deps(docker): bump kreuzberg-dev/kreuzberg-cli from 4.5.4 to 4.6.3

[dependabot]

Bumps kreuzberg-dev/kreuzberg-cli from 4.5.4 to 4.6.3.

Release notes

Sourced from kreuzberg-dev/kreuzberg-cli's releases.

v4.6.3

[4.6.3] - 2026-03-27

Added

• Tower service layer (service module): Composable ExtractionService implementing tower::Service with configurable middleware layers (tracing, metrics, timeout, concurrency limit). New tower-service feature flag, auto-enabled by api and mcp. ExtractionServiceBuilder provides ergonomic layer composition.
• Semantic OpenTelemetry conventions (telemetry module): Formal kreuzberg.* attribute namespace with 30+ span attributes, metric names, and operation/stage constants.
• Extraction metrics: 11 OTel metric instruments (counters, histograms, gauge) covering extraction totals, durations, cache hits/misses, pipeline stages, OCR, and concurrent extractions. Feature-gated behind otel.
• InstrumentedExtractor wrapper: Automatic per-extractor tracing spans and metrics without per-extractor annotations. Injected at registry dispatch when otel feature is enabled.

Improved

• Deeper instrumentation: Pipeline post-processing stages, individual processor execution, OCR operations, and RT-DETR layout model inference now have semantic spans and duration metrics.
• API and MCP servers use ExtractionService: Both consumers now route extractions through the Tower service stack.
• Unified config merge: JSON config merge logic deduplicated between CLI and MCP.
• API server hardening: Added response compression (gzip/brotli/zstd), panic recovery, request-ID correlation, and sensitive header redaction via tower-http middleware.

Changed

• Removed per-extractor #[instrument] annotations: 29 manual annotations replaced by the automatic InstrumentedExtractor wrapper.
• Span attribute names migrated to kreuzberg.* namespace: extraction.filename -> kreuzberg.document.filename, extraction.mime_type -> kreuzberg.document.mime_type, etc.

Fixed

• EPUB spine semantics refactor (#594): Richer OPF package model preserves manifest fallback chains, guide references, and non-linear spine items. Navigation chrome stripped from output. Malformed guide references now produce warnings instead of hard failures.
• DOCX image extraction for <a:blip> with child elements (#591): Images with high-quality settings were not extracted. Now handles Event::Start for <a:blip>.
• OCR table extraction returned empty results via pipeline path (#593): Layout detection and table propagation fixed for both code paths.
• Missing chunker_type field in bindings (#592): Exposed across Python, TypeScript/WASM, Go, C#, PHP bindings.
• Full API parity across all 10 bindings: Added max_archive_depth to all bindings. Added missing typed config classes for acceleration, email, layout, concurrency where needed.
• Node Windows publish failure: Prepare script fallback replaced with cross-platform node -e.
• CI Validate path triggers broadened: Covers docs/**, biome.json, .task/**, and other lintable paths.
• Publish pipeline ORT bundling: Configurable strategy input (system/bundled) on setup-onnx-runtime action. Publish jobs now use strategy: bundled.
• C FFI CI missing ORT setup: Added setup-onnx-runtime step to ci-c-ffi.yaml.

v4.6.2

[4.6.2] - 2026-03-26

Added

• PDF page rendering API (#583): New render_pdf_page function and PdfPageIterator for rendering individual PDF pages as PNG images. Available across all 11 language bindings with idiomatic patterns (Python context manager, Go Close(), Java AutoCloseable, C# IDisposable, Elixir Stream, etc.). Default 150 DPI, configurable per call.

Fixed

• Table recognition coordinate mismatch on scanned PDFs (#582): Layout detection bboxes (640x640 model space) are now scaled to OCR render resolution before TATR table recognition. Previously, coordinate space mismatch caused zero tables to be found.
• OCR elements report page_number: 1 for all pages (#582): Tesseract resets page numbers per single-page render. Page numbers are now correctly stamped after OCR in the batch loop.
• Rust E2E tests missing PDF feature: Added pdf feature to the e2e-generator Rust template, fixing 41 UnsupportedFormat("application/pdf") failures.
• HWP styled extraction empty on ARM: Added skip_on_platform support to Python and Java e2e generators, skipping the hwp_styled fixture on aarch64-unknown-linux-gnu.
• WASM CI build failure: Made kreuzberg-node prepare script resilient to missing native addon, preventing ENOENT: dist/cli.js during pnpm workspace install.
• Go C header stale at 4.5.0: Synced header and DefaultVersion constant to match current version.
• Ruby gem missing ONNX Runtime: Added ort-bundled feature to Ruby native Cargo.toml.

