chore(deps): Bump pypdf from 6.16.2 to 6.18.0 in /services/api in the community-runtime-dependencies group across 1 directory

[dependabot]

Bumps the community-runtime-dependencies group with 1 update in the /services/api directory: pypdf.

Updates pypdf from 6.16.2 to 6.18.0

Release notes

Sourced from pypdf's releases.

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

• Use apply_configuration as a context manager to temporarily overwrite configuration values.
• Use overwrite_configuration to change the configuration values for the whole session.

The old overwrites should continue to work in most cases. If you have migrated successfully and do not need the legacy handling anymore (which can cause some overhead), consider using the temporary disable_legacy_handling setting:

from pypdf import overwrite_configuration
overwrite_configuration(disable_legacy_handling=True)

In case you are experiencing some unexpected issues after the migration, consider opening a new issue (or commenting on an existing one) with the necessary details to reproduce it.

Security (SEC)

• Limit allowed length of indirect object tokens (#4055) by @​stefan6419846

Deprecations (DEP)

• Rework configuration value handling (#4044) by @​stefan6419846

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033) by @​PJBrs

Full Changelog

Version 6.17.0, 2026-09-04

What's new

Security (SEC)

• Limit value for Roman numerals (#4047) by @​stefan6419846

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032) by @​PJBrs

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036) by @​petermik68-sudo

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026) by @​Anai-Guo
• Detect a duplicate dictionary key whose first value is falsy (#4024) by @​devYRPauli
• Make is_open=False collapse outline items (#3998) by @​SomSamantray

Robustness (ROB)

• Multiple changes for wrong inputs by @​RavSinghChandan

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.18.0, 2026-09-07

Security (SEC)

• Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

• Rework configuration value handling (#4044)

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033)

Full Changelog

Version 6.17.0, 2026-09-04

Security (SEC)

• Limit value for Roman numerals (#4047)

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032)

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036)

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026)
• Detect a duplicate dictionary key whose first value is falsy (#4024)
• Make is_open=False collapse outline items (#3998)

Robustness (ROB)

• Multiple changes for wrong inputs
• Skip trailing duplicate %%EOF markers when locating startxref (#4015)
• Do not crash on a non-array destination (#3976)
• Handle annotations without subtype during merge (#3999)

Documentation (DOC)

• Use AnnotationFlag enum instead of plain integers (#3997)

Code Style (STY)

• Multiple small changes detected from test runs

Full Changelog

Commits

• 18e4c22 REL: 6.18.0
• 82501d2 SEC: Limit allowed length of indirect object tokens (#4055)
• d35834b ENH: Draw borders and backgrounds for appearance streams and annotations (#4033)
• 4b16bbb STY: Rename variable for readability (#4049)
• a1ce7fb ROB: Do not crash when a page tree entry is not a dictionary (#4048)
• 06b97ce DEV: Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#4053)
• d3f790c ROB: Do not crash when the annotations are not an array (#4046)
• 3dc716e STY: Enforce lowercase function variables (#4045)
• ec2406f DEP: Rework configuration value handling (#4044)
• c76eed7 REL: 6.17.0
• Additional commits viewable in compare view

[L4XB]

Superseded by #78, which takes this update together with the other three for this service in one uv lock resolution.

This pull request cannot merge on its own: a lock update rewrites files COMMUNITY_EXPORT_MANIFEST.json binds, so the export audit refuses the tree, and the manifest is not something Dependabot can rewrite. Pushing the fix into this branch is not the way around it either — a Dependabot-owned pull request may carry only Dependabot-authored commits, for good reason. I tried that and reverted it; this branch is back at your own commit.

#76 adds --refresh-manifest to the audit so the repair stops being a manual reconstruction.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml