# What changed in docling-slim

> 43 changes in docling-slim 2 from its official release notes, upgrade guides and advisories: 1 breaking, 8 security, 3 new APIs and options. Each one cited. Sources checked 2026-10-31. HTML: https://unstale.sh/pypi/docling-slim/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## docling-slim 2

### Breaking changes

- Email processing no longer copies .msg attachment content. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)

### Security

- Docling: Configured HTTP headers sent to every remote image host named by a document (2.132.0) — [security advisory](https://github.com/advisories/GHSA-P3FW-7699-7926)
- Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine (2.132.0) — [security advisory](https://github.com/advisories/GHSA-X3Q2-H9HX-4R4J)
- Docling has SSRF guard bypass in remote resource fetching (DNS rebinding / multi-record resolution; no IP validation in HTML render mode) (2.132.0) — [security advisory](https://github.com/advisories/GHSA-PC36-QWJQ-X68C)
- Docling: Crafted DoclingDocument JSON embeds local image files into converted output (2.131.0) — [security advisory](https://github.com/advisories/GHSA-P944-4XH2-X776)
- Docling imports plugin entry points before the allow_external_plugins check (2.131.0) — [security advisory](https://github.com/advisories/GHSA-9JXX-VJRV-H2RQ)
- Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection) (2.131.0) — [security advisory](https://github.com/advisories/GHSA-3CR3-8M4C-FPXW)
- Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backends causes CPU/memory exhaustion (2.131.0) — [security advisory](https://github.com/advisories/GHSA-CGC7-9QP3-86M3)
- Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode (2.118.1) — [security advisory](https://github.com/advisories/GHSA-Q43M-VHCP-MHVM)

### New APIs and options

- Adds a release method to InputDocument. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- RapidOCR detects page orientation. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- Adds --heading-hierarchy and allows running the heading style signal without generate_parsed_pages. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)

### Behavior and default changes

- Broken PDF text layers are replaced with OCR. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)

### Fixes and other changes

- A page is retained when a Chandra table is too large. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- The service client no longer sends the default page range in request options. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- DocLang locations are scaled to the page size. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- Empty cells are no longer created while finding XLSX tables. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- The target of an ext-link is retained in a mixed JATS citation. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- JATS captions no longer render the literal text None. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- JATS tables with a single header row span are retained. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- Native VLM inline math is preserved through exports. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- XLSX currency, percent, and date number formats are retained. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- Page backend references are dropped when unloading. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- Importing presets no longer initializes MLX. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- HTML rows stored in tfoot are retained. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- NUL characters from unmapped glyphs are replaced with U+FFFD. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- Leading YAML frontmatter is stripped instead of being misparsed. (2.145.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.145.0)
- Normalizes Arabic presentation forms in extracted PDF text. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Drops spaces around Chandra br line breaks. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Ignores whitespace between Chandra list paragraphs. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Forwards temperature and anti-hallucination options to mlx-whisper. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Recognizes Symbol and Wingdings private-use bullets as list markers. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Reads heads split by a spanning block from top to bottom. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Prevents concurrent conversions from crashing the tesserocr engine. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Imports torch lazily in the transformers ASR decoder. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Treats zero DPI metadata as missing. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- Skips macOS metadata members in ZIP inputs. (2.144.0) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.144.0)
- The header row is counted against the chart table cell cap. (2.143.1) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.143.1)
- Shapes whose text is only whitespace are skipped. (2.143.1) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.143.1)
- OCR word cells are kept in table tokens. (2.143.1) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.143.1)
- OCR cells are added to table tokens alongside native words. (2.143.1) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.143.1)
- Full-page OCR reads the page's parsed_page for table tokens. (2.143.1) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.143.1)
- The render resolution is passed to the Tesseract CLI. (2.143.1) — [release notes](https://github.com/docling-project/docling/releases/tag/v2.143.1)