Should I patch lopdf before updating Ollama and checking OpenAI cost data?

If a service accepts PDFs, lopdf 0.41.0 or earlier can abort on a roughly 21 KB crafted file. I'd patch that first, then handle the Windows-specific Ollama runner change, then reconcile OpenAI cost data that was delayed and later recovered.

Patch the lopdf parser before serving untrusted PDFs

The lopdf advisory was published October 16, 2026. It affects lopdf 0.41.0 and earlier, where the load entry points parse nested PDF arrays and dictionaries with unbounded recursion. The advisory says a deeply nested /X array can exhaust the call stack and abort the process with SIGABRT. The fixed version is 0.42.0, and the failure cannot be caught with catch_unwind.

Services that parse untrusted PDFs are affected. I'd check direct and transitive lockfiles for lopdf below 0.42.0 and move to 0.42.0 before accepting those files. If that version cannot be deployed yet, I'd stop the untrusted-PDF path until the parser is updated.

Stage Ollama v0.40.6 for Windows runner cleanup

The Ollama v0.40.6 release was published October 16, 2026. GitHub labels it a pre-release, and Ollama v0.40.6 includes a Windows change to prevent orphaned runners.

Windows deployments using that runner path are affected. I'd check the installed version and stage v0.40.6 there before wider rollout. If Windows runners are not involved, this release is lower priority for this decision.

Treat OpenAI cost lag as a reconciliation check

The OpenAI Compliance API incident began October 14, 2026, when organization cost data was delayed. OpenAI resolved it on October 16, 2026, and reported that impacted services had fully recovered. ChatGPT usage and API Platform requests were not affected, and other reporting channels remained available.

Teams relying on fresh Compliance API cost data should compare their last-seen timestamp, retry delayed reads, and reconcile the results. This status snapshot does not establish a current outage. A local mismatch still needs direct verification because individual availability can vary.

Priority checklist

1. Patch lopdf to 0.42.0, or stop accepting untrusted PDFs until you can.
2. Check Ollama versions on Windows and stage v0.40.6 where runner cleanup matters.
3. Reconcile OpenAI Compliance API cost data and retry reads that were delayed.

I put lopdf 0.42.0 first, kept Ollama v0.40.6 behind a Windows staging check, and treated OpenAI cost retries as reconciliation work.

Next up: Weekly roundup

Sunday's edition is next. 🔗 Explore the editions →