Release Notes

Breaking: Python 3.11 or newer

• All packages now require Python 3.11 or newer (#1367). Python 3.10 reached end of life in October 2026, and the security fixes below for pillow and dnspython exist only in releases that require Python 3.11. Every package gets a major version bump for this reason, also the ones with no other change. On Python 3.10, pip install rpaframework keeps resolving to 33.0.2.

• rpaframework now requires rpaframework-core ≥14.0.0, rpaframework-pdf ≥12.0.0 and rpaframework-windows ≥12.0.0, and every package that depends on rpaframework-core requires ≥14.0.0, so that upgrading any of them on an existing installation also brings in the patched pillow (RPA.PDF and RPA.Windows get pillow through rpaframework-core).

New: RPA.Decision

The new package rpaframework-decision (#1366) adds the RPA.Decision library: typed, calibrated decisions from decision models such as TypeSafe's hosted Jev and the open-weight Laya. Instead of parsing free text from a chat model, a decision model answers a fixed question with a choice, a confidence and the probability of every option, which makes thresholds and human hand-off straightforward. The same keywords are available in Robot Framework.

Keywords: Decide, Decide Or Escalate, Check (yes/no with a probability), Score (position on an ordered rubric), Rank Options, Ask Questions (several questions about one state in a single call), Classify Items and Require Confidence. Every decision is recorded in an audit log (Get, Save and Clear Decision Audit Log). Backends: jev (hosted), laya (local, via the laya extra), replay (a recorded log, for dry runs) and any Python callable, which also makes the library easy to test offline.

Security fixes

• Dependency bumps (#1367):

  • pillow ≥13.0.0 — 42 advisories, 5 of them CRITICAL (heap buffer overflows in JPEG, FlashPix and TIFF decoding, stale native storage reuse in multi-frame loaders, argument injection in the Ghostscript call), in rpaframework-core, rpaframework-recognition and rpaframework
  • certifi ≥2026.10.18 — CRITICAL, bundled emSign root CAs whose intermediate CA keys were compromised, in the lock files of all packages
  • pypdf ≥6.21.4 — HIGH, infinite loops and unbounded memory use on crafted PDFs (CVE-2026-115572, CVE-2026-115580, CVE-2026-115585, CVE-2026-119203 to CVE-2026-119209; further MEDIUM/LOW advisories), in rpaframework-pdf
  • fpdf2 ≥2.8.8 — MEDIUM, implicit loading of external URLs and local image paths from attacker-controlled content (CVE-2026-114609) and exponential SVG <use> expansion (CVE-2026-114610), in rpaframework-pdf
  • pyasn1 ≥0.6.5 — HIGH, quadratic-time denial of service in BER/CER/DER decoding (CVE-2026-119194 to CVE-2026-119197), in rpaframework-google
  • dnspython ≥2.9.0 — HIGH, excessive CPU use in dns.name.from_wire_parser() (CVE-2026-114605), in rpaframework
  • msgpack ≥1.2.3 — HIGH, unbounded memory leak in the C extension (CVE-2026-114613), in rpaframework-assistant
  • setuptools ≥84.1.0 — LOW, Windows path escape during legacy wheel installation, in rpaframework-sema4ai

• Known limitation: rpaframework still allows oauthlib 3.x because tweepy, a dependency of RPA.Twitter, caps it below 4. The advisories CVE-2026-49272 and CVE-2026-118669 concern the device-flow and token-grant endpoints of an OAuth server; the libraries use oauthlib only as a client. Which oauthlib you get depends on the installer: pip picks tweepy 4.17 with oauthlib 3.3, uv picks oauthlib 4.0.1 with the older tweepy 4.5, and that older tweepy cannot be imported on Python 3.13 or 3.14 (No module named 'imghdr'), so RPA.Twitter fails to import in that combination. A follow-up release will pin tweepy ≥4.14.

Fixes and improvements

• RPA.Windows: New keyword Control Parent Window, the counterpart of Control Child Window (#1368, fixes #1362). It walks up the element tree from an element found by a locator and makes the reached ancestor the active window, either a given number of levels up or up to the first ancestor of a control_type such as WindowControl or PaneControl. Locators after it resolve inside that ancestor, exactly as with Control Child Window:

• RPA.Robocorp.Process: List Process Work Items now retrieves every result page, so items beyond the first page are returned and included when filtering by state (#1361, fixes #1095).

• Releases are now built and published to PyPI by GitHub Actions from version tags (#1370), with the GitHub release notes generated from the same release-notes file. The daily install test and package workflows now also run when the shared development tooling changes (#1365).

