[dependabot]

Bumps pypdf from 6.16.2 to 6.19.0.

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

• Limit size of alphabetical page labels (#4096) by @​stefan6419846

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979) by @​j-t-1

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087) by @​stefan6419846
• Reduce number of full data lookups for attachment mapping API (#4081) by @​stefan6419846

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @​anandghegde
• Use page reference for existing internal link targets (#4076) by @​r-kamei
• Arabic-Indic digits are reversed during text extraction (#4077) by @​Syamjith-NK
• Parse a string rect for add_uri into a rectangle (#4074) by @​RavSinghChandan

Full Changelog

Version 6.18.1, 2026-09-11

What's new

Security (SEC)

• Further restrict FlateDecode recovery (#4073) by @​stefan6419846
• Limit entry count for TrueType and Type1 font /Widths (#4072) by @​stefan6419846
• Limit allowed length of tokens in parse_bfchar (#4071) by @​stefan6419846

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062) by @​r-kamei
• Repeat the letter for /S /A and /S /a page labels past Z (#4065) by @​youdie006
• Use font color for FreeText default appearance (#4051) by @​Yuki9814

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059) by @​MeggyCal and @​stefan6419846

Documentation (DOC)

• Use combined matrix in visitor examples (#4066) by @​r-kamei

Full Changelog

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

• Use apply_configuration as a context manager to temporarily overwrite configuration values.

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

• Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087)
• Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078)
• Use page reference for existing internal link targets (#4076)
• Arabic-Indic digits are reversed during text extraction (#4077)
• Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Version 6.18.1, 2026-09-11

Security (SEC)

• Further restrict FlateDecode recovery (#4073)
• Limit entry count for TrueType and Type1 font /Widths (#4072)
• Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062)
• Repeat the letter for /S /A and /S /a page labels past Z (#4065)
• Use font color for FreeText default appearance (#4051)

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

• Use combined matrix in visitor examples (#4066)

Full Changelog

Version 6.18.0, 2026-09-07

Security (SEC)

• Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

• Rework configuration value handling (#4044)

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033)

... (truncated)

Commits

• d62cb58 REL: 6.19.0
• 0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
• 959467a PI: Move static value out of loop body for appearance stream data (#4087)
• 20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
• 25f2301 DEP: Replace PdfWriter method add_js (#3979)
• a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
• cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
• 96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
• 2d21901 DEV: Fix Color class for latest mypy (#4082)
• 893a010 MAINT: Split PdfDocCommon._flatten (#4070)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by CodeRabbit

• Improvements
  • Updated the component used for PDF processing to a newer release. No changes to the app’s interface or workflows are included in this update. Other features remain unchanged.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pypi/​pypdf@​6.16.2 ⏵ 6.19.0		+75

View full report

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 411a32c8-fdd8-46c2-a89b-09e98ce25ed0

📥 Commits

Reviewing files that changed from the base of the PR and between f51c134 and 08c2752.

📒 Files selected for processing (1)

• requirements.txt

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

The requirements.txt pin for pypdf changes from version 6.16.2 to version 6.19.0.

Changes

Dependency update

Layer / File(s)	Summary
Update pypdf version pin requirements.txt	The pinned pypdf version changes from 6.16.2 to 6.19.0.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 08c27

The PDF upload path retains its extraction limits and handles parser failures. The updated parser may reject affected malformed or pathological PDFs, but no material regression is established; merging is reasonable after normal checks.

Architecture Summary

Architecture risk: 🔵 Low · up to 08c27

The change affects 1 system.

Changed systems: requirements.txt

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — requirements.txt (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in requirements.txt: The pinned pypdf version changes from 6.16.2 to 6.19.0.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely identifies the dependency update from pypdf 6.16.2 to 6.19.0.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

Superseded by #176.