For some time now, Alfresco has been shipping patched versions of Apache PDFBox, with a handful of fixes in it. This list of fixes looks fairly stable - they're almost identical on 4.1.4 for PDFBox 1.7.0 to 4.2.2 for PDFBox 1.8.2 to community head for PDFBox 1.8.4
Because PDFBox in Alfresco is a custom patched version, it makes upgrading harder, both for customers and Alfresco. With Apache Tika 1.6 due out in a few days, which needs a newer PDFBox, that'll be an issue once again. (It's an issue for anyone trying to upgrade to the release candidate to check today)
It would seem best for everyone if patches to things like Apache POI, Tika and PDFBox could be contributed upstream, to avoid the need for Alfresco patched versions in the long term. (Short term for bug fixes is one thing, a year seems another!).
(The current set of PDFBox patches are the main ones needed for this - the POI patches have already been applied upstream, but confusingly community head has 3.10 final but a patch file for the previous 3.9 changes...)