fix(deps): update dependency pdfmake to v0.3.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pdfmake (source)	0.3.3 → 0.3.6

GitHub Vulnerability Alerts

CVE-2026-26801

Server-Side Request Forgery (SSRF) vulnerability in pdfmake versions 0.3.0-beta.2 through 0.3.5 allows a remote attacker to obtain sensitive information via the src/URLResolver.js component. The fix was released in version 0.3.6 which introduces the setUrlAccessPolicy() method allowing server operators to define URL access rules. A warning is now logged when pdfmake is used server-side without a policy configured.

---

Release Notes

bpampuch/pdfmake (pdfmake)

v0.3.6

Compare Source

• Added setUrlAccessPolicy() for defining a custom access policy for external URLs before download
  (addresses a potential server vulnerability CVE-2026-26801)

  Example:

  pdfmake.setUrlAccessPolicy((url) => {
  	// check allowed domain
  	return url.startsWith("https://example.com/");
  });

  For details see documentation

• Added validation for image height and width values

v0.3.5

Compare Source

• Added snakingColumns property for columns to enable newspaper-like column flow
• Added outlines / bookmarks for text node
  • outline - set to true for add to bookmarks
  • outlineText (optional) - set custom bookmark text, otherwise text from node
  • outlineExpanded (optional) - set to true for expanded/opened bookmark
  • outlineParentId (optional) - parent bookmark id
• Added property outlines for ToC, which adds all items to outlines / bookmarks (any existing outline settings on texts are respected)

v0.3.4

Compare Source

• Added vertical alignment for table cells via verticalAlignment property, values: top (default), middle, bottom
• Fixed margin inheritance when styles are extended multiple times

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.