Polyfile

Latest version: v0.5.6

Safety actively analyzes 874069 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 1 of 4

0.5.6

Performance Improvements

- **Lazy loading throughout**: Startup time significantly reduced by deferring heavy imports until first use:
- PDF parser now lazily loads `pdfminer` only when parsing PDFs
- NES parser lazily loads PIL/Pillow only when rendering CHR graphics
- Kaitai parsers load on-demand per format instead of all at once
- **Caching optimizations**: `descendants()`, `mimetypes()`, and `all_extensions()` now return cached tuples instead of regenerating on each call

Bug Fixes

- **PDF parser robustness**: Fixed crashes on malformed PDF files:
- Empty lists now return safe zero-length wrappers instead of raising `ValueError`
- Malformed dictionary values are now logged and skipped rather than causing crashes
- **Python 3.14 compatibility**: Fixed forward reference handling for PEP 649 compliance

New Features

- **Magic test strength scoring**: Implemented libmagic-compatible test strength calculation for better match prioritization
- **UTF-16 string support**: Extended `lestring16`/`bestring16` to support byte-length modifiers
- **Endianness flip infrastructure**: Added foundation for flipped endianness matching (partial implementation)

Magic Definitions

- **Major update**: Synced with upstream libmagic definitions
- **New formats**: Added detection for bgcode, creativeassembly, keyman, lauterbach, R language, sf3, syd, tapebackup, uxn, and more
- **Expanded coverage**: Significant additions to DOS/Windows (+1300 lines), archive (+500 lines), console (+500 lines), images (+680 lines), and Linux (+500 lines) format detection

Breaking Changes

- **Python 3.9 no longer supported**: Minimum Python version is now 3.10
- **pdfminer.six version**: Now requires version 20251230 or newer

Dependencies

- Added `filelock>=3.20.3`
- Added `packaging>=21.0` (replacing deprecated `pkg_resources`)
- Updated `pdfminer.six` requirement to `>=20251230`

0.5.5

What's Changed
* to 3387: Lower bounds on dependency chardet and pdfminer.six by lucaspeng12138 in https://github.com/trailofbits/polyfile/pull/3422
* Do not use `sys.stderr.buffer` or log statuses that are not UTF-8 by ESultanik in https://github.com/trailofbits/polyfile/pull/31
* Bump actions/setup-python from 4 to 5 by dependabot in https://github.com/trailofbits/polyfile/pull/3418
* Bump actions/add-to-project from 0.5.0 to 0.6.0 by dependabot in https://github.com/trailofbits/polyfile/pull/3419

New Contributors
* lucaspeng12138 made their first contribution in https://github.com/trailofbits/polyfile/pull/3422

**Full Changelog**: https://github.com/trailofbits/polyfile/compare/v0.5.4...v0.5.5

0.5.4

This release switches to using `importlib` for loading resources. This fixes an issue if PolyFile is installed from an `sdist` into a discrete `venv` with resources stored separately from the code.

Documentation on extending PolyFile is also improved.

0.5.3

This release ends official support for Python 3.7, updates its use of [fickling](https://github.com/trailofbits/fickling) to a new API, and adds missing build dependencies to the source distribution.

0.5.2

Adds support for detecting Python pickle serializations.

0.5.1

Adds support for parsing HTTP/1.1 request headers.

Page 1 of 4

© 2026 Safety CLI Cybersecurity Inc. All Rights Reserved.