Released packages

• package rpaframework 34.0.0
• package rpaframework-core 14.0.0
• package rpaframework-pdf 12.0.0
• package rpaframework-recognition 9.0.0
• package rpaframework-windows 12.0.0
• package rpaframework-decision 1.0.0 (new)
• package rpaframework-assistant 7.0.0
• package rpaframework-aws 9.0.0
• package rpaframework-google 13.0.0
• package rpaframework-hubspot 5.0.0
• package rpaframework-openai 6.0.0
• package rpaframework-sema4ai 2.0.0

The last six carry no code change since their previous release; the new major version only raises the Python floor and, for the ones that depend on it, the rpaframework-core floor.

Python 3.13 and 3.14 support

• rpaframework can now be installed on Python 3.13 and 3.14 (#1351, fixes #1348, contributed by @mikemikimike). The package previously declared <3.14 as its supported Python range, so pip install rpaframework on Python 3.14 fell back to an old release and failed while building its dependencies. The supported range is now >=3.10.

• The rpa-crypto command-line tool no longer uses argparse.FileType, which is deprecated in Python 3.14. Reading from standard input and writing to standard output work as before. Two details changed: the output file is now created only when the command succeeds, and a missing input file is reported as a command failure instead of an argument error.

Security fixes

• Dependency bumps (#1355):

  • PyJWT ≥2.14.0 — CRITICAL, decode() options-dict mutation enabling a silent claim-verification bypass (CVE-2026-103001); HIGH, ReDoS in is_pem_format (CVE-2026-102270); MEDIUM, uncaught RecursionError on deeply nested token headers (CVE-2026-102265), in rpaframework
  • pypdf ≥6.19.0 — HIGH, long runtimes with a large number of embedded files (CVE-2026-102999), in rpaframework-pdf
  • urllib3 ≥2.8.0 — HIGH, infinite loop in chunked deflate streaming (CVE-2026-97688), in rpaframework-aws
  • anyio ≥4.14.2 — CRITICAL, TLS certificate spoofing via IDNA 2003 host name encoding in TLSStream (CVE-2026-63374), and soupsieve ≥2.9.0 — HIGH, polynomial-time ReDoS in selector parsing (CVE-2026-86000), in the packages' development lock files

• rpaframework now requires rpaframework-pdf ≥11.0.3, so upgrading rpaframework on an existing installation also brings in the patched pypdf (#1359).

• Known limitation: rpaframework still installs oauthlib 3.x. The two current oauthlib advisories (CVE-2026-49265 and CVE-2026-49264) are fixed only in oauthlib 4.0.0, which tweepy — a dependency of RPA.Twitter — does not allow yet. Both advisories concern code that runs on an OAuth provider's side (the PKCE check at the token endpoint and the JSONP option of the revocation endpoint). The RPA Framework libraries use oauthlib only as a client, so that code is not reached, but a tool such as pip-audit will still report the package.

Fixes and improvements

• rpaframework-recognition: Fixed OCR text search failing with a bare AssertionError when Tesseract reported a blank word before the end of a line of text (#1354). In RPA.Desktop this made ocr: locators fail immediately, so Wait For Element gave up on the first attempt instead of retrying until its timeout:

• RPA.Email.ImapSmtp: Fixed LookupError: unknown encoding: None when reading a multipart message that has a text part without a charset, which made keywords such as List Messages fail (#1356, fixes #1086). Such parts are now decoded with the library's default encoding, and parts that are neither text nor attachments no longer end up in the message body.

• RPA.Excel.Files: Auto Size Columns now sets the column width from the longest text in each column (#1356, fixes #1104). Previously it only flagged the columns as auto sized, which left the widths unchanged:

The width is estimated from the length of the text, so cells with non-default fonts or number formats can still need a manual width.

Released packages

• package rpaframework 33.0.2
• package rpaframework-pdf 11.0.3
• package rpaframework-aws 8.0.2
• package rpaframework-recognition 8.0.3

Breaking changes

• RPA.Desktop.Windows has been removed (#1343). The pywinauto-based library has emitted a deprecation warning pointing at RPA.Windows for a long time and is no longer maintained. Use RPA.Windows for all Windows UI automation going forward.

This is not a drop-in rename. RPA.Windows is built on UIAutomation rather than pywinauto, so keyword names, arguments and locator syntax differ — expect to rewrite the affected steps rather than just change the import:

The two examples/windows-* scripts that depended exclusively on the removed pywinauto API were removed along with the library.

