chore: dependency updates to resolve cves (#4124)

<!-- CURSOR_SUMMARY -->
> [!NOTE]
> Release 0.18.21 with broad dependency pin updates across requirements
(notably unstructured-inference 1.1.2) to remediate CVEs.
> 
> - **Release**
>   - Set version to `0.18.21` and update `CHANGELOG.md`.
> - **Dependencies**
> - Upgrade `unstructured-inference` to `1.1.2` in
`requirements/extra-pdf-image.txt` to address CVEs.
> - Refresh pins across `requirements/*.txt` (base, dev, test, and
extras), including updates like `certifi`, `click`, `pypdf`, `pypandoc`,
`paddlepaddle`, `torch`/`torchvision`, `google-auth` stack, `protobuf`,
`safetensors`, etc.; normalize pip-compile headers and constraint paths.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
face075. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: lawrence-u10d

CHANGELOG.md

@@ -1,11 +1,12 @@
-## 0.18.21-dev0
+## 0.18.21
 
 ### Enhancement
 - Update save_elements unit test to check crop box padding behavior
 
 ### Features
 
 ### Fixes
+- **Update `unstructured-inference`** to 1.1.2 to address CVEs
 
 ## 0.18.20
 

requirements/base.txt

@@ -2,15 +2,15 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile ./base.in
+#    pip-compile --no-strip-extras ./base.in
 #
 anyio==4.11.0
     # via httpx
 backoff==2.2.1
-    # via -r ./base.in
+    # via -r base.in
 beautifulsoup4==4.14.2
-    # via -r ./base.in
-certifi==2025.10.5
+    # via -r base.in
+certifi==2025.11.12
     # via
     #   httpcore
     #   httpx
@@ -20,31 +20,31 @@ cffi==2.0.0
     # via cryptography
 charset-normalizer==3.4.4
     # via
-    #   -r ./base.in
+    #   -r base.in
     #   requests
     #   unstructured-client
-click==8.3.0
+click==8.3.1
     # via
     #   nltk
     #   python-oxmsg
 cryptography==46.0.3
     # via unstructured-client
 dataclasses-json==0.6.7
     # via
-    #   -r ./base.in
+    #   -r base.in
     #   unstructured-client
 deepdiff==8.6.1
     # via unstructured-client
 emoji==2.15.0
-    # via -r ./base.in
+    # via -r base.in
 exceptiongroup==1.3.0
     # via anyio
 filetype==1.2.0
-    # via -r ./base.in
+    # via -r base.in
 h11==0.16.0
     # via httpcore
 html5lib==1.1
-    # via -r ./base.in
+    # via -r base.in
 httpcore==1.0.9
     # via httpx
 httpx==0.28.1
@@ -60,9 +60,9 @@ joblib==1.5.2
 jsonpath-python==1.0.6
     # via unstructured-client
 langdetect==1.0.9
-    # via -r ./base.in
+    # via -r base.in
 lxml==6.0.2
-    # via -r ./base.in
+    # via -r base.in
 marshmallow==3.26.1
     # via
     #   dataclasses-json
@@ -74,9 +74,9 @@ mypy-extensions==1.1.0
 nest-asyncio==1.6.0
     # via unstructured-client
 nltk==3.9.2
-    # via -r ./base.in
+    # via -r base.in
 numpy==2.2.6
-    # via -r ./base.in
+    # via -r base.in
 olefile==0.47
     # via python-oxmsg
 orderly-set==5.5.0
@@ -86,26 +86,26 @@ packaging==25.0
     #   marshmallow
     #   unstructured-client
 psutil==7.1.3
-    # via -r ./base.in
+    # via -r base.in
 pycparser==2.23
     # via cffi
-pypdf==6.1.3
+pypdf==6.3.0
     # via unstructured-client
 python-dateutil==2.9.0.post0
     # via unstructured-client
-python-iso639==2025.2.18
-    # via -r ./base.in
+python-iso639==2025.11.16
+    # via -r base.in
 python-magic==0.4.27
-    # via -r ./base.in
+    # via -r base.in
 python-oxmsg==0.0.2
-    # via -r ./base.in
+    # via -r base.in
 rapidfuzz==3.14.3
-    # via -r ./base.in
+    # via -r base.in
 regex==2025.11.3
     # via nltk
 requests==2.32.5
     # via
-    #   -r ./base.in
+    #   -r base.in
     #   requests-toolbelt
     #   unstructured-client
 requests-toolbelt==1.0.0
@@ -122,11 +122,11 @@ soupsieve==2.8
     # via beautifulsoup4
 tqdm==4.67.1
     # via
-    #   -r ./base.in
+    #   -r base.in
     #   nltk
 typing-extensions==4.15.0
     # via
-    #   -r ./base.in
+    #   -r base.in
     #   anyio
     #   beautifulsoup4
     #   cryptography
@@ -141,14 +141,14 @@ typing-inspect==0.9.0
     #   unstructured-client
 unstructured-client==0.25.9
     # via
-    #   -c /Users/luke/git/unstructured/requirements/deps/constraints.txt
-    #   -r ./base.in
+    #   -c deps/constraints.txt
+    #   -r base.in
 urllib3==2.5.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/deps/constraints.txt
+    #   -c deps/constraints.txt
     #   requests
     #   unstructured-client
 webencodings==0.5.1
     # via html5lib
-wrapt==2.0.0
-    # via -r ./base.in
+wrapt==2.0.1
+    # via -r base.in

