Build(deps): Bump pypdf from 6.16.2 to 6.18.0 in /backend

[dependabot]

Bumps pypdf from 6.16.2 to 6.18.0.

Release notes

Sourced from pypdf's releases.

Version 6.18.0, 2026-09-07

What's new

Please note that this release requires users which previously overwrote the default limits to migrate to the new approach: Docs

In short:

• Use apply_configuration as a context manager to temporarily overwrite configuration values.
• Use overwrite_configuration to change the configuration values for the whole session.

The old overwrites should continue to work in most cases. If you have migrated successfully and do not need the legacy handling anymore (which can cause some overhead), consider using the temporary disable_legacy_handling setting:

from pypdf import overwrite_configuration
overwrite_configuration(disable_legacy_handling=True)

In case you are experiencing some unexpected issues after the migration, consider opening a new issue (or commenting on an existing one) with the necessary details to reproduce it.

Security (SEC)

• Limit allowed length of indirect object tokens (#4055) by @​stefan6419846

Deprecations (DEP)

• Rework configuration value handling (#4044) by @​stefan6419846

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033) by @​PJBrs

Full Changelog

Version 6.17.0, 2026-09-04

What's new

Security (SEC)

• Limit value for Roman numerals (#4047) by @​stefan6419846

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032) by @​PJBrs

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036) by @​petermik68-sudo

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026) by @​Anai-Guo
• Detect a duplicate dictionary key whose first value is falsy (#4024) by @​devYRPauli
• Make is_open=False collapse outline items (#3998) by @​SomSamantray

Robustness (ROB)

• Multiple changes for wrong inputs by @​RavSinghChandan

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.18.0, 2026-09-07

Security (SEC)

• Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

• Rework configuration value handling (#4044)

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033)

Full Changelog

Version 6.17.0, 2026-09-04

Security (SEC)

• Limit value for Roman numerals (#4047)

New Features (ENH)

• _cmap.py: Also parse encoding for embedded CFF Type1 fonts (#4032)

Performance Improvements (PI)

• Cache repeated text extraction character lookups (#4036)

Bug Fixes (BUG)

• Treat an empty /Filter array as no filter when extracting images (#4026)
• Detect a duplicate dictionary key whose first value is falsy (#4024)
• Make is_open=False collapse outline items (#3998)

Robustness (ROB)

• Multiple changes for wrong inputs
• Skip trailing duplicate %%EOF markers when locating startxref (#4015)
• Do not crash on a non-array destination (#3976)
• Handle annotations without subtype during merge (#3999)

Documentation (DOC)

• Use AnnotationFlag enum instead of plain integers (#3997)

Code Style (STY)

• Multiple small changes detected from test runs

Full Changelog

Commits

• 18e4c22 REL: 6.18.0
• 82501d2 SEC: Limit allowed length of indirect object tokens (#4055)
• d35834b ENH: Draw borders and backgrounds for appearance streams and annotations (#4033)
• 4b16bbb STY: Rename variable for readability (#4049)
• a1ce7fb ROB: Do not crash when a page tree entry is not a dictionary (#4048)
• 06b97ce DEV: Bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#4053)
• d3f790c ROB: Do not crash when the annotations are not an array (#4046)
• 3dc716e STY: Enforce lowercase function variables (#4045)
• ec2406f DEP: Rework configuration value handling (#4044)
• c76eed7 REL: 6.17.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.