Bump pdfkit from 0.15.2 to 0.19.1 in /backend

[dependabot]

Bumps pdfkit from 0.15.2 to 0.19.1.

Release notes

Sourced from pdfkit's releases.

0.19.1

• Fix RGB JPEG embedded as DeviceGray (0.19.0 regression) (#1734)

0.19.0

Highlights in this release are the bump in minimum supported environments (quite conservative), reduce of Node js specific dependencies (EventEmitter, Buffer), more granular image transparency and roundedRect options and the usual quality of life fixes

• [BREAKING] Bump node version requirement to 20+
• [BREAKING] Bump minimum supported browsers to Firefox 115, iOS/Safari 16
• Fix text with input x as null
• Add opacity option to doc.image() to control image transparency
• Fix corrupted PDF when mixing standard and embedded fonts that share postscript name
• Fix PDF/UA compliance issues in kitchen-sink-accessible example
• Add bbox and placement options to PDFStructureElement for PDF/UA compliance
• Extend roundedRect with borderRadius as number for all corners or per-corner array (CSS order)
• Fix accessibility: scope in TH element
• Fix PDF Name escaping for spot colors with spaces (#1644)

0.18.0

• Fix garbled text copying in Chrome/Edge for PDFs with >256 unique characters (#1659)
• Fix Link accessibility issues
• Fix Table Accessibility Issue: Operator CS/cs not allowed in this current state
• Fix Interlaced PNG with indexed transparency rendered incorrectly
• Fix SVG path parser incorrectly handle arc flags without separators
• Add pageLayout option to control how pages are displayed in PDF viewers
• Preserve existing PageMode instead of overwriting when adding outlines
• Add userUnit option for custom page units (PDF 1.6)
• Support outlines that jump to specific page positions with custom zoom level
• Add robust handling of null byte padding in JPEG images
• Replace outdated jpeg-exif with minimal implementation
• Replace outdated crypto-js with maintained small alternatives
• Fix issue with indentation with indentAllLines: true when a new page is created

0.17.2

• Fix rendering lists that spans across pages

0.17.1

• Fix null values in table cells rendering as [object Object]
• Fix further LineWrapper precision issues
• Optmize standard font handling. Less code, less memory usage

0.17.0

• Fix precision rounding issues in LineWrapper
• Fix fonts without a postscriptName
• Add support for dynamic sizing
• Add support for rotatable text
• Fix page cascade options when text overflows
• Add table generation
• Fix y position when using image() without x and y coordinates
• Improve Prettier configuration

... (truncated)

Changelog

Sourced from pdfkit's changelog.

[v0.19.1] - 2026-06-10

• Fix RGB JPEG embedded as DeviceGray (0.19.0 regression) (#1734)

[v0.19.0] - 2026-06-07

• Bump node version requirement to 20+
• Bump minimum supported browsers to Firefox 115, iOS/Safari 16
• Fix text with input x as null
• Add opacity option to doc.image() to control image transparency
• Fix corrupted PDF when mixing standard and embedded fonts that share postscript name
• Fix PDF/UA compliance issues in kitchen-sink-accessible example
• Add bbox and placement options to PDFStructureElement for PDF/UA compliance
• Extend roundedRect with borderRadius as number for all corners or per-corner array (CSS order)
• Fix accessibility: scope in TH element
• Fix PDF Name escaping for spot colors with spaces (#1644)

[v0.18.0] - 2026-03-14

• Fix garbled text copying in Chrome/Edge for PDFs with >256 unique characters (#1659)
• Fix Link accessibility issues
• Fix Table Accessibility Issue: Operator CS/cs not allowed in this current state
• Fix Interlaced PNG with indexed transparency rendered incorrectly
• Fix SVG path parser incorrectly handle arc flags without separators
• Add pageLayout option to control how pages are displayed in PDF viewers
• Preserve existing PageMode instead of overwriting when adding outlines
• Add userUnit option for custom page units (PDF 1.6)
• Support outlines that jump to specific page positions with custom zoom level
• Add robust handling of null byte padding in JPEG images
• Replace outdated jpeg-exif with minimal implementation
• Replace outdated crypto-js with maintained small alternatives
• Fix issue with indentation with indentAllLines: true when a new page is created

[v0.17.2] - 2025-08-30

• Fix rendering lists that spans across pages

[v0.17.1] - 2025-05-02

• Fix null values in table cells rendering as [object Object]
• Fix further LineWrapper precision issues
• Optmize standard font handling. Less code, less memory usage

[v0.17.0] - 2025-04-12

• Fix precision rounding issues in LineWrapper
• Fix fonts without a postscriptName
• Add support for dynamic sizing
• Add support for rotatable text
• Fix page cascade options when text overflows

... (truncated)

Commits

• f9992a2 v0.19.1
• b5b2547 Fix RGB JPEG embedded as DeviceGray (0.19.0 regression) (#1734)
• 8a8971e Bump minimatch from 3.1.2 to 3.1.5 (#1696)
• 44d5be7 Bump pbkdf2 from 3.1.2 to 3.1.6 (#1731)
• 96cd9c7 Bump qs from 6.14.0 to 6.15.2 (#1730)
• f51c5a4 Bump tar from 7.5.2 to 7.5.11 (#1701)
• f3f0d48 Bump flatted from 3.3.3 to 3.4.2 (#1708)
• e779e40 Bump picomatch from 2.3.1 to 2.3.2 (#1711)
• f4c32de Bump brace-expansion from 1.1.11 to 1.1.13 (#1712)
• b4a9e5b Bump lodash from 4.17.21 to 4.18.1 (#1713)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)