fix(deps): update dependency pypdf to v6

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pypdf (changelog)	>=4.3,<6.0 → >=6.19,<6.20

---

Release Notes

py-pdf/pypdf (pypdf)

v6.19.0

Compare Source

Security (SEC)

• Limit size of alphabetical page labels (#​4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#​3979)

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#​4087)
• Reduce number of full data lookups for attachment mapping API (#​4081)

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#​4078)
• Use page reference for existing internal link targets (#​4076)
• Arabic-Indic digits are reversed during text extraction (#​4077)
• Parse a string rect for add_uri into a rectangle (#​4074)

Full Changelog

v6.18.1

Compare Source

Security (SEC)

• Limit size of alphabetical page labels (#​4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#​3979)

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#​4087)
• Reduce number of full data lookups for attachment mapping API (#​4081)

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#​4078)
• Use page reference for existing internal link targets (#​4076)
• Arabic-Indic digits are reversed during text extraction (#​4077)
• Parse a string rect for add_uri into a rectangle (#​4074)

Full Changelog

v6.18.0

Compare Source

Security (SEC)

• Further restrict FlateDecode recovery (#​4073)
• Limit entry count for TrueType and Type1 font /Widths (#​4072)
• Limit allowed length of tokens in parse_bfchar (#​4071)

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#​4062)
• Repeat the letter for /S /A and /S /a page labels past Z (#​4065)
• Use font color for FreeText default appearance (#​4051)

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#​4050, #​4059)

Documentation (DOC)

• Use combined matrix in visitor examples (#​4066)

Full Changelog

v6.17.0

Compare Source

Security (SEC)

• Limit allowed length of indirect object tokens (#​4055)

Deprecations (DEP)

• Rework configuration value handling (#​4044)

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#​4033)

Full Changelog

v6.16.2

Compare Source

Bug Fixes (BUG)

• Make remove_from_tree() work on outline items (#​3939)
• Be more lenient about space width in layout mode text extraction (#​3992)
• Do not scale the text leading by the font size (#​3987)
• Update annotation appearance stream matrix on page transform (#​3968)
• Allow repeated page references (#​3959)

Robustness (ROB)

• Improve RC4 fallback when cryptography can't provide it (#​3853)

Full Changelog

v6.16.1

Compare Source

Security (SEC)

• Limit iterations for outline retrieval and XForm text extraction (#​3966)

Full Changelog

v6.16.0

Compare Source

Security (SEC)

• Limit iterations for outline retrieval and XForm text extraction (#​3966)

Full Changelog

v6.15.0

Compare Source

Security (SEC)

• Improve performance of read_until_whitespace (#​3947)
• Limit CID width range and width count when loading fonts (#​3946)
• Limit token length for ToUnicode entries (#​3944)

Deprecations (DEP)

• Deprecate previously missed inline_images setter as well (#​3897)

New Features (ENH)

• Add ActualText tag when we produce RTL appearance stream (#​3901)
• Allow keeping original PDF header in non-incremental clone mode (#​3918)
• AppearanceStream: Add support for RTL appearance streams with Arabic characters (#​3831)
• Add actions base class (#​3552)

Bug Fixes (BUG)

• Expand low-bit samples for images without a filter (#​3938)
• Decode low-bit DeviceRGB images as RGB instead of palette (#​3929)
• Correctly handle IndirectObject in FlateDecode.decode DecodeParms (#​3937)

Documentation (DOC)

• Image and attachment filenames are unsanitized (#​3942)

Maintenance (MAINT)

• Update charset mappings (#​3935)

Full Changelog

v6.14.2

Compare Source

Security (SEC)

• Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (#​3892)

Full Changelog

v6.14.1

Compare Source

Security (SEC)

• Avoid infinite loops for incomplete ASCII85 and ASCIIHex inline images (#​3892)

Full Changelog

v6.14.0

Compare Source

Security (SEC)

• Detect end of stream during inline image end marker detection (#​3891)

Full Changelog

v6.13.3

Compare Source

Security (SEC)

• Apply general limit for requested image size (#​3888)
• Speed up recovery when reading broken cross-reference table (#​3887)

New Features (ENH)

• Check whether image is displayed on a given page (#​3738)

Robustness (ROB)

• Several fixes

Full Changelog

v6.13.2

Compare Source

Security (SEC)

• Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (#​3871)

Performance Improvements (PI)

• Avoid per-pixel getpixel loop for 1-bit indexed images (#​3854)

Robustness (ROB)

• Several fixes

Maintenance (MAINT)

• Make mypy assert messages consistent (#​3849)

Full Changelog

v6.13.1

Compare Source

Security (SEC)

• Detect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (#​3847)

Robustness (ROB)

• Fix UnboundLocalError in _read_standard_xref_table on a malformed entry (#​3841)
• Raise PdfStreamError on non-hexadecimal bytes in hex readers (#​3832)

Full Changelog

v6.13.0

Compare Source

Security (SEC)

• Prevent infinite loops when processing threads/articles (#​3839)

