[dependabot]

Bumps pypdf from 6.19.0 to 6.20.0.

Release notes

Sourced from pypdf's releases.

Version 6.20.0, 2026-10-09

What's new

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173) by @​stefan6419846

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168) by @​stefan6419846

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164) by @​marshalltech81
• Parse numbers, indirect references, names and nulls faster (#4148) by @​MartinThoma
• Do not inherit PdfObject from a Protocol (#4149) by @​MartinThoma
• Speed up cloning direct objects (#4152) by @​MartinThoma

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154) by @​pasmud
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151) by @​metsw24-max

Robustness (ROB)

• Multiple changes by @​RavSinghChandan
• Accept an %%EOF marker that is not at the start of a line (#4136) by @​Dmao233
• Font / _cmapy.py: More robust guards around fontTools (#4157) by @​PJBrs
• Flatten the page tree iteratively (#4107) by @​MartinThoma
• Ignore invalid character codes for TrueType and Type1 font widths (#4117) by @​stefan6419846
• Restrict values to allowed range in CCITTFaxDecode (#4115) by @​stefan6419846
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108) by @​MartinThoma

Developer Experience (DEV)

• Declare official support for Python 3.15 by @​stefan6419846
• Declare protocol data members on PdfReader and PdfWriter (#4106) by @​ihsandeniz

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.20.0, 2026-10-09

Security (SEC)

• Limit work per stream (filter count, accumulated decoding work) (#4173)

New Features (ENH)

• Add support for BrotliDecode filter (PDF 2.0) (#4168)

Performance Improvements (PI)

• Parse an embedded CFF font program once per stream (#4164)
• Parse numbers, indirect references, names and nulls faster (#4148)
• Do not inherit PdfObject from a Protocol (#4149)
• Speed up cloning direct objects (#4152)

Bug Fixes (BUG)

• Report the correct page number for identical pages (#4154)
• Decrypt the XMP metadata stream unless /EncryptMetadata is false (#4151)

Robustness (ROB)

• Accept an %%EOF marker that is not at the start of a line (#4136)
• Font / _cmapy.py: More robust guards around fontTools (#4157)
• Flatten the page tree iteratively (#4107)
• Ignore invalid character codes for TrueType and Type1 font widths (#4117)
• Restrict values to allowed range in CCITTFaxDecode (#4115)
• Drop a /Kids entry resolving to null instead of raising a cycle error (#4108)

Developer Experience (DEV)

• Declare official support for Python 3.15
• Declare protocol data members on PdfReader and PdfWriter (#4106)

Full Changelog

Commits

• 0309ab7 REL: 6.20.0
• 80a84d4 SEC: Limit work per stream (filter count, accumulated decoding work) (#4173)
• 4c20fa8 DEV: Declare official support for Python 3.15
• c64a4e4 ROB: Skip a Tj operator whose operand is not a string (#4171)
• 4714175 MAINT: Fix A001 (Variable is shadowing a Python builtin) (#4167)
• 921d778 ROB: Accept an %%EOF marker that is not at the start of a line (#4136)
• 1a6b050 ROB: Skip a TJ operator whose operand is not an array (#4166)
• 5b6a77a PI: Parse an embedded CFF font program once per stream (#4164)
• 79423c1 PI: Parse numbers, indirect references, names and nulls faster (#4148)
• 37e1cd6 ROB: Handle EOF when reading standard xref table (#4170)
• Additional commits viewable in compare view

[dannyadair]

@dependabot rebase

[dannyadair]

@dependabot rebase