security fix for pdfkit (app did not appear to be vulnerable, but updating anyway)  [ci skip]