build(deps): bump @embedpdf/pdfium from 2.14.2 to 2.14.4 in /web/vendor

[dependabot]

Bumps @embedpdf/pdfium from 2.14.2 to 2.14.4.

Release notes

Sourced from @​embedpdf/pdfium's releases.

Release v2.14.4

@​embedpdf/engines@​2.14.4

Patch Changes

• #658 by @​bobsingor – Fix incorrect annotation positions for PDFs with a non-zero MediaBox/CropBox origin (e.g. CAD/technical drawing exports). The engine now reads each page's box origin at open time and applies it in both the PDF-to-CSS and CSS-to-PDF coordinate conversions, so annotations render and round-trip at the position shown by native PDF viewers.

• #662 by @​bobsingor – Fix fontFallback: null not disabling the default jsDelivr CDN font fallback. The snippet previously stripped null with a truthy filter before it reached the worker, so the worker fell back to the CDN config. The value is now forwarded correctly (preserving null while still omitting an unset option), and the fontFallback type is widened to FontFallbackConfig | null across the engine hooks/options so the documented airgapped opt-out is type-correct end to end.

@​embedpdf/models@​2.14.4

Patch Changes

• #658 by @​bobsingor – Add the PdfPageBoxes interface and an optional boxes field on PdfPageObject, exposing each page's Media/Crop (always present) and optional Bleed/Trim/Art boxes in unrotated PDF user space.

@​embedpdf/pdfium@​2.14.4

Patch Changes

• #658 by @​bobsingor – Add EPDF_GetPageBoxByIndex API (with the EPDF_PAGE_BOX_TYPE enum) to read a page's Media/Crop/Bleed/Trim/Art box without loading or parsing the page. MediaBox is resolved through page-tree inheritance (falling back to the default page size), CropBox falls back to MediaBox, and Bleed/Trim/Art return false when absent.

@​embedpdf/plugin-ui@​2.14.4

Patch Changes

• #663 by @​bobsingor – Overlays now participate in the category visibility system. The schema analyzer collects overlay categories (and visibilityDependsOn), so category visibility CSS is generated for them and they can be hidden via disabledCategories like any other UI item.

@​embedpdf/snippet@​2.14.4

Patch Changes

• #662 by @​bobsingor – Fix fontFallback: null not disabling the default jsDelivr CDN font fallback. The snippet previously stripped null with a truthy filter before it reached the worker, so the worker fell back to the CDN config. The value is now forwarded correctly (preserving null while still omitting an unset option), and the fontFallback type is widened to FontFallbackConfig | null across the engine hooks/options so the documented airgapped opt-out is type-correct end to end.

• #663 by @​bobsingor – Allow hiding the UnlockOwnerOverlay (the read-only notice shown on encrypted, permission-restricted PDFs) via disabledCategories. The overlay renderer now emits the data-epdf-cat attribute, and the unlock-owner-overlay overlay carries the new security / security-unlock-overlay categories, so viewer-only integrations can remove it with disabledCategories: ['security-unlock-overlay'] (or the parent security).

• #661 by @​bobsingor – Fix UI actions that relied on native HTML form submission failing inside sandboxed iframes without the allow-forms permission. The comment input, zoom percentage input, and link modal now trigger their handlers via explicit button clicks and Enter keydown instead of form submission, so they work in sandboxed contexts while behaving identically everywhere else.

• #660 by @​bobsingor – Fix the "Shapes" mode tab and its overflow-menu entry staying visible when annotation-shape is added to disabledCategories. The shapes mode entries now carry the annotation-shape category (matching the convention used by the insert/form/redact modes), so disabling that category hides the tab and disables the mode:shapes command alongside the already-hidden shape tools.

@​embedpdf/core@​2.14.4

@​embedpdf/plugin-annotation@​2.14.4

@​embedpdf/plugin-attachment@​2.14.4

@​embedpdf/plugin-bookmark@​2.14.4

@​embedpdf/plugin-capture@​2.14.4

@​embedpdf/plugin-commands@​2.14.4

... (truncated)

Changelog

Sourced from @​embedpdf/pdfium's changelog.

2.14.4

Patch Changes

• #658 by @​bobsingor – Add EPDF_GetPageBoxByIndex API (with the EPDF_PAGE_BOX_TYPE enum) to read a page's Media/Crop/Bleed/Trim/Art box without loading or parsing the page. MediaBox is resolved through page-tree inheritance (falling back to the default page size), CropBox falls back to MediaBox, and Bleed/Trim/Art return false when absent.

2.14.3

Patch Changes

• #638 by @​bobsingor – Fix callout FreeText annotations rendering with a black background when the fill color is transparent.

  In GenerateFreeTextAP's callout branch, the text-box rectangle was painted unconditionally with operator B (fill + stroke). When /C was absent, no fill colour was emitted, so B fell back to PDF's default black fill. Now the fill defaults to transparent via GetColorStringWithDefault and the paint operator is picked dynamically with GetPaintOperatorString, mirroring GenerateCircleAP / GenerateSquareAP.

• #640 by @​bobsingor – Fix page layout shifting after editing PDFs whose /Contents is a split-stream array (e.g. after redaction).

  PDF renders /Contents as one continuous program, so graphics state set in one stream carries into the next. The previous behaviour rewrote only the dirty streams while keeping the original split boundaries, which could corrupt the graphics-state handoff between streams and shift the visible layout. CPDF_PageContentGenerator::GenerateContent now collapses all active page objects into a single canonical content stream when the page has been edited, via GenerateCanonicalPageStream + CPDF_PageContentManager::ReplaceWithSingleStream. Form XObjects keep their existing single-stream behaviour.

Commits

• f4dc27d chore: version packages
• 5f96cf2 Read page boxes to fix annotation positions
• 7799a2b chore: version packages
• 146cde1 Update pdfium-src
• 70306b1 Collapse split page content into single stream
• 226e671 Fix callout FreeText transparent background
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)