chore(deps): update dependency pypdf to v6.12.0 [security]

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
pypdf (changelog)	==6.10.2 → ==6.12.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference streams

CVE-2026-48156 / GHSA-248m-82v9-q6g6

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires cross-reference streams with /W [0 0 0] values and large /Size values.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to upgrade their apps immediately, they should consider applying the changes from PR #​3791.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6
• https://nvd.nist.gov/vuln/detail/CVE-2026-48156
• https://github.com/py-pdf/pypdf/pull/3791
• https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0
• https://github.com/advisories/GHSA-248m-82v9-q6g6

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

pypdf: Possible large memory usage for large offsets for layout mode text

CVE-2026-48155 / GHSA-cj93-chg6-vgv8

More information

Details

Impact

An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires extracting text in layout mode with large character offsets.

Patches

This has been fixed in pypdf==6.12.0.

Workarounds

If developers are unable to immediately upgrade, they should consider applying the changes from PR #​3790.

Severity

• CVSS Score: 4.8 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8
• https://nvd.nist.gov/vuln/detail/CVE-2026-48155
• https://github.com/py-pdf/pypdf/pull/3790
• https://github.com/py-pdf/pypdf/releases/tag/6.12.0
• https://github.com/advisories/GHSA-cj93-chg6-vgv8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

py-pdf/pypdf (pypdf)

v6.12.0

Compare Source

Security (SEC)

• Limit input size and element count for XMP metadata (#​3796)

Robustness (ROB)

• Prevent cyclic parent hierarchies for inherited dictionaries (#​3795)
• Deal with invalid first code in LZW decoder (#​3794)

Full Changelog

v6.11.0

Compare Source

New Features (ENH)

• Initialise a Font from an embedded font file (#​3704)

Robustness (ROB)

• Allow to fix AES padding length in non-strict mode (#​3742)

Developer Experience (DEV)

• Enable PyPy testing again (#​3752)
• Align mypy Makefile target with strict mode (#​3690)

Full Changelog

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.