[OUAO-FRANK]

Summary

markitdown pins magika~=0.6.1. Every magika 0.6.x release runs dotenv.load_dotenv(dotenv.find_dotenv()) in magika/__init__.py at import time, and find_dotenv() walks up from magika's own site-packages directory — so import markitdown silently loads the first .env it finds above the environment into os.environ. This leaks unrelated variables into a running server process, and can resurrect an environment setting the operator removed on purpose.

magika removed the dotenv dependency in 1.0.2 (google/magika#1283, google/magika#1285), but the ~=0.6.1 pin prevents markitdown users from receiving that fix.

This relaxes the pin to magika>=0.6.1,<2, which:

• keeps the floor at 0.6.1 (no change for anyone already on 0.6.x),
• allows the 1.x line that no longer imports .env,
• stays bounded below 2.0 so a future breaking major is not auto-adopted.

Testing

• Unit tests

$ cd packages/markitdown
$ # reinstall with magika 1.0.3
$ uv pip install "magika>=1.0,<2"
$ python -c "import magika; print(magika.__version__); print(hasattr(magika.Magika(), 'identify_stream'))"
1.0.3
True
$ python -c "import pathlib, magika; s = pathlib.Path(magika.__file__).parent/'__init__.py'; print('load_dotenv' in s.read_text())"
False
$ pytest tests/test_module_misc.py tests/test_csv.py tests/test_xlsx.py -q
239 passed, 1 skipped   # the one failure (test_speech_transcription) is unrelated and needs the audio extras

The markitdown code path uses only magika.Magika() and Magika().identify_stream(), both unchanged in 1.0.3. The dotenv import is confirmed absent from magika/__init__.py in 1.0.3.

No other package in the repo pins magika directly (packages/markitdown-mcp, markitdown-ocr, markitdown-sample-plugin all depend on markitdown transitively), so this is the single constraint to relax.

Breaking Changes

• None — the floor is unchanged; only the upper bound (which was effectively ==0.6.x via ~=) is widened to <2.

Checklist

• Linked Issue or clearly described motivation
• Added/updated docs (if needed) — no public docs reference the magika version
• Added/updated tests (if needed) — this is a dependency-constraint change; verification is by running the existing suite against magika 1.0.3 (239 passed)
• Security impact considered — positive: adopting magika 1.x removes the unexpected .env-into-os.environ import
• Backward compatibility considered — no code change; only the dependency range widens

---

AI disclosure: this change was produced with an AI/LLM coding assistant (deepseek-v4 family). I verified magika 1.0.3's API and the removed dotenv import locally, and will answer maintainer questions myself. No commit is attributed to AI.

Closes #2719

[Adam Fourney (afourney)]

This seems sensible, but there are more changes in the PR than just the Magika dependency. Let me see what I can do to remove this pin.

[Adam Fourney (afourney)]

Ok, I bumped the version as requested, without making other changes. Please re-open this with a more detailed explanation for the xlsx changes if you would like those merged too.