Full Changelog

v6.12.2

Compare Source

Security (SEC)

• Optimize _decode_png_prediction regarding memory and speed (#​3806)
• Improve loop control in text extraction (#​3805)

Full Changelog

v6.12.1

Compare Source

Security (SEC)

• Optimize _decode_png_prediction regarding memory and speed (#​3806)
• Improve loop control in text extraction (#​3805)

Full Changelog

v6.12.0

Compare Source

Security (SEC)

• Limit input size and element count for XMP metadata (#​3796)

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#​3795)
• Deal with invalid first code in LZW decoder (#​3794)

Full Changelog

v6.11.0

Compare Source

New Features (ENH)

• Initialise a Font from an embedded font file (#​3704)

Robustness (ROB)

• Allow to fix AES padding length in non-strict mode (#​3742)

Developer Experience (DEV)

• Enable PyPy testing again (#​3752)
• Align mypy Makefile target with strict mode (#​3690)

Full Changelog

v6.10.2

Compare Source

Security (SEC)

• Do not rely on possibly invalid /Size for incremental cloning (#​3735)
• Introduce limits for FlateDecode parameters and image decoding (#​3734)

Full Changelog

v6.10.1

Compare Source

Security (SEC)

• Do not rely on possibly invalid /Size for incremental cloning (#​3735)
• Introduce limits for FlateDecode parameters and image decoding (#​3734)

Full Changelog

v6.10.0

Compare Source

Security (SEC)

• Limit the allowed size of xref and object streams (#​3733)

Robustness (ROB)

• Consider strict mode setting for decryption errors (#​3731)

Documentation (DOC)

• Use new parameter names for compress_identical_objects

Full Changelog

v6.9.2

Compare Source

Security (SEC)

• Avoid infinite loop in read_from_stream for broken files (#​3693)

Robustness (ROB)

• Resolve UnboundLocalError for xobjs in _get_image (#​3684)

Full Changelog

v6.9.1

Compare Source

Security (SEC)

• Avoid infinite loop in read_from_stream for broken files (#​3693)

Robustness (ROB)

• Resolve UnboundLocalError for xobjs in _get_image (#​3684)

Full Changelog

v6.9.0

Compare Source

Security (SEC)

• Improve performance and limit length of array-based content streams (#​3686)

Full Changelog

v6.8.0

Compare Source

New Features (ENH)

• Expose /Perms verification result on Encryption object (#​3672)

Performance Improvements (PI)

• Fix O(n²) performance in NameObject read/write (#​3679)
• Batch-parse all objects in ObjStm on first access (#​3677)

Bug Fixes (BUG)

• Avoid sharing array-based content streams between pages (#​3681)
• Avoid accessing invalid page when inserting blank page under some conditions (#​3529)

Full Changelog

v6.7.5

Compare Source

Security (SEC)

• Limit allowed /Length value of stream (#​3675)

New Features (ENH)

• Add /IRT (in-reply-to) support for markup annotations (#​3631)

Documentation (DOC)

• Avoid using PageObject.replace_contents on PdfReader (#​3669)
• Document how to disable jbig2dec calls

Full Changelog

v6.7.4

Compare Source

Security (SEC)

• Improve the performance of the ASCIIHexDecode filter (#​3666)

Full Changelog

v6.7.3

Compare Source

Security (SEC)

• Allow limiting output length for RunLengthDecode filter (#​3664)

Robustness (ROB)

• Deal with invalid annotations in extract_links (#​3659)

Full Changelog

v6.7.2

Compare Source

Security (SEC)

• Use zlib decompression limit when retrieving XFA data (#​3658)

Full Changelog

v6.7.1

Compare Source

Security (SEC)

• Prevent infinite loop from circular xref /Prev references (#​3655)

Bug Fixes (BUG)

• Fix wrong LUT size error (#​3651)
• Fix handling of page boxes defined on /Pages (#​3650)

Full Changelog

v6.7.0

Compare Source

Security (SEC)

• Detect cyclic references when accessing TreeObject.children (#​3645)
• Limit size of /ToUnicode entries (#​3646)
• Limit FlateDecode recovery attempts (#​3644)

Bug Fixes (BUG)

• Avoid own object replacement logic in PageObject.replace_contents (#​3638)
• Fix UnboundLocalError when update_page_form_field_values with /Sig (#​3634)

Robustness (ROB)

• Avoid divison by zero when decoding FlateDecode PNG prediction (#​3641)

Full Changelog

v6.6.2

Compare Source

Deprecations (DEP)

• Deprecate support for abbreviations in decode_stream_data (#​3617)

New Features (ENH)

• Add ability to add font resources for 14 Adobe Core fonts in text widget annotations (#​3624)

Bug Fixes (BUG)

• Avoid invalid load for ICCBased FlateDecode images in mode 1 (#​3619)

Robustness (ROB)

• Fix AESV2 decryption when /Length missing in encrypt dict (#​3629)
• Fix merging when annotations point to NullObject (#​3613)
• Check for self._info being None in compress_identical_objects (#​3612)

