fix: update extractor Python dependencies

[davidwaizer]

Updates the locked Docling extractor dependency graph to remediate the Trivy findings in packages/extractor/python/uv.lock.

Validation: uv lock check, frozen uv sync, dependency imports, Python compilation, end-to-end DOCX extraction smoke test, Bun lint/typecheck/tests/build/site typecheck, and targeted Trivy scan (0 findings).

[qodo-code-review]

Qodo reviews are paused for this user.

Troubleshooting steps vary by plan Learn more →

On a Teams plan?
Reviews resume once this user has a paid seat and their Git account is linked in Qodo.
Link Git account →

Using GitHub Enterprise Server, GitLab Self-Managed, or Bitbucket Data Center?
These require an Enterprise plan - Contact us
Contact us →

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-28T22:39:04.856916Z	77e4359	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

docx-corpus/packages/extractor/python/uv.lock

Line 2743 in 77e4359

{ url = "https://files.pythonhosted.org/packages/7f/e7/19894fdb51c7dbaf94f5a79bb0871da0992e8e4241e579cb006da46d2e58/torch-2.13.0-cp310-cp310-macosx_14_0_arm64.whl", hash = "sha256:94f0de129916f77b8dc2c7a8eff644cfeddfe59e39c9f55e9f6e17543410281d", size = 111178962, upload-time = "2026-07-08T16:05:49.855Z" },

Retain support for pre-14 Apple Silicon macOS

The upgraded Torch lock contains only macosx_14_0_arm64 wheels, so uv sync --frozen can no longer install the extractor on Apple Silicon machines running macOS 11–13. I reproduced this for macOS 13/Python 3.12 with uv sync --python-platform aarch64-apple-darwin --frozen --dry-run: the new lock rejects Torch 2.13.0, while the parent lock successfully selects Torch 2.9.1's macosx_11_0_arm64 wheel. (uv sync --help defines --python-platform as selecting the platform for which requirements are installed.) Please retain a compatible Torch resolution for older supported macOS versions or explicitly constrain the project's platform support.

---

docx-corpus/packages/extractor/python/uv.lock

Line 2727 in 77e4359

{ name = "cuda-toolkit", extra = ["cublas", "cudart", "cufft", "cufile", "cupti", "curand", "cusolver", "cusparse", "nvjitlink", "nvrtc", "nvtx"], marker = "sys_platform == 'linux'" },

Avoid installing the CUDA stack on every ARM Linux host

On aarch64 Linux, this unconditional sys_platform == 'linux' dependency makes the normal extractor uv sync install the complete CUDA 13 stack even when the machine has no NVIDIA GPU. I compared uv sync --python-platform aarch64-manylinux_2_28 --frozen --dry-run against the parent lock: the old graph installs only Torch and Torchvision, while this graph adds 18 CUDA/NVIDIA packages whose selected ARM wheels total about 2.27 GB compressed, plus Triton and a much larger Torch wheel. This is particularly inconsistent with the image build's explicit use of PyTorch's CPU index; the lock should likewise select CPU Torch by default or gate these packages on an explicit GPU configuration.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".