Security fixes

• RPA.Archive: Fixed a Zip Slip path traversal vulnerability (CWE-22) in Extract Archive (#1341, fixes #1339, #1340). Archive members containing path traversal sequences such as ../../evil.py could previously be written outside the requested destination directory. Extraction now validates that every member resolves inside the destination first and raises ValueError otherwise. Both the ZIP and TAR code paths are covered, for whole-archive and selected-members extraction alike.

• Dependency bumps across the affected packages:

  • soupsieve ≥2.8.4 — HIGH, memory exhaustion via large comma-separated selector lists (CVE-2026-49476) (#1342)
  • pillow ≥12.3.0 — HIGH, heap out-of-bounds write in ImageCmsTransform.apply() (CVE-2026-59205) and a decompression-bomb DoS in PdfParser.PdfStream.decode() (CVE-2026-59200)
  • cryptography ≥50.0.0 — HIGH, Bleichenbacher oracle in PKCS#7 EnvelopedData decryption (CVE-2026-69247)
  • pypdf ≥6.15.0 — MEDIUM, excessive memory use for large /ToUnicode streams (CVE-2026-71870), in rpaframework-pdf
  • pyasn1 ≥0.6.4 — HIGH, BER/CER/DER decoder DoS via unbounded long-form tag IDs (CVE-2026-59884), and httplib2 ≥0.32.0 — HIGH, decompression-bomb DoS via unbounded gzip/deflate handling (CVE-2026-59939), both in rpaframework-google
  • setuptools ≥83.0.0 — MEDIUM, MANIFEST.in exclusion bypass via Unicode normalization collision (CVE-2026-59890), in rpaframework-sema4ai

  The pillow and cryptography floors were raised across all packages (#1350, #1338).

Fixes and improvements

• rpaframework-core: Fixed the Windows locator parser silently mis-tokenizing a strategy when the locator value carried a stray locator= prefix or an unmatched quote character — for example producing a bogus locator='executable strategy instead of recognizing executable:. A clearer warning is now surfaced when this happens (#1343, fixes #1323).

• rpaframework-core: executable: locators are now matched case-insensitively. Windows file names are case-insensitive but the comparison was not, so executable:notepad.exe could not find a process that Windows lists as Notepad.exe — as it does on Windows 11. handle: matching is numeric and is unchanged.

• RPA.Desktop: Highlight Elements now returns the list of matched element regions instead of None, exposing the coordinates that were already being computed internally (#1343, fixes #1324):

• rpaframework now requires rpaframework-core ≥13.0.2, so a fresh install cannot resolve a core version that predates the Windows locator fixes RPA.Windows relies on.

Released packages

• package rpaframework 33.0.1
• package rpaframework-core 13.0.3
• package rpaframework-pdf 11.0.2
• package rpaframework-recognition 8.0.2
• package rpaframework-google 12.0.1
• package rpaframework-sema4ai 1.1.1

Security releases regarding dependency package cryptography. Other security updates have been included as well and because of that multiple package releases have been done.

• package rpaframework 28.6.3

• package rpaframework-google 9.0.2

• package rpaframework-hubspot 1.0.2

• package rpaframework-openai 1.3.3

• package rpaframework-pdf 7.3.3

• package rpaframework-recognition 5.2.5

• package rpaframework-windows 7.5.2

Also as mentioned on 03 Apr 2024, the dialogs package has been now removed from repository.

• Update rpaframework-core to version 11.3.3 including webdriver-manager upgrade to version 4.0.2. This should fix the issue with downloading the latest Chrome driver version.

• (in rpaframework 28.6.1) Library RPA.Robocorp.Vault (#1199): Proper error message if caused by SSL truststore patching bug.

Couple of reminders when using Selenium browsers and handling webdrivers:

• the matching webdriver can be always placed into robot root folder and that will be used if it is compatible with the selected browser (can be downloaded from here). BUT remember that open_available_browser method will automatically try to download and use correct webdriver

• the Chrome's new search engine selection startup popup can be bypassed by giving argument for the Chrome (examples in Python and Robot Framework syntax)

Python

Robot Framework

• Library RPA.Browser.Selenium (#1191):

  • Fix/workaround for Chromium browser all instances not closing after the run. Which affects methods open_available_browser and open_chrome_browser. The default behavior can be changed with new parameter sandbox=True.

