chore(deps): bump pypdf from 6.11.0 to 6.13.0

[dependabot]

Bumps pypdf from 6.11.0 to 6.13.0.

Release notes

Sourced from pypdf's releases.

Version 6.13.0, 2026-06-05

What's new

Security (SEC)

• Avoid infinite loops for outlines and text extraction (#3830) by @​stefan6419846

New Features (ENH)

• Add Japanese predefined CMaps (#3800) by @​yasuhiroiwaki
• Font: Collect all character widths, not only those that can be unicode mapped (#3798) by @​PJBrs

Robustness (ROB)

• Recover a corrupt trailing startxref pointer (closes #3238) (#3826) by @​gaoflow
• Handle /Pages node without /Kids during flattening (#3825) by @​gaoflow
• Accept inline image EI marker at the end of a content stream (#3827) by @​gaoflow

Maintenance (MAINT)

• Type the always-raising deprecation helpers as NoReturn (#3819) by @​estelledc

Full Changelog

Version 6.12.2, 2026-05-26

What's new

Security (SEC)

• Optimize _decode_png_prediction regarding memory and speed (#3806) by @​stefan6419846
• Improve loop control in text extraction (#3805) by @​stefan6419846

Full Changelog

Version 6.12.1, 2026-05-22

What's new

Security (SEC)

• Limit input size and element count for XMP metadata (#3796) by @​stefan6419846

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#3795) by @​stefan6419846
• Deal with invalid first code in LZW decoder (#3794) by @​stefan6419846

Full Changelog

Version 6.12.0, 2026-05-21

What's new

Security (SEC)

• Disallow cross-reference streams with zero-only width values (#3791) by @​stefan6419846
• Avoid excessive whitespace in layout mode text extraction (#3790) by @​stefan6419846

New Features (ENH)

• Implement SASLprep (RFC 4013) for AES-256 password normalization (#3780) by @​adityamoolya

... (truncated)

Changelog

Sourced from pypdf's changelog.

Version 6.13.0, 2026-06-05

Security (SEC)

• Avoid infinite loops for outlines and text extraction (#3830)

New Features (ENH)

• Add Japanese predefined CMaps (#3800)
• Font: Collect all character widths, not only those that can be unicode mapped (#3798)

Robustness (ROB)

• Recover a corrupt trailing startxref pointer (closes #3238) (#3826)
• Handle /Pages node without /Kids during flattening (#3825)
• Accept inline image EI marker at the end of a content stream (#3827)

Maintenance (MAINT)

• Type the always-raising deprecation helpers as NoReturn (#3819)

Full Changelog

Version 6.12.2, 2026-05-26

Security (SEC)

• Optimize _decode_png_prediction regarding memory and speed (#3806)
• Improve loop control in text extraction (#3805)

Full Changelog

Version 6.12.1, 2026-05-22

Security (SEC)

• Limit input size and element count for XMP metadata (#3796)

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#3795)
• Deal with invalid first code in LZW decoder (#3794)

Full Changelog

Version 6.12.0, 2026-05-21

Security (SEC)

• Disallow cross-reference streams with zero-only width values (#3791)
• Avoid excessive whitespace in layout mode text extraction (#3790)

New Features (ENH)

• Implement SASLprep (RFC 4013) for AES-256 password normalization (#3780)
• CID font resource from font file to encode more characters (#3652)

Performance Improvements (PI)

• Optimize retrieval of named destinatinos in reader (#3442)

... (truncated)

Commits

• 98afb45 REL: 6.13.0
• 68822de SEC: Avoid infinite loops for outlines and text extraction (#3830)
• ddd3485 ROB: Recover a corrupt trailing startxref pointer (closes #3238) (#3826)
• 5cebe5e ROB: Handle /Pages node without /Kids during flattening (#3825)
• be173fe ROB: Accept inline image EI marker at the end of a content stream (#3827)
• e0d443c ROB: Handle object numbers above 2**31 in _make_crypt_filter (#3824)
• dad0f5e ROB: Stop reading past truncated /Nums in get_label_from_nums (#3823)
• 52545c5 ROB: Pad truncated data in bits2byte instead of reading out of bounds (#3820)
• 56e0784 ENH: Add Japanese predefined CMaps (#3800)
• 0d048ee MAINT: Add ABC as a base class (#3818)
• Additional commits viewable in compare view