Support surya-ocr 0.20 (transformers 5.x / Pillow 12 / huggingface-hub 1.x)

[gkriegspeedbay]

Context

marker 1.10.2 pins surya-ocr<0.18, transformers<5, and Pillow<11. Because surya 0.20
restructured its recognition/foundation API (recognition now runs through a GGUF VLM served
by SuryaInferenceManager), marker 1.10.2 can't import surya 0.20 as-is, and the caps
transitively block transformers 5.x / Pillow 12 for marker and anything built on it.

The surya side of this is already in flight: datalab-to/surya#492 (transformers 5
incompatibility) with fixes in datalab-to/surya#520 (transformers 5.x + huggingface-hub 1.x)
and datalab-to/surya#519 (Pillow 11/12).

What I have

I've got a working migration of marker to surya 0.20's API — adapting create_model_dict to
the shared SuryaInferenceManager, the layout/recognition/table-rec/equation call sites to
the new signatures, and the recognition consumption from the old per-char OCRResult to
0.20's per-block HTML (PageOCRResult). It's validated end-to-end: a real PDF converts to
non-empty markdown on transformers 5.x + Pillow 12 (both the provider-text and force_ocr
paths, with the llama.cpp VLM backend). A few 0.17-era config knobs (e.g. disable_ocr_math,
the various *_batch_size, keep_chars for OCR'd content) become inert under 0.20's API,
which I've documented in place.

Question

Would you welcome a PR for this, or is a surya-0.20 integration already in progress on your side?

[pchalasani]

Downstream data point in support of this, from langroid (we ship marker-pdf as an optional PDF-parsing extra).

The Pillow<11 cap holds across every published version — 1.6.0, 1.6.2, 1.7.0, 1.9.0, 1.10.2, and 2.0.0 all declare Pillow>=10.1.0,<11. So there's no version we can move to that escapes it.

Concretely, that pin currently keeps our resolution on Pillow 10.4.0 and accounts for 29 open Dependabot alerts we just had to dismiss as upstream-blocked:

• 17 on Pillow itself, patched in 12.1.1 / 12.2.0 / 12.3.0 — mostly heap OOB reads/writes and decompression-bomb DoS in image and font decoders (ImageFilter.RankFilter, Image.paste()/crop(), ImageCmsTransform, PSD/FITS/JPEG2000/GD/PCF/BDF paths)
• 12 more on packages held back through the same chain (weasyprint, pi-heif, markdownify)

The reason we care rather than just muting them: these are malicious-image-parsing bugs, and the whole point of the extra is parsing PDFs that users didn't author. Anyone installing langroid[doc-chat] gets Pillow 10.x today.

No pressure on timing — mainly wanted to add a concrete downstream cost to the case for landing the surya 0.20 migration, and to say the Pillow half specifically is what bites us. Happy to test a branch against our doc-parsing suite if that's useful.