How uv add silently downgraded my pypdf security patch (and how I fixed it)

I merged two PRs to fix my dependency alerts on GitHub. Both had empty diffs. GitHub kept showing 11 open Dependabot alerts (10 high, 1 moderate). It was right, and I was wrong. When I dug into my terminal, I saw this: text pypdf==6.21.4 pypdf==6.21.1 My security patch was silently downgraded. Here…