chore(deps): bump the minor-and-patch group in /backend with 3 updates

[dependabot]

Bumps the minor-and-patch group in /backend with 3 updates: pdfkit, @types/pdfkit and @types/redis.

Updates pdfkit from 0.15.2 to 0.20.1

Release notes

Sourced from pdfkit's releases.

v0.20.1

• Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

v0.20.0

Highlights

TLDR: "A PDF generation library for Node.js" -> "A JavaScript PDF generation library"

Standard Font Support rewritten

Standard font support has been rewritten to use pre-parsed font metrics instead of parsing raw AFM definitions at runtime. The new approach is more efficient (less runtime overhead and memory usage) and reduces the size of the browser bundle significantly. Standalone build which bundles all standard fonts is down to 1.3MB from 2.3MB.

In Node, font metrics are loaded lazily as before, while in browser builds, except the standalone one, each font must be imported from pdfkit/standard-fonts/* and registered with registerStdFonts(). Previously, to use a standard font in browser was necessary to use a bundler.

See usage example in output helpers section below.

Removal of Node specific dependencies

Buffer is no longer used internally. Uint8Array is now the minimum denominator for binary data in both Node and browsers. Since Buffer is a Uint8Array subclass, this change is fully backward compatible.

Native fs, zlib and ReadableStream are conditionally imported only in Node. Browser builds use minimal implementations. This approach gives us the best of both worlds: Node builds still use the native modules, while browser ones are portable.

Many thanks to @​diegomura for his help in removing the Node specific dependencies.

registerFile API

The new registerFile(path, data) API allows registering in-memory files globally. The data argument must be a Uint8Array. Passing undefined as data unregisters the path.

In browsers, it can be used as a simplified virtual file system. In Node, this is useful for registering fonts, images and other resources that are not available on disk. The native file system is still used when the path is not registered.

import { PDFDocument, registerFile } from 'pdfkit';
const response = await fetch('/fonts/Roboto-Regular.ttf');
const fontData = new Uint8Array(await response.arrayBuffer());
registerFile('fonts/Roboto-Regular.ttf', fontData);
const doc = new PDFDocument();
// register an alias for the font path
doc.registerFont('Roboto', 'fonts/Roboto-Regular.ttf');
// or use the path directly
doc.font('fonts/Roboto-Regular.ttf');
// Optionally unregister the path when it is no longer needed.
registerFile('fonts/Roboto-Regular.ttf', undefined);

toBytes and toBlob output helpers

... (truncated)

Changelog

Sourced from pdfkit's changelog.

[v0.20.1] - 2026-08-23

• Add a Node ESM build so import 'pdfkit' in Node resolves to the Node build (real file system, native zlib, Node streams, self-registering standard fonts) instead of the browser bundle

[v0.20.0] - 2026-08-23

• [BREAKING CHANGE] Remove the virtual file system (pdfkit/virtual-fs). Browser builds no longer depend on fs: use registerFile to register Uint8Array data under a path, pass a Uint8Array or ArrayBuffer directly to registerFont, image and file, or pass a data URL directly to image and file
• Add registerFile(path, data, options) to globally register in-memory files in Node and browsers, with optional birthtime and ctime metadata. Passing undefined as data unregisters the path
• [BREAKING CHANGE] Export PDFDocument, LineWrapper and registerFile as named exports from the main Node and browser entry points while preserving the default PDFDocument export
• Add experimental toBlob(document) and toBytes(document) output helpers under pdfkit/output
• Accept already-parsed fontkit Font instances in doc.font() and registerFont
• Load the PDF/A ICC profile from disk only when needed in Node, while continuing to bundle it in browser builds
• Add tools to convert raw AFM standard-font definitions into parsed or compact runtime JavaScript modules
• [BREAKING CHANGE] Use generated standard-font data instead of parsing raw AFM definitions at runtime. Node loads font metrics lazily; browser applications must import each font they use from pdfkit/standard-fonts/* and register it with registerStdFonts()
• [BREAKING CHANGE] Restrict AcroForm options to documented mappings and explicit escape hatches.
• [BREAKING CHANGE] Stop automatically uppercasing annotation option keys.
• [BREAKING CHANGE] Throw from addNamedEmbeddedFile when no ref is given, instead of writing an unparseable undefined token into the /EmbeddedFiles name tree
• Do not mutate options passed to doc.annotate() and its convenience methods (link, note, strike, lineAnnotation, rectAnnotation, ellipseAnnotation, textAnnotation, fileAnnotation)
• Persist font options when adding a new page. Fixes #1739
• Use Uint8Array instead of Node's Buffer internally
• Fix date text field formatting emitting invalid JavaScript, so the format was never applied. Fixes #1546
• Fix indentAllLines applying the indent again on every paragraph and every page break, and keep it applied across continued text. Fixes #1606
• Fix a hole in a sparse array being skipped entirely, which shifted every later entry down one
• Encrypt strings inside name trees. Fixes #1513

[v0.19.1] - 2026-06-10

• Fix RGB JPEG embedded as DeviceGray (0.19.0 regression) (#1734)

[v0.19.0] - 2026-06-07

• Bump node version requirement to 20+
• Bump minimum supported browsers to Firefox 115, iOS/Safari 16
• Fix text with input x as null
• Add opacity option to doc.image() to control image transparency
• Fix corrupted PDF when mixing standard and embedded fonts that share postscript name
• Fix PDF/UA compliance issues in kitchen-sink-accessible example
• Add bbox and placement options to PDFStructureElement for PDF/UA compliance
• Extend roundedRect with borderRadius as number for all corners or per-corner array (CSS order)
• Fix accessibility: scope in TH element
• Fix PDF Name escaping for spot colors with spaces (#1644)

[v0.18.0] - 2026-03-14

• Fix garbled text copying in Chrome/Edge for PDFs with >256 unique characters (#1659)
• Fix Link accessibility issues
• Fix Table Accessibility Issue: Operator CS/cs not allowed in this current state
• Fix Interlaced PNG with indexed transparency rendered incorrectly
• Fix SVG path parser incorrectly handle arc flags without separators
• Add pageLayout option to control how pages are displayed in PDF viewers

... (truncated)

Commits

• f048bdd v0.20.1
• 910c86a Add Node ESM build: route the node import condition to a real Node bundle (#1...
• 34f6da0 v0.20.0
• 71690eb Add afm font handling changelog entry
• 255fc6d Export PDFDocument and helpers as named exports
• 0f92500 Import @​noble/hashes without extension (avoid duplicate identifiers in build ...
• cd4e882 Make generate website docs portable (remove magick dependency)
• d24b383 Update babel
• f0863a6 Accept pre-parsed fontkit Font instances in doc.font() (#1776)
• f79e551 Fix CI after dev dependency update (#1777)
• Additional commits viewable in compare view

Updates @types/pdfkit from 0.13.9 to 0.17.6

Commits

• See full diff in compare view

Updates @types/redis from 4.0.10 to 4.0.11

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Labels

The following labels could not be found: dependencies, npm. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.