requirements/dev.txt

@@ -2,16 +2,16 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile ./dev.in
+#    pip-compile --no-strip-extras ./dev.in
 #
 build==1.3.0
     # via pip-tools
-cfgv==3.4.0
+cfgv==3.5.0
     # via pre-commit
-click==8.3.0
+click==8.3.1
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
-    #   -c /Users/luke/git/unstructured/requirements/test.txt
+    #   -c base.txt
+    #   -c test.txt
     #   pip-tools
 distlib==0.4.0
     # via virtualenv
@@ -23,17 +23,17 @@ nodeenv==1.9.1
     # via pre-commit
 packaging==25.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
-    #   -c /Users/luke/git/unstructured/requirements/test.txt
+    #   -c base.txt
+    #   -c test.txt
     #   build
-pip-tools==7.5.1
-    # via -r ./dev.in
+pip-tools==7.5.2
+    # via -r dev.in
 platformdirs==4.5.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/test.txt
+    #   -c test.txt
     #   virtualenv
-pre-commit==4.3.0
-    # via -r ./dev.in
+pre-commit==4.4.0
+    # via -r dev.in
 pyproject-hooks==1.2.0
     # via
     #   build
@@ -42,13 +42,13 @@ pyyaml==6.0.3
     # via pre-commit
 tomli==2.3.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/test.txt
+    #   -c test.txt
     #   build
     #   pip-tools
 typing-extensions==4.15.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
-    #   -c /Users/luke/git/unstructured/requirements/test.txt
+    #   -c base.txt
+    #   -c test.txt
     #   virtualenv
 virtualenv==20.35.4
     # via pre-commit

requirements/extra-csv.txt

@@ -2,23 +2,23 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile ./extra-csv.in
+#    pip-compile --no-strip-extras ./extra-csv.in
 #
 numpy==2.2.6
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
+    #   -c base.txt
     #   pandas
 pandas==2.3.3
-    # via -r ./extra-csv.in
+    # via -r extra-csv.in
 python-dateutil==2.9.0.post0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
+    #   -c base.txt
     #   pandas
 pytz==2025.2
     # via pandas
 six==1.17.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
+    #   -c base.txt
     #   python-dateutil
 tzdata==2025.2
     # via pandas

requirements/extra-docx.txt

@@ -2,15 +2,15 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile ./extra-docx.in
+#    pip-compile --no-strip-extras ./extra-docx.in
 #
 lxml==6.0.2
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
+    #   -c base.txt
     #   python-docx
 python-docx==1.2.0
-    # via -r ./extra-docx.in
+    # via -r extra-docx.in
 typing-extensions==4.15.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
+    #   -c base.txt
     #   python-docx

requirements/extra-epub.txt

@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile ./extra-epub.in
+#    pip-compile --no-strip-extras ./extra-epub.in
 #
-pypandoc==1.15
-    # via -r ./extra-epub.in
+pypandoc==1.16.2
+    # via -r extra-epub.in

requirements/extra-markdown.txt

@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile ./extra-markdown.in
+#    pip-compile --no-strip-extras ./extra-markdown.in
 #
 markdown==3.10
-    # via -r ./extra-markdown.in
+    # via -r extra-markdown.in

requirements/extra-odt.txt

@@ -2,17 +2,17 @@
 # This file is autogenerated by pip-compile with Python 3.10
 # by the following command:
 #
-#    pip-compile ./extra-odt.in
+#    pip-compile --no-strip-extras ./extra-odt.in
 #
 lxml==6.0.2
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
+    #   -c base.txt
     #   python-docx
-pypandoc==1.15
-    # via -r ./extra-odt.in
+pypandoc==1.16.2
+    # via -r extra-odt.in
 python-docx==1.2.0
-    # via -r ./extra-odt.in
+    # via -r extra-odt.in
 typing-extensions==4.15.0
     # via
-    #   -c /Users/luke/git/unstructured/requirements/base.txt
+    #   -c base.txt
     #   python-docx