... (truncated)

Changelog

Sourced from kreuzberg-dev/kreuzberg-cli's changelog.

[4.6.3] - 2026-03-27

Added

• Tower service layer (service module): Composable ExtractionService implementing tower::Service with configurable middleware layers (tracing, metrics, timeout, concurrency limit). New tower-service feature flag, auto-enabled by api and mcp. ExtractionServiceBuilder provides ergonomic layer composition.
• Semantic OpenTelemetry conventions (telemetry module): Formal kreuzberg.* attribute namespace with 30+ span attributes, metric names, and operation/stage constants. Documented conventions for document extraction, pipeline stages, OCR, and model inference telemetry.
• Extraction metrics: 11 OTel metric instruments (counters, histograms, gauge) covering extraction totals, durations, cache hits/misses, pipeline stages, OCR, and concurrent extractions. Feature-gated behind otel.
• InstrumentedExtractor wrapper: Automatic per-extractor tracing spans and metrics without per-extractor annotations. Injected at registry dispatch when otel feature is enabled.

Improved

• Deeper instrumentation: Pipeline post-processing stages (Early/Middle/Late), individual processor execution, OCR operations, and RT-DETR layout model inference now have semantic spans and duration metrics.
• API and MCP servers use ExtractionService: Both consumers now route extractions through the Tower service stack, getting unified tracing, metrics, and middleware for free.
• Unified config merge: JSON config merge logic deduplicated between CLI and MCP into a shared function.
• API server hardening: Added response compression (gzip/brotli/zstd), panic recovery, request-ID correlation, and sensitive header redaction via tower-http middleware.

Changed

• Removed per-extractor #[instrument] annotations: 29 manual #[cfg_attr(feature = "otel", tracing::instrument(...))] annotations replaced by the automatic InstrumentedExtractor wrapper.
• Span attribute names migrated to kreuzberg.* namespace: extraction.filename -> kreuzberg.document.filename, extraction.mime_type -> kreuzberg.document.mime_type, etc.

Fixed

• EPUB spine semantics refactor (#594): Richer OPF package model preserves manifest fallback chains, guide references, and non-linear spine items. Navigation chrome stripped from output. Malformed guide references now produce warnings instead of hard failures. Tested for fallback cycles and empty spines.
• DOCX image extraction for <a:blip> with child elements (#591): Images with high-quality settings (containing <a:extLst> children) were not extracted because only Event::Empty was handled. Now also handles Event::Start for <a:blip>.
• OCR table extraction returned empty results via pipeline path (#593): Layout detection was gated behind a needs_structured check, skipping it for the default Plain output format. Tables from run_ocr_pipeline were discarded. Both paths now propagate tables correctly.
• Missing chunker_type field in bindings (#592): Exposed chunker_type, sizing_cache_dir, and prepend_heading_context fields across Python, TypeScript/WASM, Go, C#, PHP bindings.
• Full API parity across all 10 bindings: Added max_archive_depth to all bindings. Added missing acceleration, email to Ruby/R. Added layout to PHP. Added 7 missing fields to WASM. Fixed parity script regex for Go slice types.
• test_pipeline_with_all_features assertion without quality feature: quality_score assertion now gated behind #[cfg(feature = "quality")].
• Node Windows publish failure: Prepare script fallback used bash-specific mkdir -p and echo > which fail on Windows. Replaced with cross-platform node -e fallback.
• CI Validate path triggers too narrow: Broadened glob patterns to cover docs/**, biome.json, .task/**, and other lintable paths that prek hooks check.
• Publish pipeline ORT bundling: Added configurable strategy input (system/bundled) to setup-onnx-runtime action. Set strategy: bundled for all publish jobs so ort-bundled cargo feature takes effect, producing self-contained binaries.

---

[4.6.2] - 2026-03-26

Added

• PDF page rendering API (#583): New render_pdf_page function and PdfPageIterator for rendering individual PDF pages as PNG images. Available across all 11 language bindings with idiomatic patterns (Python context manager, Go Close(), Java AutoCloseable, C# IDisposable, Elixir Stream, etc.). Default 150 DPI, configurable per call.

