🎉 RPA Framework 33.0.2

Python 3.13 and 3.14 support

• rpaframework can now be installed on Python 3.13 and 3.14 (#1351, fixes #1348, contributed by @mikemikimike). The package previously declared <3.14 as its supported Python range, so pip install rpaframework on Python 3.14 fell back to an old release and failed while building its dependencies. The supported range is now >=3.10.

• The rpa-crypto command-line tool no longer uses argparse.FileType, which is deprecated in Python 3.14. Reading from standard input and writing to standard output work as before. Two details changed: the output file is now created only when the command succeeds, and a missing input file is reported as a command failure instead of an argument error.

Security fixes

• Dependency bumps (#1355):

  • PyJWT ≥2.14.0 — CRITICAL, decode() options-dict mutation enabling a silent claim-verification bypass (CVE-2026-103001); HIGH, ReDoS in is_pem_format (CVE-2026-102270); MEDIUM, uncaught RecursionError on deeply nested token headers (CVE-2026-102265), in rpaframework
  • pypdf ≥6.19.0 — HIGH, long runtimes with a large number of embedded files (CVE-2026-102999), in rpaframework-pdf
  • urllib3 ≥2.8.0 — HIGH, infinite loop in chunked deflate streaming (CVE-2026-97688), in rpaframework-aws
  • anyio ≥4.14.2 — CRITICAL, TLS certificate spoofing via IDNA 2003 host name encoding in TLSStream (CVE-2026-63374), and soupsieve ≥2.9.0 — HIGH, polynomial-time ReDoS in selector parsing (CVE-2026-86000), in the packages' development lock files

• rpaframework now requires rpaframework-pdf ≥11.0.3, so upgrading rpaframework on an existing installation also brings in the patched pypdf (#1359).

• Known limitation: rpaframework still installs oauthlib 3.x. The two current oauthlib advisories (CVE-2026-49265 and CVE-2026-49264) are fixed only in oauthlib 4.0.0, which tweepy — a dependency of RPA.Twitter — does not allow yet. Both advisories concern code that runs on an OAuth provider's side (the PKCE check at the token endpoint and the JSONP option of the revocation endpoint). The RPA Framework libraries use oauthlib only as a client, so that code is not reached, but a tool such as pip-audit will still report the package.

Fixes and improvements

• rpaframework-recognition: Fixed OCR text search failing with a bare AssertionError when Tesseract reported a blank word before the end of a line of text (#1354). In RPA.Desktop this made ocr: locators fail immediately, so Wait For Element gave up on the first attempt instead of retrying until its timeout:

• RPA.Email.ImapSmtp: Fixed LookupError: unknown encoding: None when reading a multipart message that has a text part without a charset, which made keywords such as List Messages fail (#1356, fixes #1086). Such parts are now decoded with the library's default encoding, and parts that are neither text nor attachments no longer end up in the message body.

• RPA.Excel.Files: Auto Size Columns now sets the column width from the longest text in each column (#1356, fixes #1104). Previously it only flagged the columns as auto sized, which left the widths unchanged:

The width is estimated from the length of the text, so cells with non-default fonts or number formats can still need a manual width.

Released packages

• package rpaframework 33.0.2
• package rpaframework-pdf 11.0.3
• package rpaframework-aws 8.0.2
• package rpaframework-recognition 8.0.3