• Library RPA.Excel.Application (#1191):

  • Enhance find with new parameters search_type, start_after, and exact

  • Allow open_workbook to load workbooks from URLs

  • Improve all RPA.*.Application.quit_application methods to perform garbage collection before calling app.quit() to avoid problem with unreleased COM objects

  • Add rgb_to_excel_color(red, green, blue) method to get a suitable color value for Range.Font.Color and Range.Interior.Color

• Library RPA.Word.Application (#1159):

  • Add keyword Select current paragraph for selecting the current paragraph.

  • Add keyword Select paragraphs for selecting previous/next paragraphs.

  • Add keyword Copy selection to clipboard for copying the selection to the clipboard.

• Library RPA.Excel.Application (#1158):

  • Add keyword Remove hidden columns and rows from given range.

  • Add keyword Merge range for merging cells in a range.

  • Add keyword Unmerge range for unmerging cells in a range.

• Library RPA.Cloud.Google (#1157, rpaframework-google 9.0.0):

  • Fix problem with method intellisense in Python development environments.

  • Add keyword Detect Tables for detecting table-like structures in spreadsheet’s sheets.

  • Add keyword Get Sheet Formulas for getting formulas from a sheet.

  • Add keyword To A1 notation for converting column number to A1 notation.

• Library RPA.Excel.Application (#1152): Add keyword Write data to range for writing data to range(s) in a spreadsheet. This will be significantly faster than using Write to cells keyword for large data sets.

• Library RPA.Word.Application (#1152):

• Add keywords starting with Move_ for positioning cursor position in a document.

• Add keyword Find text for finding text in a document.

• Add keyword Paste from clipboard for pasting text from clipboard to a current cursor position.

• Add keyword Get current line to get text from the current line.

• Add keyword Get number of lines to get number of lines in a current document.

• Refactor keyword Write text to take cursor positioning into consideration.

TL;DR: We are transitioning from Robot Framework and moving all our focus to Python. Existing bots developed in Robot Framework will continue to operate as usual. We'll provide critical updates related to Robot Framework-specific issues until Feb 15th 2025, according to our one-year LTS plan for Enterprise customers. All our new developments will be directed towards Python's dynamic and expansive ecosystem. We recommend our users develop all new automations on Python.

Robocorp platform will be Python-only

Advancements in Generative AI and LLMs have revolutionised how we approach problem-solving and automation. We realized the potential of Python as a language for automation and AI early. Last year, we announced that we invested heavily in Python on our platform, ensuring that, at minimum, everything that was possible using Robot Framework would be available for Python developers. We have reached that date now.

👉 Today marks a significant milestone in our platform's evolution. As part of this transition, we're announcing discontinuing support for Robot Framework on the Robocorp platform. While we will continue to offer bug fixes and security updates for Robot Framework related features until February 15th, 2025, official support will cease thereafter. It's crucial to understand that automations developed with Robot Framework will remain fully functional within the Robocorp ecosystem. 👈

Robot Framework has served us well, providing a solid foundation for automation - all based on Python. However, by focusing on Python only, we allow our customers to enjoy scale and speed that only comes with an ecosystem as vibrant as Python.

What will happen in detail?

There is no immediate impact on existing bots: Automations built on Robot Framework will continue functioning as usual, ensuring your ongoing operations are not disrupted.

We announce a deprecation of Robot Framework on the Robocorp platform on Feb 15th 2024, with one-year long term support guaranteed for Enterprise customers (until Feb 15th 2025). The old Robot Framework bots will continue working even after this; we simply do not issue fixes to Robot Framework-related tooling anymore.

Our developer tooling going forward only supports Python. However, we will issue CVE fixes for the following year.

• Language Server Protocol (LSP) for Robot Framework extension for VS Code remains open-source and available, but we cease to support new features or new versions of Robot Framework.

• Robocorp Code Extension will support only Python code generation in the inspectors/recorders and its other features. The same will apply to the ReMark developer AI assistant.

• Our documentation site will be focused on Python tutorials and examples. However, we will keep a snapshot of current Robot Framework examples and docs until 2025.

We will restructure our automation libraries over time to focus on Python and to remove the dependency on Robot Framework that exists today in RPA Framework. This work was already started mid 2023 with the introduction of robocorp libraries. See details of all automation libraries here.

• RPA Framework (our open-source project with the automation keywords many of our users have gotten familiar with) remains available and supports RPA use-cases (like Java apps, Excel, Outlook, PDFs and much more). However, examples and documentation are added only in Python going forward.

• Some RPA Framework libraries will be deprecated as there are better ways to accomplish the same functionality directly with well-maintained Python libraries. This will be communicated later.

