Update dependency pdfjs-dist to v4 [SECURITY] #272
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.7.570->4.2.67GitHub Vulnerability Alerts
CVE-2024-4367
Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with
isEvalSupportedset totrue(which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.Patches
The patch removes the use of
eval:https://github.com/mozilla/pdf.js/pull/18015
Workarounds
Set the option
isEvalSupportedtofalse.References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Release Notes
mozilla/pdf.js (pdfjs-dist)
v4.2.67Compare Source
This release includes a new JPX decoder, based on OpenJPEG, which improves JPX image rendering performance and correctness. Moreover, this release contains improvements for the annotation editor, font conversion and the viewer.
Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in https://github.com/mozilla/pdf.js/issues/17561.
Changes since v4.1.392
pdfjs.configby @timvandermeij in https://github.com/mozilla/pdf.js/pull/17924mkdirpdependency in favor of the built-in Node.jsfs.mkdirSyncby @timvandermeij in https://github.com/mozilla/pdf.js/pull/17935rimrafdependency in favor of the built-in Node.jsfs.rmSyncin the test folder by @timvandermeij in https://github.com/mozilla/pdf.js/pull/179384.2by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17949JpxImageAPI issues (PR 17946 follow-up) by @timvandermeij in https://github.com/mozilla/pdf.js/pull/179511890535) by @calixteman in https://github.com/mozilla/pdf.js/pull/17914waitForTimeoutusage from the helper functions by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17966signalin the viewer by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17964JpxImage.parseImagePropertiesto support TypedArray data in IMAGE_DECODERS builds by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17977signal-support in theEventBus, and utilize it in the viewer (PR 17964 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17967waitForTimeoutusage from the annotation integration tests by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17969DataCloneError(issue 17981) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17984CompiledFont.getPathJsby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/18018SimpleLinkServiceto extendPDFLinkServiceby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/18013v4.1.392Compare Source
This release features improvements, bugfixes and optimizations for accessibility, annotation rendering, annotation editing, font rendering, form handling, image rendering, text selection and the viewer.
Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in #17561.
Changes since v4.0.379
pdfjs.configby @timvandermeij in https://github.com/mozilla/pdf.js/pull/174741872721) by @calixteman in https://github.com/mozilla/pdf.js/pull/174751869001) by @calixteman in https://github.com/mozilla/pdf.js/pull/174761871353) by @calixteman in https://github.com/mozilla/pdf.js/pull/17458workerPort/workerSrcoptions by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17504npm installon MacOS by @nicolo-ribaudo in https://github.com/mozilla/pdf.js/pull/174904.1by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17507gulp-clito 2.3.0 and explicitly add it as a dependency by @nicolo-ribaudo in https://github.com/mozilla/pdf.js/pull/17489PDFViewer(PR 14388 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17508web/locale/folder from linting (PR 17525 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175291856218) by @calixteman in https://github.com/mozilla/pdf.js/pull/175061875357) by @calixteman in https://github.com/mozilla/pdf.js/pull/17534isArrayBufferhelper function by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17537git blameby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175461869767) by @calixteman in https://github.com/mozilla/pdf.js/pull/17543asynccode when loading fonts in thePartialEvaluatorby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17553test.mjschild process exit codes in the Gulpfile by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17555EvaluatorPreprocessor.opMaphas a null-prototype (issue 17554) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175561669097) by @calixteman in https://github.com/mozilla/pdf.js/pull/17558asynccode in thePartialEvaluatorby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175621876096) by @calixteman in https://github.com/mozilla/pdf.js/pull/175681875547) by @calixteman in https://github.com/mozilla/pdf.js/pull/175741876564) by @calixteman in https://github.com/mozilla/pdf.js/pull/175801876588) by @calixteman in https://github.com/mozilla/pdf.js/pull/17581DefaultExternalServicesinto a regular class, without static methods by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17588should compress and save textunit-test (issue 17399) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17591fileInputDOM-element dynamically by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17592debuggerSrc-parameter into theAppOptionsby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17593GenericL10nworks if the locale files cannot be loaded