November 1, 2026 · RPA Framework

🎉 RPA Framework 34.0.0 and RPA.Decision

Breaking: Python 3.11 or newer

All packages now require Python 3.11 or newer (#1367). Python 3.10 reached end of life in October 2026, and the security fixes below for pillow and dnspython exist only in releases that require Python 3.11. Every package gets a major version bump for this reason, also the ones with no other change. On Python 3.10, pip install rpaframework keeps resolving to 33.0.2.
rpaframework now requires rpaframework-core ≥14.0.0, rpaframework-pdf ≥12.0.0 and rpaframework-windows ≥12.0.0, and every package that depends on rpaframework-core requires ≥14.0.0, so that upgrading any of them on an existing installation also brings in the patched pillow (RPA.PDF and RPA.Windows get pillow through rpaframework-core).

New: RPA.Decision

The new package rpaframework-decision (#1366) adds the RPA.Decision library: typed, calibrated decisions from decision models such as TypeSafe's hosted Jev and the open-weight Laya. Instead of parsing free text from a chat model, a decision model answers a fixed question with a choice, a confidence and the probability of every option, which makes thresholds and human hand-off straightforward. The same keywords are available in Robot Framework.

from RPA.Decision import Decision decision = Decision(threshold=0.8) decision.set_decision_backend("jev") # reads TYPESAFE_API_KEY from the environment kind = decision.decide( document_text, question="What kind of document is this?", options="invoice,reminder,other", ) print(kind.choice, kind.confidence, kind.probabilities) # Raises LowConfidenceError below the threshold, so a human can take over kind = decision.decide_or_escalate( document_text, question="What kind of document is this?", options="invoice,reminder,other", )

Keywords: Decide, Decide Or Escalate, Check (yes/no with a probability), Score (position on an ordered rubric), Rank Options, Ask Questions (several questions about one state in a single call), Classify Items and Require Confidence. Every decision is recorded in an audit log (Get, Save and Clear Decision Audit Log). Backends: jev (hosted), laya (local, via the laya extra), replay (a recorded log, for dry runs) and any Python callable, which also makes the library easy to test offline.

pip install rpaframework-decision

Security fixes

Dependency bumps (#1367):
- pillow ≥13.0.0 — 42 advisories, 5 of them CRITICAL (heap buffer overflows in JPEG, FlashPix and TIFF decoding, stale native storage reuse in multi-frame loaders, argument injection in the Ghostscript call), in rpaframework-core, rpaframework-recognition and rpaframework
- certifi ≥2026.10.18 — CRITICAL, bundled emSign root CAs whose intermediate CA keys were compromised, in the lock files of all packages
- pypdf ≥6.21.4 — HIGH, infinite loops and unbounded memory use on crafted PDFs (CVE-2026-115572, CVE-2026-115580, CVE-2026-115585, CVE-2026-119203 to CVE-2026-119209; further MEDIUM/LOW advisories), in rpaframework-pdf
- fpdf2 ≥2.8.8 — MEDIUM, implicit loading of external URLs and local image paths from attacker-controlled content (CVE-2026-114609) and exponential SVG <use> expansion (CVE-2026-114610), in rpaframework-pdf
- pyasn1 ≥0.6.5 — HIGH, quadratic-time denial of service in BER/CER/DER decoding (CVE-2026-119194 to CVE-2026-119197), in rpaframework-google
- dnspython ≥2.9.0 — HIGH, excessive CPU use in dns.name.from_wire_parser() (CVE-2026-114605), in rpaframework
- msgpack ≥1.2.3 — HIGH, unbounded memory leak in the C extension (CVE-2026-114613), in rpaframework-assistant
- setuptools ≥84.1.0 — LOW, Windows path escape during legacy wheel installation, in rpaframework-sema4ai
Known limitation: rpaframework still allows oauthlib 3.x because tweepy, a dependency of RPA.Twitter, caps it below 4. The advisories CVE-2026-49272 and CVE-2026-118669 concern the device-flow and token-grant endpoints of an OAuth server; the libraries use oauthlib only as a client. Which oauthlib you get depends on the installer: pip picks tweepy 4.17 with oauthlib 3.3, uv picks oauthlib 4.0.1 with the older tweepy 4.5, and that older tweepy cannot be imported on Python 3.13 or 3.14 (No module named 'imghdr'), so RPA.Twitter fails to import in that combination. A follow-up release will pin tweepy ≥4.14.

Fixes and improvements

RPA.Windows: New keyword Control Parent Window, the counterpart of Control Child Window (#1368, fixes #1362). It walks up the element tree from an element found by a locator and makes the reached ancestor the active window, either a given number of levels up or up to the first ancestor of a control_type such as WindowControl or PaneControl. Locators after it resolve inside that ancestor, exactly as with Control Child Window:

from RPA.Windows import Windows windows = Windows() windows.control_window("Calculator") # From the "5" button up to the first ancestor that is a window windows.control_parent_window("id:num5Button", control_type="WindowControl") windows.click("id:clearButton")

RPA.Robocorp.Process: List Process Work Items now retrieves every result page, so items beyond the first page are returned and included when filtering by state (#1361, fixes #1095).
Releases are now built and published to PyPI by GitHub Actions from version tags (#1370), with the GitHub release notes generated from the same release-notes file. The daily install test and package workflows now also run when the shared development tooling changes (#1365).

Released packages

package rpaframework 34.0.0
package rpaframework-core 14.0.0
package rpaframework-pdf 12.0.0
package rpaframework-recognition 9.0.0
package rpaframework-windows 12.0.0
package rpaframework-decision 1.0.0 (new)
package rpaframework-assistant 7.0.0
package rpaframework-aws 9.0.0
package rpaframework-google 13.0.0
package rpaframework-hubspot 5.0.0
package rpaframework-openai 6.0.0
package rpaframework-sema4ai 2.0.0

The last six carry no code change since their previous release; the new major version only raises the Python floor and, for the ones that depend on it, the rpaframework-core floor.