[dependabot]

Bumps pypdf from 6.15.0 to 6.19.0.

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

• Limit size of alphabetical page labels (#4096) by @​stefan6419846

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979) by @​j-t-1

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087) by @​stefan6419846
• Reduce number of full data lookups for attachment mapping API (#4081) by @​stefan6419846

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @​anandghegde
• Use page reference for existing internal link targets (#4076) by @​r-kamei
• Arabic-Indic digits are reversed during text extraction (#4077) by @​Syamjith-NK
• Parse a string rect for add_uri into a rectangle (#4074) by @​RavSinghChandan

Full Changelog

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

• Further restrict FlateDecode recovery (#4073) by @​stefan6419846
• Limit entry count for TrueType and Type1 font /Widths (#4072) by @​stefan6419846
• Limit allowed length of tokens in parse_bfchar (#4071) by @​stefan6419846

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062) by @​r-kamei
• Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @​youdie006
• Use font color for FreeText default appearance (#4051) by @​Yuki9814

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @​MeggyCal and @​stefan6419846

Documentation (DOC)

• Use combined matrix in visitor examples (#4066) by @​r-kamei

Full Changelog

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

• Use apply_configuration as a context manager to temporarily overwrite configuration values.

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

• Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087)
• Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078)
• Use page reference for existing internal link targets (#4076)
• Arabic-Indic digits are reversed during text extraction (#4077)
• Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Version 6.18.1, 2026-09-11

Security (SEC)

• Further restrict FlateDecode recovery (#4073)
• Limit entry count for TrueType and Type1 font /Widths (#4072)
• Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062)
• Repeat the letter for /S /A and /S /a page labels past Z (#4065)
• Use font color for FreeText default appearance (#4051)

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

• Use combined matrix in visitor examples (#4066)

Full Changelog

Version 6.18.0, 2026-09-07

Security (SEC)

• Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

• Rework configuration value handling (#4044)

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033)

... (truncated)

Commits

• d62cb58 REL: 6.19.0
• 0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
• 959467a PI: Move static value out of loop body for appearance stream data (#4087)
• 20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
• 25f2301 DEP: Replace PdfWriter method add_js (#3979)
• a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
• cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
• 96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
• 2d21901 DEV: Fix Color class for latest mypy (#4082)
• 893a010 MAINT: Split PdfDocCommon._flatten (#4070)
• Additional commits viewable in compare view

[dependabot]

Superseded by #48.