIB_PATH. The CLI statically linked its bundled CPU ONNX Runtime, so --acceleration cuda failed with "CUDA execution provider requested but not available" even when ORT_DYLIB_PATH pointed at a GPU-enabled runtime. Release artifacts now load ONNX Runtime dynamically and ship a CPU fallback next to the binary. (#8)
• Markdown formatting is no longer stripped from DOCX, EPUB and CSV output. (#5)
• kreuzberg-tesseract releases the native text array when UTF-8 conversion fails, closing an error-path leak. (#7)

Security

• rustls bumped past RUSTSEC-2026-0285. TLS 1.3 handshake messages were accepted across encryption-level boundaries; fixed in 0.23.45.

Changed

• Dependency refresh: liter-llm 1.19 → 2.0.3, tree-sitter-language-pack 1.16.1 → 1.20.0, html-to-markdown-rs 3.12.0 → 3.14.3, and in-range bumps to reqwest, toml, encoding_rs, mail-parser, rmcp and cc.
• Breaking dependency bumps: cfb 0.15, comrak 0.55, lzma-rust2 0.21, dirs 7, lopdf 0.45, jsonschema 0.56, bindgen 0.73.
• The Node package builds with pnpm 12 (two-document lockfile).
• Internal: shell sources are formatted by poly, and the script test suite gains Bats and Pester coverage.

[4.10.3] - 2026-09-05

Fixed

• Legacy DOC piece-table lookup now reads fcClx/lcbClx from the correct FIB pair, preventing compressed Windows-1252 text from falling back to UTF-16LE contiguous decoding. Thanks to @​NiekNijland.
• The crate builds again from a fresh dependency resolution. ort 2.0.0-rc.13 and quick-xml 0.42 were published after 4.10.2, and both are reachable through the caret requirements 4.10.2 shipped with. rc.13 moved the execution-provider re-exports behind per-provider cargo features, and quick-xml 0.42 changed its names API from bytes to &str; either one fails to compile against 4.10.2's source. Both are now pinned exactly (=2.0.0-rc.12, =0.41.0), so a fresh cargo add kreuzberg resolves to a combination that builds.
• tree-sitter-language-pack 1.16 compatibility. ProcessConfig gained max_source_bytes and parse_timeout_ms; both are left unset, preserving the previous unbounded, untimed behaviour.

Changed

• Dependency refresh across every language package, including liter-llm 1.9 to 1.19, html-to-markdown-rs 3.8.3 to 3.12.0, rmcp 2.2 to 3.2, base64 0.22 to 0.23, and tree-sitter-language-pack 1.12.5 to 1.16.1.
• liter-llm's tracing feature is no longer requested: as of 1.19 tracing is a mandatory dependency of that crate, so the feature no longer exists. Tracing output is unaffected.

[4.10.0] - 2026-07-11

First release of the standalone Kreuzberg v4 LTS line. This is the long-term-support home for Kreuzberg v4; active development continues as Xberg (v5+). No behavioural changes to extraction — this release is a security, licensing, and packaging refresh.

Security

• Upgraded core dependencies to their latest patched releases (hf-hub, rmcp, lopdf, liter-llm, pyo3, comrak, calamine, quick-xml, text-splitter, tower-http, and others).

Changed

• License is now MIT (earlier v4 releases shipped under the Elastic License 2.0).
• Repository moved to standalone kreuzberg-dev/kreuzberg-lts. New v4 Go releases publish under github.com/kreuzberg-dev/kreuzberg-lts/v4; existing github.com/kreuzberg-dev/kreuzberg pins keep resolving via the Go module proxy cache.

Added

... (truncated)

Commits

• b8c96b3 chore(release): prepare 4.10.4
• 1094f00 fix(cli): load ONNX Runtime dynamically in release artifacts
• 331c19d fix(extraction): restore markdown formatting output (#5)
• ef63bc0 chore(deps): breaking dependency bumps
• 507ea51 chore(deps): compatible dependency bumps
• 197fa60 chore(deps): bump liter-llm, tree-sitter-language-pack, html-to-markdown-rs
• a66c5ec docs(ai-rulez): point the skills at modules that became directories
• 15182af fix(deps): bump rustls past RUSTSEC-2026-0285
• fda4a14 style(shell): let poly format shell sources
• f6b3f98 test(scripts): cover scripts/lib/tessdata.sh
• Additional commits viewable in compare view