Our recommendation for action

While there are no immediate consequences to currently running Robot Framework bots, we recommend our customers take the following action:

• Start developing new automation workflows in Python. All three certification courses are available now in Python and are a great starting point for developers.

• Review the “Switch to Python” page for detailed instructions on what is new, and decide if your organisation will implement any existing Robot Framework automations in Python. We do not require this, but in some cases, it will help with maintenance.

Relevant links

• Read the full blog post with more details

• Switching from Robot Framework to Python page

• Python automation certification courses

• ReMark code generation assistant

• Snapshot of Robot Framework-related documentation

• Library RPA.Excel.Application (#1149):

• Add new keyword Create Pivot Field for creating pivot fields for the pivot table.

• Add new keyword Create Pivot Table for creating pivot tables in a spreadsheet.

• Add new keyword Create Table for creating a table in a spreadsheet.

• Add new keyword Find for finding a value in a range.

• Add new keyword Get Pivot Tables for getting pivot tables in a spreadsheet.

• Add new keyword Get Range for getting a range in a spreadsheet.

• Add new keyword List Tables for listing tables in a spreadsheet.

• For all RPA.*.Application libraries (#1149): Add new utility keyword for Robot Framework syntax Set Object Property

• Security dependency fix given the bump of cryptography package to version 42.0.2. (#1149)

Read pull requests linked above for more information.

17 Jan 2024

• Library RPA.Cloud.Google (#1145, rpaframework-google 8.2.0):
• All init_ keywords will return initialized service instance.
• Library level documentation refactoring. Authentication related examples are now in their own markdown file.

See Github pull request for more details on the release.

• Library RPA.Outlook.Application (#1144): Add reply_to and check_names parameters for Send Email.

Check Github PR for more details on these parameters.

• Library RPA.Browser.Selenium (#1139): Keyword Open Available Browser won’t anymore try to initialize webdrivers for browsers that are not installed in the system.
• Library RPA.Crypto (#1140): Fix AES256 return types for keywords Generate Key and Decrypt String.
• Library RPA.Hubspot (#1106): Extract the RPA.Hubspot library out of the main package and into its own package rpaframework-hubspot. This is a breaking change, please update your conda.yaml accordingly.

⚠️ Warning

This is a breaking change if you are using the RPA.Hubspot library within your task packages, please add the rpaframework-hubspot package into your conda.yaml to continue using the library.

• Update selenium package to the version 4.15.2.
• Library RPA.Crypto (#1128): Add AES256 encryption method support.
• Library RPA.Windows (#1134; rpaframework-windows 7.5.0): Add keywords Enable Process Listing and Disable Process Listing to enable/disable the listing of processes in the List Windows keyword.

• Library RPA.Robocorp.Vault (#1129): Improve error message when trying to connect to Control Room Vault without valid connection details.
• Library RPA.SAP (#1130): Add keywords for pressing F1 or F4 on textfield and gridview elements. Thanks to Enrico Franzelli for the contribution!
• Relax importlib-metadata version requirement to allow 4.13.0 and above.

• Library RPA.Outlook.Application (#1127): Fix how keyword Move Emails works. Read more from the pull request.

• Library RPA.Robocorp.Storage (robocorp-storage 1.0.2): Fix keyword List Assets for listing and returning correctly all the assets available in the cloud.
• Library RPA.Assistant (#1122; rpaframework-assistant 3.0.2): Show files selected with Add File Input to make it easier for users to know it has been used. Also shows a warning if the image path for Add Image is not valid or if the file does not exist.

🗒️ Note

This version is compatible with robocorp 1.2.1.

• Library RPA.Browser.Selenium (#1123; rpaframework-core 11.2.3): Fix “There is no such driver by url” error with Chrome/Chromium versions above 114 attempting a chromedriver version resolution.
• Library RPA.Robocorp.WorkItems: Fix dirty items logging and documentation nits.

• Add reply_to parameter for Send Message keyword for RPA.Email.Exchange and RPA.Email.ImapSmtp libraries.

• Application classes from RPA.*.Application libraries can be further inherited and extended without the need of adding a mandatory class-level docstring.
• Library RPA.Robocorp.WorkItems won’t get easily affected anymore by any issue within the RPA.Email.ImapSmtp library.
• Keyword Email To Document raises appropriately when the input value is of an unexpected type.
• Takes into use the latest robocorp-storage 1.0.1, adding various fixes into the RPA.Robocorp.Storage library.