by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17603ExternalServices-instance lazily in the viewer (PR 17588 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17604l10n-folder (issue 17609, PR 17603 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17610PDFDataTransportStreamconstructor by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176201879107) by @calixteman in https://github.com/mozilla/pdf.js/pull/176381879102) by @calixteman in https://github.com/mozilla/pdf.js/pull/17639requirestatements from the build system by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176341879113) by @calixteman in https://github.com/mozilla/pdf.js/pull/176433f81070by @calixteman in https://github.com/mozilla/pdf.js/pull/17645PDFViewerApplicationby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17646no-new-symbolandrequire-yieldESLint rules by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176581877426) by @calixteman in https://github.com/mozilla/pdf.js/pull/17650enableStampEditorpreference" (bug1879588) by @calixteman in https://github.com/mozilla/pdf.js/pull/176511879108) by @calixteman in https://github.com/mozilla/pdf.js/pull/176621879281) by @calixteman in https://github.com/mozilla/pdf.js/pull/176641878916) by @calixteman in https://github.com/mozilla/pdf.js/pull/17636__non_webpack_import__re-writing into the Babel plugin by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17637PDFViewerApplication.findBarsafely in more spots (PR 15831 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17676beginMarkedContentPropsoperator when optional content parsing fails (issue 17679) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17680PDFPrintServiceFactory.createPrintServiceto take a parameter object by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17667tweakWebpackOutputusage in the gulpfile (PR 17637 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17678parseMinifiedhandling slightly in the gulpfile by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176811868759) by @calixteman in https://github.com/mozilla/pdf.js/pull/177021867739) by @calixteman in https://github.com/mozilla/pdf.js/pull/177081881692) by @calixteman in https://github.com/mozilla/pdf.js/pull/17719hexNumbersArray, used byUtil.makeHexColor, is built by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177181881802) by @calixteman in https://github.com/mozilla/pdf.js/pull/177201866437) by @calixteman in https://github.com/mozilla/pdf.js/pull/17737HighlightEditor.#telemetryTypegetter at its only call-site (PR 17748 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177501881684) by @calixteman in https://github.com/mozilla/pdf.js/pull/177551882248) by @calixteman in https://github.com/mozilla/pdf.js/pull/177561881219) by @calixteman in https://github.com/mozilla/pdf.js/pull/17757XMLHttpRequest-branch in thefetchDatahelper function (PR 17277 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177101883394) by @calixteman in https://github.com/mozilla/pdf.js/pull/177681832519) by @calixteman in https://github.com/mozilla/pdf.js/pull/177711883632) by @calixteman in https://github.com/mozilla/pdf.js/pull/177751883609) by @calixteman in https://github.com/mozilla/pdf.js/pull/177761867740) by @calixteman in https://github.com/mozilla/pdf.js/pull/177781881743) by @calixteman in https://github.com/mozilla/pdf.js/pull/17788Usagedicts (issue 5764, bug1826783) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17726dist-pretarget (PR 17681 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177171867742) by @calixteman in https://github.com/mozilla/pdf.js/pull/17732fs/promisesin the Node.js-specific code in thesrc/-folder by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17714AppOptionsby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176941881746) by @calixteman in https://github.com/mozilla/pdf.js/pull/17790alias-building out of thecreateWebpackConfigfunction by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176911886427) by @calixteman in https://github.com/mozilla/pdf.js/pull/178141886586) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17818PDFViewerApplication.initPassiveLoadingand directly invoke theopen-method from the extension-specific code by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178131886964) by @calixteman in https://github.com/mozilla/pdf.js/pull/178251886959) by @calixteman in https://github.com/mozilla/pdf.js/pull/17823Path2Dpolyfill for Node.js environments by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17830BasePreferencesclass by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17842addWindowResolutionChangelistener unconditionally (PR 17767 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178651888657) by @calixteman in https://github.com/mozilla/pdf.js/pull/17855compatibilityParamshandling to the GENERIC viewer by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17861PromiseCapabilitywithPromise.withResolvers()by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178541889623) by @calixteman in https://github.com/mozilla/pdf.js/pull/17885Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.