build(deps): update pypdf requirement from <7,>=6.16.2 to >=6.19.0,<7

[dependabot]

Updates the requirements on pypdf to permit the latest version.

Release notes

Sourced from pypdf's releases.

Version 6.19.0, 2026-09-16

What's new

Security (SEC)

• Limit size of alphabetical page labels (#4096) by @​stefan6419846

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979) by @​j-t-1

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087) by @​stefan6419846
• Reduce number of full data lookups for attachment mapping API (#4081) by @​stefan6419846

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078) by @​anandghegde
• Use page reference for existing internal link targets (#4076) by @​r-kamei
• Arabic-Indic digits are reversed during text extraction (#4077) by @​Syamjith-NK
• Parse a string rect for add_uri into a rectangle (#4074) by @​RavSinghChandan

Full Changelog

Changelog

Sourced from pypdf's changelog.

Version 6.19.0, 2026-09-16

Security (SEC)

• Limit size of alphabetical page labels (#4096)

Deprecations (DEP)

• Replace PdfWriter method add_js (#3979)

Performance Improvements (PI)

• Move static value out of loop body for appearance stream data (#4087)
• Reduce number of full data lookups for attachment mapping API (#4081)

Bug Fixes (BUG)

• Do not copy unrelated pages when appending pages with non-terminal fields (#4078)
• Use page reference for existing internal link targets (#4076)
• Arabic-Indic digits are reversed during text extraction (#4077)
• Parse a string rect for add_uri into a rectangle (#4074)

Full Changelog

Version 6.18.1, 2026-09-11

Security (SEC)

• Further restrict FlateDecode recovery (#4073)
• Limit entry count for TrueType and Type1 font /Widths (#4072)
• Limit allowed length of tokens in parse_bfchar (#4071)

Bug Fixes (BUG)

• Use current text matrix for visitor_text (#4062)
• Repeat the letter for /S /A and /S /a page labels past Z (#4065)
• Use font color for FreeText default appearance (#4051)

Robustness (ROB)

• Fix compatibility with fonttools < 4.58.0 (#4050, #4059)

Documentation (DOC)

• Use combined matrix in visitor examples (#4066)

Full Changelog

Version 6.18.0, 2026-09-07

Security (SEC)

• Limit allowed length of indirect object tokens (#4055)

Deprecations (DEP)

• Rework configuration value handling (#4044)

New Features (ENH)

• Draw borders and backgrounds for appearance streams and annotations (#4033)

... (truncated)

Commits

• d62cb58 REL: 6.19.0
• 0d8b5a8 SEC: Limit size of alphabetical page labels (#4096)
• 959467a PI: Move static value out of loop body for appearance stream data (#4087)
• 20822b2 DEV: Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#4093)
• 25f2301 DEP: Replace PdfWriter method add_js (#3979)
• a924438 BUG: Do not copy unrelated pages when appending pages with non-terminal field...
• cf5cec2 BUG: Use page reference for existing internal link targets (#4076)
• 96d81f0 BUG: Arabic-Indic digits are reversed during text extraction (#4077)
• 2d21901 DEV: Fix Color class for latest mypy (#4082)
• 893a010 MAINT: Split PdfDocCommon._flatten (#4070)
• Additional commits viewable in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 8b535be3-2186-4028-b1f9-24b43c497e18

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[elkaix]

Merged in #68 (3249543).

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.