Fixed

• Table recognition coordinate mismatch on scanned PDFs (#582): Layout detection bboxes (640x640 model space) are now scaled to OCR render resolution before TATR table recognition. Previously, coordinate space mismatch caused zero tables to be found.
• OCR elements report page_number: 1 for all pages (#582): Tesseract resets page numbers per single-page render. Page numbers are now correctly stamped after OCR in the batch loop.
• Rust E2E tests missing PDF feature: Added pdf feature to the e2e-generator Rust template, fixing 41 UnsupportedFormat("application/pdf") failures.
• HWP styled extraction empty on ARM: Added skip_on_platform support to Python and Java e2e generators, skipping the hwp_styled fixture on aarch64-unknown-linux-gnu.
• WASM CI build failure: Made kreuzberg-node prepare script resilient to missing native addon, preventing ENOENT: dist/cli.js during pnpm workspace install.
• Go C header stale at 4.5.0: Synced header and DefaultVersion constant to match current version.
• Ruby gem missing ONNX Runtime: Added ort-bundled feature to Ruby native Cargo.toml.

... (truncated)

Commits

• b569454 fix(tesseract): resolve MinGW compiler by absolute path, bust stale MSVC cache
• c78e841 fix(ci): use dynamic ORT linking on Windows GNU; document runtime requirement
• 95793fa fix(ci): don't set ORT_LIB_LOCATION in bundled strategy so ort-sys statically...
• b29c2cb Merge pull request #597 from pratik-mahalle/features
• 73c288a add new image in feature page
• 72dd8f0 chore: bump version to 4.6.3, fix C FFI CI missing ORT setup
• e95370c fix(epub): harden guide parsing, add cycle/empty-spine tests
• d9f0cd8 fix: API parity, PR review fixes, dependency updates, changelog
• a3b2e75 chore: aligns bindings
• fa62036 fix(epub): preserve spine semantics and reduce TOC navigation noise (#594)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: docker. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[stefan-ernst]

https://github.com/dependabot rebase

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[dependabot]

Dependabot can't authenticate to a private package registry. Because of this, Dependabot cannot update this pull request.

[github-actions]

🔍 Deadcode Analysis

Found potentially unused code (click to expand)

