chore: dependency updates (presidio-analyzer, spacy, cryptography) and changelog policy fix

CHANGELOG.md

@@ -7,9 +7,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-## [2.1.0-beta.2] - 2026-07-23
-
-First public beta of the 2.1.0 line, focused on advanced privacy export, full OCR support for scanned PDFs, and new Lite/Full release variants.
+Work in progress toward the 2.1.0 line, focused on advanced privacy export, full OCR support for scanned PDFs, and new Lite/Full release variants. Beta iterations are validated via prerelease tags but are not listed individually here; only the final stable release will get its own heading below.
 
 ### ✨ Added
 
@@ -25,12 +23,14 @@ First public beta of the 2.1.0 line, focused on advanced privacy export, full OC
 - **Separated Re-identification Data**: Restore maps are never embedded into exported PDFs and are encrypted with Fernet using a PBKDF2-HMAC-SHA256 derived key.
 - **Safer Export Metadata Handling**: Privacy export now clears document metadata and removes common residual structures such as widgets and overlapping links in redacted areas.
 - **Safer UI Logging**: Log messages shown in the UI are HTML-escaped before rendering.
+- **cryptography 49.0.0**: Updated from 45.0.7, resolving 4 known advisories (2 high, 1 medium, 1 low) including a vulnerable bundled OpenSSL and a missing subgroup validation for SECT curves.
 
 ### 🔧 Internals
 
 - **Expanded Test Coverage**: Added dedicated tests for privacy primitives, build variant behavior, OCR helper resolution, and prerelease version handling.
 - **Documentation Refresh**: Updated README, ARCHITECTURE, USER_GUIDE, SECURITY, TROUBLESHOOTING, CONTRIBUTING, DEVELOPMENT, and added `OCR_SETUP.md` for the new privacy and OCR workflows.
 - **Release Automation Updates**: GitHub workflows now build Lite/Full variants across supported operating systems and support the beta-to-stable promotion flow.
+- **presidio-analyzer 2.2.364 / spacy 3.8.14**: presidio-analyzer now only excludes spacy 3.8.14 on Python >= 3.14, so spacy 3.8.14 (model-download bugfix) can be used on our Python 3.13 target.
 
 ## [2.0.7] - 2026-07-21
 

DEVELOPMENT.md

@@ -135,9 +135,9 @@ NullifyPDF/
 | --------------------- | ------- | ---------------------------- |
 | **PySide6**           | 6.11.1  | GUI framework (Qt6 bindings) |
 | **PyMuPDF**           | 1.28.0  | PDF manipulation and OCR bridge |
-| **presidio-analyzer** | 2.2.363 | PII detection                |
-| **spaCy**             | 3.8.13  | NLP for entity recognition   |
-| **cryptography**      | 45.0.7  | Encrypted restore maps       |
+| **presidio-analyzer** | 2.2.364 | PII detection                |
+| **spaCy**             | 3.8.14  | NLP for entity recognition   |
+| **cryptography**      | 49.0.0  | Encrypted restore maps       |
 | **pytest**            | 9.1.1   | Testing framework            |
 
 ### Language Models (Auto-Downloaded)
@@ -560,5 +560,5 @@ Ready to contribute? See [CONTRIBUTING.md](./CONTRIBUTING.md) for:
 
 ---
 
-*Last updated: 2026-07-23*  
+*Last updated: 2026-07-29*  
 *← [Troubleshooting](./TROUBLESHOOTING.md) | [Back to README →](./README.md)*

requirements.txt

@@ -9,9 +9,9 @@ PySide6==6.11.1
 PyMuPDF==1.28.0
 
 # NLP & Security Analysis
-presidio-analyzer==2.2.363
-spacy==3.8.13  # Mantenuto in 3.8.13 per compatibilità con presidio-analyzer 2.2.363
-cryptography==45.0.7
+presidio-analyzer==2.2.364
+spacy==3.8.14  # presidio-analyzer 2.2.364 excludes spacy==3.8.14 only for python_version>=3.14; safe on our Python 3.13 target
+cryptography==49.0.0
 # spaCy language models (pinned to exact versions for reproducibility)
 # IMPORTANT: model minor version MUST match the spaCy core minor version
 # (spaCy 3.8.x <-> models 3.8.x). The models declare spacy>=3.8.0,<3.9.0.