npm / pdfkit
pdfkit
What changed in pdfkit 0.20, from its official release notes, upgrade guides and advisories. Also covers @types/pdfkit. Sources checked 2026-10-19.
6 breaking1 security7 new APIs and options8 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpdfkit 0.2022 changes
Breaking changes 6
In Node, importing pdfkit now resolves to a Node ESM build with the real file system, native zlib, Node streams, and self-registering standard fonts instead of the browser bundle.
AcroForm options are restricted to documented mappings and explicit escape hatches.
Throws when no ref is given instead of writing an unparseable undefined token into the /EmbeddedFiles name tree.
Annotation option keys are no longer automatically uppercased.
Browser applications must import each standard font they use and register it with registerStdFonts(); Node continues to load font metrics lazily.
The virtual file system was removed. Register in-memory data with registerFile, pass binary data directly to registerFont, image, or file, or pass data URLs to image and file.
Security 1
Strings inside name trees are now encrypted.
New APIs and options 7
doc.font() now accepts already-parsed fontkit Font instances.
LineWrapper is now available as a named export from the main Node and browser entry points.
PDFDocument is now available as a named export from the main Node and browser entry points; the default export is preserved.
Register in-memory files globally in Node and browsers, optionally with birthtime and ctime metadata; passing undefined as data unregisters the path.
registerFont now accepts already-parsed fontkit Font instances.
An experimental helper under pdfkit/output returns a Promise resolving to a Blob containing the document output.
An experimental helper under pdfkit/output returns a Promise resolving to a contiguous Uint8Array containing the document output.
Fixes and other changes 8
Calling doc.file() twice with the same in-memory attachment under one name no longer throws when deduplication checks dates that are absent for sources not read from disk.
doc.text() no longer throws
unsupported number: NaNwhen lineBreak is false and underline, strike, link or goTo is used.The mapping now resolves to a single file under all conditions, preventing bundlers and file tracers from packing ESM font metrics that cause runtime module-not-found errors.
Fixes invalid JavaScript emitted by date text field formatting, which prevented the format from being applied.
doc.annotate() and its convenience methods no longer mutate the options passed to them.
Fixes repeated indentation across paragraphs and page breaks, and keeps the indent applied across continued text.
Font options are now persisted when adding a new page.
Fixes skipped holes in sparse arrays that shifted every later entry down one.