unstale

pypi / docling-slim

docling-slim

What changed in docling-slim 2, from its official release notes, upgrade guides and advisories. Also covers docling. Sources checked 2026-10-31.

1 breaking8 security3 new APIs and options1 behavior and defaults30 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.9 on npm

docling-slim 243 changes

Breaking changes 1

  • Email processing no longer copies .msg attachment content.

    2.145.0release notes

Security 8

  • Docling: Configured HTTP headers sent to every remote image host named by a document

    2.132.0security advisory

  • Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

    2.132.0security advisory

  • Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode)

    2.132.0security advisory

  • Docling: Crafted DoclingDocument JSON embeds local image files into converted output

    2.131.0security advisory

  • Docling imports plugin entry points before the allow_external_plugins check

    2.131.0security advisory

  • Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)

    2.131.0security advisory

  • Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion

    2.131.0security advisory

  • Docling: enable_local_fetch is not enforced in HTML browser-rendering mode

    2.118.1security advisory

New APIs and options 3

  • Adds a release method to InputDocument.

    2.145.0release notes

  • RapidOCR detects page orientation.

    2.145.0release notes

  • Adds --heading-hierarchy and allows running the heading style signal without generate_parsed_pages.

    2.144.0release notes

Behavior and default changes 1

  • Broken PDF text layers are replaced with OCR.

    2.144.0release notes

Fixes and other changes 30

  • A page is retained when a Chandra table is too large.

    2.145.0release notes

  • The service client no longer sends the default page range in request options.

    2.145.0release notes

  • DocLang locations are scaled to the page size.

    2.145.0release notes

  • Empty cells are no longer created while finding XLSX tables.

    2.145.0release notes

  • The target of an ext-link is retained in a mixed JATS citation.

    2.145.0release notes

  • JATS captions no longer render the literal text None.

    2.145.0release notes

  • JATS tables with a single header row span are retained.

    2.145.0release notes

  • Native VLM inline math is preserved through exports.

    2.145.0release notes

  • XLSX currency, percent, and date number formats are retained.

    2.145.0release notes

  • Page backend references are dropped when unloading.

    2.145.0release notes

  • Importing presets no longer initializes MLX.

    2.145.0release notes

  • HTML rows stored in tfoot are retained.

    2.145.0release notes

  • NUL characters from unmapped glyphs are replaced with U+FFFD.

    2.145.0release notes

  • Leading YAML frontmatter is stripped instead of being misparsed.

    2.145.0release notes

  • Normalizes Arabic presentation forms in extracted PDF text.

    2.144.0release notes

  • Drops spaces around Chandra br line breaks.

    2.144.0release notes

  • Ignores whitespace between Chandra list paragraphs.

    2.144.0release notes

  • Forwards temperature and anti-hallucination options to mlx-whisper.

    2.144.0release notes

  • Recognizes Symbol and Wingdings private-use bullets as list markers.

    2.144.0release notes

  • Reads heads split by a spanning block from top to bottom.

    2.144.0release notes

  • Prevents concurrent conversions from crashing the tesserocr engine.

    2.144.0release notes

  • Imports torch lazily in the transformers ASR decoder.

    2.144.0release notes

  • Treats zero DPI metadata as missing.

    2.144.0release notes

  • Skips macOS metadata members in ZIP inputs.

    2.144.0release notes

  • The header row is counted against the chart table cell cap.

    2.143.1release notes

  • Shapes whose text is only whitespace are skipped.

    2.143.1release notes

  • OCR word cells are kept in table tokens.

    2.143.1release notes

  • OCR cells are added to table tokens alongside native words.

    2.143.1release notes

  • Full-page OCR reads the page's parsed_page for table tokens.

    2.143.1release notes

  • The render resolution is passed to the Tesseract CLI.

    2.143.1release notes