Build1 distinct publisher2 min readPublished
The fourteen standard PDF fonts are Windows-1252 underneath, so a Polish company name throws an encoder error, and the one-line regex that stops the crash ships a valid invoice with the letters quietly gone.
The Engineer · Build desk

Compiled by The EngineerSomething wrong?How this is made
The strip is a range test, and the range is not WinAnsi's. `[^\x20-\xFF]` removes every code point above U+00FF [8]. The character that started this, Ł, is U+0141, so it goes [7]. The euro sign at U+20AC and the curly quotes at U+2018 and above also go, and WinAnsi encodes all of those without complaint [6][1]. So one regex deletes two disjoint sets: characters the standard font genuinely cannot draw, and characters it can. It is doing more work than it was asked to do.
Nothing downstream sees either deletion. The file is a valid PDF, no exception is raised, and the logs stay clean [9]. A generator suite asserts on the input string and on the absence of a throw, and neither of those changes when a letter vanishes between `drawText` and the page. pdf-lib's own error was the useful artifact here, naming both the character and its hex code point [7]. Trading it for a green test run swaps a stack trace for a document defect. The author of the write-up is blunt about the only check that catches it: render a page with non-Latin-1 text in it and look at it with your eyes [9].
The figures most likely to be copied out of this are the font sizes, so it is worth saying what they rest on. One unsubsetted Archivo weight is about 180 KB, which is why three weights add roughly half a megabyte to every document generated [12][2]. With `subset: true`, the same three weights inside the author's four-page invoice land at 35 KB, because only the glyphs actually drawn get embedded [13]. Call it fifteen times smaller [2]. That ratio transfers to documents that draw a comparable glyph set and no further. Subset size follows distinct glyphs used, so a customer base heavy on diacritics will not compress like one Polish name in an English template, and caching the font files in a module-level variable shortens the read on warm invocations rather than the subset [14].
With a rasteriser already pointed at the output, two layout defects turned up that reading the code would not have surfaced [18]. The totals block right-aligned its figure at 20pt Black in a column sized for four digits: $2,160.00 fit, and 86,832.81 PLN ran back over the words TOTAL DUE [19]. That is the same failure class as the missing letter, and the same instrument catches both, which is the argument for keeping a rendered-page check inside the pipeline instead of waiting for it to arrive as a bug report.
Ranked by verification strength, evidence, and original report placement.
The author generates invoices in a Node serverless function using pdf-lib.
A client company name, Lodz Sp. z o.o. written as Łódź Sp. z o.o., was rendered on the invoice as "ód Sp. z o.o."; nothing was thrown, nothing was logged, and the PDF opened perfectly.
PDF has fourteen fonts every reader is guaranteed to have, usable without embedding anything, and pdf-lib exposes them as StandardFonts.
The standard fonts are encoded as WinAnsi, roughly Windows-1252, and their glyph set covers Western European Latin and nothing else.
Ł and ź are not in the WinAnsi glyph set, and the boundary is narrower than people assume.
The euro sign and curly quotes are inside the WinAnsi set and are safe to draw with a standard font.
Distinct publishers with included, body-backed reporting in this cluster.
dev.to
1 article · August 30, 2026
Follow any of these and your For You feed starts watching them — no settings page required.
build
A JSON parser benchmark that scores refusal as a pass, and why the column order flips1 distinct publisher
build
A key in the app binary is a bucket handover; presigned uploads also drop the proxy data bill1 distinct publisher
build
A GAN beauty filter is a device budget allocation, not a feature toggle1 distinct publisher
build
Every viewer hits your HLS key endpoint in the same second, and almost nobody tests it1 distinct publisher
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
One author, but checkable in ten minutes
The parts that carry weight — the standard fourteen being WinAnsi, the encoder refusing Ł with a quotable error, the regex that deletes what the encoder refused — are things a reader can confirm at a terminal, which is why a single unreviewed post scores respectably. What nobody has checked is the specific record: the Łódź invoice, the 180 KB weights, the 35 KB output and the six-figure overlap are all one developer's numbers from one pipeline, presented with code but no artifact.
One self-reported production pipeline
The only real-world footprint on the record is the author's own invoicing product, where he says he found all of this. No other team, incident, bug report or usage figure appears, and pdf-lib's install base — the thing that would make this widespread rather than anecdotal — is asserted only implicitly by the claim that it "will hit anyone generating documents from user-supplied text".
The library is blamed for the author's regex
"pdf-lib is silently deleting characters from your users' data" is the one sentence the post's own evidence contradicts: pdf-lib threw loudly, and the silence was purchased by a one-line strip the author shipped and now calls a mistake. He concedes as much — the error is "correct and helpful" — so the overstatement lives in the framing rather than the findings, and the technical substance underneath is if anything undersold.
Ends at the author's own product
The post closes on HourToBill, and dev.to publishes what its members submit, so a product pitch and a technical claim travel together with nothing in between. The pull is moderate rather than severe: the advice recommends a free OFL font and a Python one-liner, names no paid tool, and would be embarrassing if wrong — credibility, not conversion, is what the author is spending. Still, the sharpest framing in the piece points at a widely used open-source library rather than at his own patch.
Solid mechanism, unverified anecdote
Confidence rests on the difference between the two halves. The failure chain is well specified and reproducible, so the engineering guidance stands on its own; the incident report, the measurements and the claim of generality all come from one interested party with no corroboration, and the headline's aim is demonstrably off. Enough to act on if you generate documents from typed input, not enough to cite as a measured account of how often this happens.