chore(deps): update dependency pdfjs-dist to v4 [security] #67
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.16.105
->4.2.67
GitHub Vulnerability Alerts
CVE-2024-4367
Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with
isEvalSupported
set totrue
(which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.Patches
The patch removes the use of
eval
:https://github.com/mozilla/pdf.js/pull/18015
Workarounds
Set the option
isEvalSupported
tofalse
.References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Release Notes
mozilla/pdf.js (pdfjs-dist)
v4.2.67
Compare Source
This release includes a new JPX decoder, based on OpenJPEG, which improves JPX image rendering performance and correctness. Moreover, this release contains improvements for the annotation editor, font conversion and the viewer.
Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in https://github.com/mozilla/pdf.js/issues/17561.
Changes since v4.1.392
pdfjs.config
by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17924mkdirp
dependency in favor of the built-in Node.jsfs.mkdirSync
by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17935rimraf
dependency in favor of the built-in Node.jsfs.rmSync
in the test folder by @timvandermeij in https://github.com/mozilla/pdf.js/pull/179384.2
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17949JpxImage
API issues (PR 17946 follow-up) by @timvandermeij in https://github.com/mozilla/pdf.js/pull/179511890535
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17914waitForTimeout
usage from the helper functions by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17966signal
in the viewer by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17964JpxImage.parseImageProperties
to support TypedArray data in IMAGE_DECODERS builds by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17977signal
-support in theEventBus
, and utilize it in the viewer (PR 17964 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17967waitForTimeout
usage from the annotation integration tests by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17969DataCloneError
(issue 17981) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17984CompiledFont.getPathJs
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/18018SimpleLinkService
to extendPDFLinkService
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/18013v4.1.392
Compare Source
This release features improvements, bugfixes and optimizations for accessibility, annotation rendering, annotation editing, font rendering, form handling, image rendering, text selection and the viewer.
Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in #17561.
Changes since v4.0.379
pdfjs.config
by @timvandermeij in https://github.com/mozilla/pdf.js/pull/174741872721
) by @calixteman in https://github.com/mozilla/pdf.js/pull/174751869001
) by @calixteman in https://github.com/mozilla/pdf.js/pull/174761871353
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17458workerPort
/workerSrc
options by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17504npm install
on MacOS by @nicolo-ribaudo in https://github.com/mozilla/pdf.js/pull/174904.1
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17507gulp-cli
to 2.3.0 and explicitly add it as a dependency by @nicolo-ribaudo in https://github.com/mozilla/pdf.js/pull/17489PDFViewer
(PR 14388 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17508web/locale/
folder from linting (PR 17525 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175291856218
) by @calixteman in https://github.com/mozilla/pdf.js/pull/175061875357
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17534isArrayBuffer
helper function by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17537git blame
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175461869767
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17543async
code when loading fonts in thePartialEvaluator
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17553test.mjs
child process exit codes in the Gulpfile by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17555EvaluatorPreprocessor.opMap
has a null-prototype (issue 17554) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175561669097
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17558async
code in thePartialEvaluator
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175621876096
) by @calixteman in https://github.com/mozilla/pdf.js/pull/175681875547
) by @calixteman in https://github.com/mozilla/pdf.js/pull/175741876564
) by @calixteman in https://github.com/mozilla/pdf.js/pull/175801876588
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17581DefaultExternalServices
into a regular class, without static methods by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17588should compress and save text
unit-test (issue 17399) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17591fileInput
DOM-element dynamically by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17592debuggerSrc
-parameter into theAppOptions
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17593GenericL10n
works if the locale files cannot be loaded by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17603ExternalServices
-instance lazily in the viewer (PR 17588 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17604l10n
-folder (issue 17609, PR 17603 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17610PDFDataTransportStream
constructor by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176201879107
) by @calixteman in https://github.com/mozilla/pdf.js/pull/176381879102
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17639require
statements from the build system by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176341879113
) by @calixteman in https://github.com/mozilla/pdf.js/pull/176433f81070
by @calixteman in https://github.com/mozilla/pdf.js/pull/17645PDFViewerApplication
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17646no-new-symbol
andrequire-yield
ESLint rules by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176581877426
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17650enableStampEditor
preference" (bug1879588
) by @calixteman in https://github.com/mozilla/pdf.js/pull/176511879108
) by @calixteman in https://github.com/mozilla/pdf.js/pull/176621879281
) by @calixteman in https://github.com/mozilla/pdf.js/pull/176641878916
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17636__non_webpack_import__
re-writing into the Babel plugin by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17637PDFViewerApplication.findBar
safely in more spots (PR 15831 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17676beginMarkedContentProps
operator when optional content parsing fails (issue 17679) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17680PDFPrintServiceFactory.createPrintService
to take a parameter object by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17667tweakWebpackOutput
usage in the gulpfile (PR 17637 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17678parseMinified
handling slightly in the gulpfile by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176811868759
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177021867739
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177081881692
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17719hexNumbers
Array, used byUtil.makeHexColor
, is built by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177181881802
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177201866437
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17737HighlightEditor.#telemetryType
getter at its only call-site (PR 17748 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177501881684
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177551882248
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177561881219
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17757XMLHttpRequest
-branch in thefetchData
helper function (PR 17277 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177101883394
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177681832519
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177711883632
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177751883609
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177761867740
) by @calixteman in https://github.com/mozilla/pdf.js/pull/177781881743
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17788Usage
dicts (issue 5764, bug1826783
) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17726dist-pre
target (PR 17681 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177171867742
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17732fs/promises
in the Node.js-specific code in thesrc/
-folder by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17714AppOptions
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176941881746
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17790alias
-building out of thecreateWebpackConfig
function by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176911886427
) by @calixteman in https://github.com/mozilla/pdf.js/pull/178141886586
) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17818PDFViewerApplication.initPassiveLoading
and directly invoke theopen
-method from the extension-specific code by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178131886964
) by @calixteman in https://github.com/mozilla/pdf.js/pull/178251886959
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17823Path2D
polyfill for Node.js environments by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17830BasePreferences
class by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17842addWindowResolutionChange
listener unconditionally (PR 17767 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178651888657
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17855compatibilityParams
handling to the GENERIC viewer by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17861PromiseCapability
withPromise.withResolvers()
by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178541889623
) by @calixteman in https://github.com/mozilla/pdf.js/pull/17885Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.