Full Changelog

v6.6.1

Compare Source

Security (SEC)

• Detect cyclic references when retrieving outlines (#​3610)

Full Changelog

v6.6.0

Compare Source

Robustness (ROB)

• /AcroForm might be NullObject (#​3601)
• Handle missing font bounding boxes gracefully (#​3600)

Full Changelog

v6.5.0

Compare Source

Security (SEC)

• Improve handling of partially broken PDF files (#​3594)

Deprecations (DEP)

• Block common page content modifications when assigned to reader (#​3582)

New Features (ENH)

• Embellishments to generated text appearance streams (#​3571)

Bug Fixes (BUG)

• Do not consider multi-byte BOM-like sequences as BOMs (#​3589)

Robustness (ROB)

• Avoid empty FlateDecode outputs without warning (#​3579)

Documentation (DOC)

• Add outlines documentation and link it in User Guide (#​3511)

Developer Experience (DEV)

• Add PyPy 3.11 to test matrix and benchmarks (#​3574)

Maintenance (MAINT)

• Fix compatibility with Pillow >= 12.1.0 (#​3590)

Full Changelog

v6.4.2

Compare Source

New Features (ENH)

• Limit jbig2dec memory usage (#​3576)
• FontDescriptor: Initiate from embedded font resource (#​3551)

Robustness (ROB)

• Allow fallback to PBM files for jbig2dec without PNG support (#​3567)
• Use warning instead of error for early EOD for RunLengthDecode (#​3548)

Developer Experience (DEV)

• Test with macOS as well (#​3401)

Full Changelog

v6.4.1

Compare Source

Bug Fixes (BUG)

• Fix KeyError when flattening form field without /Font in resources (#​3554)

Robustness (ROB)

• Allow deleting non-existent annotations (#​3559)

Documentation (DOC)

• Fix level of attachment heading (#​3560)

Full Changelog

v6.4.0

Compare Source

Performance Improvements (PI)

• Optimize loop for layout mode text extraction (#​3543)

Bug Fixes (BUG)

• Do not fail on choice field without /Opt key (#​3540)

Documentation (DOC)

• Document possible issues with merge_page and clipping (#​3546)
• Add some notes about library security (#​3545)

Maintenance (MAINT)

• Use CORE_FONT_METRICS for widths where possible (#​3526)

Full Changelog

v6.3.0

Compare Source

Security (SEC)

• Reduce default limit for LZW decoding

New Features (ENH)

• Parse and format comb fields in text widget annotations (#​3519)

Robustness (ROB)

• Silently ignore Adobe Ascii85 whitespace for suffix detection (#​3528)

Full Changelog

v6.2.0

Compare Source

New Features (ENH)

• Wrap and align text in flattened PDF forms (#​3465)

Bug Fixes (BUG)

• Fix missing "PreventGC" when cloning (#​3520)
• Preserve JPEG image quality by default (#​3516)

Full Changelog

v6.1.3

Compare Source

New Features (ENH)

• Add 'strict' parameter to PDFWriter (#​3503)

Bug Fixes (BUG)

• PdfWriter.append fails when there are articles being None (#​3509)

Documentation (DOC)

• Execute docs examples in CI (#​3507)

Full Changelog

v6.1.2

Compare Source

Security (SEC)

• Allow limiting size of LZWDecode streams (#​3502)
• Avoid infinite loop when reading broken DCT-based inline images (#​3501)

Bug Fixes (BUG)

• PageObject.scale() scales media box incorrectly (#​3489)

Robustness (ROB)

• Fail with explicit exception when image mode is an empty array (#​3500)

Full Changelog

v6.1.1

Compare Source

Bug Fixes (BUG)

• Fix handling of zero-length StreamObject (#​3485)

Robustness (ROB)

• Deal with wrong size for incremental PDF files (#​3495)
• Improve handling for malformed cross-reference tables (#​3483)

Developer Experience (DEV)

• Use released Python 3.14
• Use Mapping instead of dict in type hint of update_page_form_field_values (#​3490)

Full Changelog

v6.1.0

Compare Source

Bug Fixes (BUG)

• Insert new embedded files in a sorted manner (#​3477)
• Fix name tree handling for embedded files with Kids-based inputs (#​3475)
• Make embedding files not break PDF/A-3 compliance (#​3472)

Documentation (DOC)

• Document AFRelationship handling for PDF/A and provide constants (#​3478)

Full Changelog

v6.0.0

Compare Source

New Features (ENH)

• Enhance XMP metadata handling with creation and setter methods (#​3410)
• Add all font metrics for base 14 Type 1 PDF fonts (#​3363)
• Allow deleting embedded files (#​3461)
• Add support for Python in FIPS mode for document identifier (#​3438)

Bug Fixes (BUG)

• Fix handling of UTF-16 encoded destination titles (#​3463)
• Guard empty input to prevent IndexError (#​3448)

Developer Experience (DEV)

• Fix type hint for XMP metadata setter to add bytes type (#​3464)

Full Changelog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.