Bump kreuzberg from 4.10.2 to 4.10.3

[dependabot]

Bumps kreuzberg from 4.10.2 to 4.10.3.

Release notes

Sourced from kreuzberg's releases.

v4.10.3

What's Changed

• fix(chart): harden defaults and add Artifact Hub README by @​Goldziher in kreuzberg-dev/kreuzberg-lts#1
• chore(ci): remove dead self-hosted runner config by @​Goldziher in kreuzberg-dev/kreuzberg-lts#2
• fix: read legacy DOC CLX from correct FIB pair by @​NiekNijland in kreuzberg-dev/kreuzberg-lts#3

New Contributors

• @​Goldziher made their first contribution in kreuzberg-dev/kreuzberg-lts#1
• @​NiekNijland made their first contribution in kreuzberg-dev/kreuzberg-lts#3

Full Changelog: kreuzberg-dev/kreuzberg-lts@v4.10.1...v4.10.3

Changelog

Sourced from kreuzberg's changelog.

[4.10.3] - 2026-09-05

Fixed

• Legacy DOC piece-table lookup now reads fcClx/lcbClx from the correct FIB pair, preventing compressed Windows-1252 text from falling back to UTF-16LE contiguous decoding. Thanks to @​NiekNijland.
• The crate builds again from a fresh dependency resolution. ort 2.0.0-rc.13 and quick-xml 0.42 were published after 4.10.2, and both are reachable through the caret requirements 4.10.2 shipped with. rc.13 moved the execution-provider re-exports behind per-provider cargo features, and quick-xml 0.42 changed its names API from bytes to &str; either one fails to compile against 4.10.2's source. Both are now pinned exactly (=2.0.0-rc.12, =0.41.0), so a fresh cargo add kreuzberg resolves to a combination that builds.
• tree-sitter-language-pack 1.16 compatibility. ProcessConfig gained max_source_bytes and parse_timeout_ms; both are left unset, preserving the previous unbounded, untimed behaviour.

Changed

• Dependency refresh across every language package, including liter-llm 1.9 to 1.19, html-to-markdown-rs 3.8.3 to 3.12.0, rmcp 2.2 to 3.2, base64 0.22 to 0.23, and tree-sitter-language-pack 1.12.5 to 1.16.1.
• liter-llm's tracing feature is no longer requested: as of 1.19 tracing is a mandatory dependency of that crate, so the feature no longer exists. Tracing output is unaffected.

[4.10.0] - 2026-07-11

First release of the standalone Kreuzberg v4 LTS line. This is the long-term-support home for Kreuzberg v4; active development continues as Xberg (v5+). No behavioural changes to extraction — this release is a security, licensing, and packaging refresh.

Security

• Upgraded core dependencies to their latest patched releases (hf-hub, rmcp, lopdf, liter-llm, pyo3, comrak, calamine, quick-xml, text-splitter, tower-http, and others).

Changed

• License is now MIT (earlier v4 releases shipped under the Elastic License 2.0).
• Repository moved to standalone kreuzberg-dev/kreuzberg-lts. New v4 Go releases publish under github.com/kreuzberg-dev/kreuzberg-lts/v4; existing github.com/kreuzberg-dev/kreuzberg pins keep resolving via the Go module proxy cache.

Added

• LTS support policy and migration guide at docs.kreuzberg.dev/lts: v4 receives critical bug and security fixes until the end of 2026 on a best-effort basis. The R binding remains exclusive to the v4 LTS line (not part of Xberg v5).

[4.9.9] - 2026-06-05

LTS patch release with PDF/OCR robustness fixes and selected stability backports from main.

Fixed

• OCR on wide, vector-heavy single-page PDFs: uses a bounded render profile and retries at a lower cap instead of failing extraction with PdfiumLibraryInternalError(Unknown).
• Embedded PDF image OCR: unsupported image streams are re-extracted through Pdfium or skipped with a specific warning instead of repeated image dimension probe failed noise.
• RTF/MSG decompression: cap the initial allocation hint so a crafted stream cannot request a multi-gigabyte allocation from an untrusted size header.
• Table row sorting is now NaN-safe (no longer panics).
• FFI embedding preset symbols are exported even when embeddings are disabled, preventing Java/native binding startup from failing with missing symbols.
• Chunking now uses formatted content for non-plain output formats, preserves page metadata, and normalizes trailing-space page artifacts before boundary matching.
• UTF-16 email transcoding: short binary inputs are no longer misclassified as UTF-16.
• Returns a validation error when extraction_timeout_secs is set without tokio-runtime.

[4.9.8] - 2026-05-17

... (truncated)

Commits

• 0b3a736 chore(release): prepare 4.10.3
• 4b0e744 Merge pull request #3 from NiekNijland/codex/fix-legacy-doc-cp1252
• 0fe2330 chore(lint): point the quality-debt notes at their tracking issue
• db267ec fix(lint): resolve the last real findings and justify the rest
• 27f6017 fix(lint): type the any-holes, drop dead async, and repair three tests
• e81ab61 chore(poly): exempt generated code and disable stylistic rules
• f19cb5f fix: read legacy DOC CLX from correct FIB pair
• f9c378e chore(poly): disable MD025 autofix for fmt only
• ce67f9e chore: update GitHub Actions
• d130798 docs(rules): cite the e2e task name that actually exists
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)