internal/database/sqlite_deferred_indexes.go:27:6: unreachable func: MaterializeDeferredSQLiteCustomFieldIndexes
internal/handlers/attachment.go:180:29: unreachable func: AttachmentHandler.resolveStoredAttachmentPath
internal/handlers/item_links.go:98:27: unreachable func: ItemLinkHandler.ensureLinkService
internal/handlers/item_links.go:113:27: unreachable func: ItemLinkHandler.resolveEntityScope
internal/handlers/item_links.go:118:27: unreachable func: ItemLinkHandler.endpointVisible
internal/handlers/item_links.go:123:27: unreachable func: ItemLinkHandler.filterLinksByAccess
internal/handlers/item_links.go:128:27: unreachable func: ItemLinkHandler.accessibleAssetSetIDSet
internal/handlers/item_links.go:136:27: unreachable func: ItemLinkHandler.canUserViewEntity
internal/handlers/jira_import_execution.go:88:29: unreachable func: JiraImportHandler.executeImportWithClient
internal/handlers/statuses.go:37:25: unreachable func: StatusHandler.validateStatusFields
internal/handlers/statuses.go:63:25: unreachable func: StatusHandler.GetAll
internal/handlers/statuses.go:75:25: unreachable func: StatusHandler.Get
internal/handlers/statuses.go:96:25: unreachable func: StatusHandler.Create
internal/handlers/statuses.go:143:25: unreachable func: StatusHandler.Update
internal/handlers/statuses.go:193:25: unreachable func: StatusHandler.Delete
internal/handlers/test_runs.go:309:26: unreachable func: TestRunHandler.GetBySet
internal/logbook/repository.go:762:22: unreachable func: Repository.IncrementRetrievalCount
internal/logbook/repository.go:818:22: unreachable func: Repository.DeleteAttachment
internal/plugins/manager.go:811:6: unreachable func: ReadPluginFile
internal/plugins/manager_common.go:45:6: unreachable func: WithTimeout
internal/plugins/manager_common.go:50:6: unreachable func: WithMemoryLimit
internal/plugins/manager_common.go:55:6: unreachable func: WithHTTPClient
internal/plugins/manager_common.go:60:6: unreachable func: WithSMTPSender
internal/plugins/manager_common.go:65:6: unreachable func: WithLogger
internal/plugins/router.go:166:18: unreachable func: Router.GetPluginRoutes
internal/plugins/webhook_host.go:128:6: unreachable func: GetPluginWebhookHandler
internal/portalwebauthn/storage.go:140:28: unreachable func: CredentialStore.LookupCustomerByCredentialID
internal/portalwebauthn/storage.go:237:28: unreachable func: CredentialStore.CountCustomerCredentials
internal/repository/channel_repository.go:332:29: unreachable func: ChannelRepository.Exists
internal/repository/logbook_action_repository.go:238:35: unreachable func: LogbookActionRepository.GetNodesByActionID
internal/repository/logbook_action_repository.go:279:35: unreachable func: LogbookActionRepository.GetEdgesByActionID
internal/repository/logbook_action_repository.go:481:35: unreachable func: LogbookActionRepository.HasBucketPermission
internal/repository/todoist_sync_repository.go:184:33: unreachable func: TodoistSyncRepository.GetLinkByTodoistID
internal/restapi/v1/middleware/ratelimit.go:89:24: unreachable func: RateLimiter.Stop
internal/scheduler/cfv_cleanup_scheduler.go:688:31: unreachable func: CFVCleanupScheduler.RunOnceForTests
internal/server/server.go:1883:18: unreachable func: Server.BaseURL
internal/server/server.go:1897:18: unreachable func: Server.DB
internal/services/channel_service.go:263:26: unreachable func: ChannelService.Exists
internal/services/customer_organisation_permission_service.go:50:49: unreachable func: CustomerOrganisationPermissionService.HasManagers
internal/services/history_service.go:100:27: unreachable func: HistoryService.Close
internal/services/history_service.go:109:27: unreachable func: HistoryService.FlushForTesting
internal/services/history_service.go:115:6: unreachable func: ResetHistoryServiceForTesting
internal/services/invitation_service.go:198:29: unreachable func: InvitationService.CleanupExpiredInvitations
internal/services/item_crud_service.go:45:27: unreachable func: ItemCRUDService.GetByIDBasic
internal/services/item_crud_service.go:51:27: unreachable func: ItemCRUDService.Exists
internal/services/item_crud_service.go:283:27: unreachable func: ItemCRUDService.GetDescendants
internal/services/item_crud_service.go:289:27: unreachable func: ItemCRUDService.GetAncestors
internal/services/item_crud_service.go:295:27: unreachable func: ItemCRUDService.GetRootItems
internal/services/item_crud_service.go:547:27: unreachable func: ItemCRUDService.GetWithEffectiveProject
internal/services/item_link_orchestration.go:578:27: unreachable func: ItemLinkService.AccessibleWorkspaceKeys
internal/services/item_link_orchestration.go:660:27: unreachable func: ItemLinkService.EndpointVisible
internal/services/item_update_service.go:330:29: unreachable func: ItemUpdateService.RecordItemCreationHistory
internal/services/page_service.go:398:23: unreachable func: PageService.Archive
internal/services/page_service.go:670:23: unreachable func: PageService.ListTree
internal/services/page_service.go:727:23: unreachable func: PageService.ListDescendants
internal/services/permission_cache.go:53:6: unreachable func: DefaultPermissionCacheConfig
internal/services/portal_service.go:414:25: unreachable func: PortalService.ValidateRequestTypeBelongsToChannel
internal/services/run_service.go:103:21: unreachable func: RunnerFunc.Run
internal/services/run_service.go:300:26: unreachable func: PostRunHookFunc.AfterRun
internal/services/workspace_service.go:284:28: unreachable func: WorkspaceService.Exists
internal/services/actiontemplates/registry.go:89:6: unreachable func: LoadError
internal/tui/keymap.go:92:21: unreachable func: HelpKeyMap.ShortHelp
internal/tui/keymap.go:93:21: unreachable func: HelpKeyMap.FullHelp
internal/utils/dialer.go:115:6: unreachable func: ParseCIDRList
internal/validation/item_field_validator.go:749:6: unreachable func: ConvertCustomFieldValuesToJSON
internal/validation/item_field_validator.go:767:30: unreachable func: ItemFieldValidator.ValidateCreateRequest
plugin-src/react-demo/backend/main.go:15:6: unreachable func: Init
plugin-src/react-demo/backend/main.go:20:6: unreachable func: HandleRequest

These functions may be unused. Consider removing them if they're no longer needed.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.