docling-project/docling-core

Review signals: 50 known vulnerability. 2 static matches retained as context.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 50 findings.

2 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Docling Core provides document profiling statistics: Real input produced the expected result: Document: 2408.09869v3 Pages: 9

  Source: The Profiling API enables extraction of comprehensive statistics from DoclingDocument objects,

  Input: examples/2408.09869v3.json

  Expected: Document: 2408.09869v3, 9 pages

  Command: uv run python examples/document_profiling.py

  Observed: Document: 2408.09869v3 Pages: 9 Tables: 5 Pictures: 13 Text items: 996 - Section headers: 30 - List items: 22 - Code blocks: 2 - Formulas: 0 Total items: 1014 Average items per page: 112.67 Origin MIME type: application/pdf Pictures requiring OCR: 3 JSON export (first 500 chars): { "name": "2408.09869v3", "num_pages": 9, "num_tables": 5, "num_pictures": 13, "num_texts": 996, "num_key_value_items": 0, "num_form_items": 0, "num_section_headers": 30, "num_list_items": 22, "num_code_items": 2, "num_formulas": 0, "origin_mimetype": "application/pdf", "num_pictur

Examples

• Profile a document and print statistics: command completed successfully

  Source: README.md / Profiling

  Input: examples/2408.09869v3.json

  Expected: Document stats including page count

  Command: uv run python examples/document_profiling.py

  Observed: ================== Example 4: Exporting Statistics Report ================================================================================ Directory not found: test/data/doc ================================================================================ Example 5: Analyzing Document Characteristics ================================================================================ Directory not found: test/data/doc ================================================================================ Examples completed! ================================================================================

Local or hosted: local

Profile bundled DoclingDocument JSON

pwd; git status --short --branch; git rev-parse HEAD; sed -n '1,240p' README.md; python3 --version
git init; git remote add origin https://github.com/docling-project/docling-core; git fetch --depth 1 origin 55829160b6eb17b6796fb6649e9b43bcce94cb01; git reset --mixed FETCH_HEAD; python3 -m pip --version; command -v uv || true; rg -n "uv run|examples/|DoclingDocument\(" README.md examples | head -60
uv --version; uv sync --all-extras
uv run pytest -s test
ls -la; ls examples; sed -n '1,160p' examples/document_profiling.py; find . -maxdepth 2 -type f | head -30
uv run python examples/document_profiling.py
mkdir -p .coldpass; cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Docling Core provides document profiling statistics","source":"The Profiling API enables extraction of comprehensive statistics from DoclingDocument objects,","input":"examples/2408.09869v3.json","expected":"Document: 2408.09869v3, 9 pages","probe_kind":"cli","argv":["uv","run","python","examples/document_profiling.py"],"expected_text":"Document: 2408.09869v3\nPages: 9","cwd":"<guest-path>"}]
EOF
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["uv","run","python","examples/document_profiling.py"],"cwd":"<guest-path>","expected_text":"Document: 2408.09869v3\nPages: 9"}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Profile a document and print statistics","source":"README.md / Profiling","input":"examples/2408.09869v3.json","expected":"Document stats including page count","argv":["uv","run","python","examples/document_profiling.py"],"cwd":"<guest-path>","expected_text":"Pages: 9"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README and examples; profiling is a direct document operation and no scheduling, loop trigger, webhook, or cycle mechanism is documented.","checks":[]}
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Profile bundled DoclingDocument JSON","operation_scope":"README profiling example; Python 3.12.3 and uv installed with documented development setup","steps":["uv sync --all-extras","uv run python examples/document_profiling.py"],"deviations":["README's documented uv run pytest -s test exited 4 because the pinned checkout has no test directory; profiling example ran and reported 9 pages, 5 tables, 13 pictures, and 996 text items. Collection portions noted absent test/data/doc."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay