Update dependency pdfjs-dist to v4 [SECURITY] #5462
Conversation
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
renovate
bot
added
dependencies
renovate
bot
force-pushed
the
renovate/npm-pdfjs-dist-vulnerability
branch
from
54915d4 to
6185ae1
Compare
|
This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged. |
renovate
bot
force-pushed
the
renovate/npm-pdfjs-dist-vulnerability
branch
from
6185ae1 to
cec9fe3
Compare
|
renovate
bot
force-pushed
the
renovate/npm-pdfjs-dist-vulnerability
branch
from
cec9fe3 to
2f74e98
Compare
thornbill
force-pushed
the
renovate/npm-pdfjs-dist-vulnerability
branch
from
2f74e98 to
0bff493
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
|
| @@ -3,7 +3,8 @@ | |||
| "modules": "false", | |||
| "files": "./dist/**/*.js", | |||
| "not": [ | |||
| "./dist/libraries/pdf.worker.js", | |||
| "./dist/libraries/pdf.worker.mjs", | |||
| "./dist/node_modules.pdfjs-dist.*", | |||
There was a problem hiding this comment.
This file includes dynamic imports that are only used in nodejs environments, so it should be safe to ignore.
| // Disable for PDF.js XSS vulnerability | ||
| // https://github.com/mozilla/pdf.js/security/advisories/GHSA-wgrm-67xf-hhpq | ||
| isEvalSupported: false | ||
| url: downloadHref |
There was a problem hiding this comment.
This workaround is no longer required.
| @@ -205,6 +208,7 @@ const config = { | |||
| path.resolve(__dirname, 'node_modules/markdown-it'), | |||
| path.resolve(__dirname, 'node_modules/material-react-table'), | |||
| path.resolve(__dirname, 'node_modules/mdurl'), | |||
| path.resolve(__dirname, 'node_modules/pdfjs-dist'), | |||
There was a problem hiding this comment.
I didn't notice any issues moving this back into our standard babel build, but is there anything specific that needs tested here @dmitrylyzo?
There was a problem hiding this comment.
Tbh, I don't remember. 😅
Maybe it's specific to that version of pdfjs?
At the moment, webOS 1.2 fails with SyntaxError: Use of reserved word 'import' (also tried it in the extra babel list).
case 2:
_context5.next = 4;
return import(/*webpackIgnore: true*/_this37.workerSrc);
case 4:I'm using source-map in webpack.dev.conf, so it doesn't produce eval, which doesn't work in webOS 1.2.
Anyway, pdf.worker doesn't work because of ES6 features.
But it looks like pdfjs has some legacy variant (legacy/ folder).
No, that doesn't work either because of import. 😕
Cloudflare Pages deployment
|
|
This pull request has merge conflicts. Please resolve the conflicts so the PR can be successfully reviewed and merged. |
This PR contains the following updates:
3.11.174->4.2.67GitHub Vulnerability Alerts
CVE-2024-4367
Impact
If pdf.js is used to load a malicious PDF, and PDF.js is configured with
isEvalSupportedset totrue(which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.Patches
The patch removes the use of
eval:https://github.com/mozilla/pdf.js/pull/18015
Workarounds
Set the option
isEvalSupportedtofalse.References
https://bugzilla.mozilla.org/show_bug.cgi?id=1893645
Release Notes
mozilla/pdf.js (pdfjs-dist)
v4.2.67Compare Source
This release includes a new JPX decoder, based on OpenJPEG, which improves JPX image rendering performance and correctness. Moreover, this release contains improvements for the annotation editor, font conversion and the viewer.
Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in https://github.com/mozilla/pdf.js/issues/17561.
Changes since v4.1.392
pdfjs.configby @timvandermeij in https://github.com/mozilla/pdf.js/pull/17924mkdirpdependency in favor of the built-in Node.jsfs.mkdirSyncby @timvandermeij in https://github.com/mozilla/pdf.js/pull/17935rimrafdependency in favor of the built-in Node.jsfs.rmSyncin the test folder by @timvandermeij in https://github.com/mozilla/pdf.js/pull/179384.2by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17949JpxImageAPI issues (PR 17946 follow-up) by @timvandermeij in https://github.com/mozilla/pdf.js/pull/179511890535) by @calixteman in https://github.com/mozilla/pdf.js/pull/17914waitForTimeoutusage from the helper functions by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17966signalin the viewer by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17964JpxImage.parseImagePropertiesto support TypedArray data in IMAGE_DECODERS builds by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17977signal-support in theEventBus, and utilize it in the viewer (PR 17964 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17967waitForTimeoutusage from the annotation integration tests by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17969DataCloneError(issue 17981) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17984CompiledFont.getPathJsby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/18018SimpleLinkServiceto extendPDFLinkServiceby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/18013v4.1.392Compare Source
This release features improvements, bugfixes and optimizations for accessibility, annotation rendering, annotation editing, font rendering, form handling, image rendering, text selection and the viewer.
Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in #17561.
Changes since v4.0.379
pdfjs.configby @timvandermeij in https://github.com/mozilla/pdf.js/pull/174741872721) by @calixteman in https://github.com/mozilla/pdf.js/pull/174751869001) by @calixteman in https://github.com/mozilla/pdf.js/pull/174761871353) by @calixteman in https://github.com/mozilla/pdf.js/pull/17458workerPort/workerSrcoptions by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17504npm installon MacOS by @nicolo-ribaudo in https://github.com/mozilla/pdf.js/pull/174904.1by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17507gulp-clito 2.3.0 and explicitly add it as a dependency by @nicolo-ribaudo in https://github.com/mozilla/pdf.js/pull/17489PDFViewer(PR 14388 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17508web/locale/folder from linting (PR 17525 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175291856218) by @calixteman in https://github.com/mozilla/pdf.js/pull/175061875357) by @calixteman in https://github.com/mozilla/pdf.js/pull/17534isArrayBufferhelper function by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17537git blameby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175461869767) by @calixteman in https://github.com/mozilla/pdf.js/pull/17543asynccode when loading fonts in thePartialEvaluatorby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17553test.mjschild process exit codes in the Gulpfile by @timvandermeij in https://github.com/mozilla/pdf.js/pull/17555EvaluatorPreprocessor.opMaphas a null-prototype (issue 17554) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175561669097) by @calixteman in https://github.com/mozilla/pdf.js/pull/17558asynccode in thePartialEvaluatorby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/175621876096) by @calixteman in https://github.com/mozilla/pdf.js/pull/175681875547) by @calixteman in https://github.com/mozilla/pdf.js/pull/175741876564) by @calixteman in https://github.com/mozilla/pdf.js/pull/175801876588) by @calixteman in https://github.com/mozilla/pdf.js/pull/17581DefaultExternalServicesinto a regular class, without static methods by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17588should compress and save textunit-test (issue 17399) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17591fileInputDOM-element dynamically by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17592debuggerSrc-parameter into theAppOptionsby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17593GenericL10nworks if the locale files cannot be loaded by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17603ExternalServices-instance lazily in the viewer (PR 17588 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17604l10n-folder (issue 17609, PR 17603 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17610PDFDataTransportStreamconstructor by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176201879107) by @calixteman in https://github.com/mozilla/pdf.js/pull/176381879102) by @calixteman in https://github.com/mozilla/pdf.js/pull/17639requirestatements from the build system by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176341879113) by @calixteman in https://github.com/mozilla/pdf.js/pull/176433f81070by @calixteman in https://github.com/mozilla/pdf.js/pull/17645PDFViewerApplicationby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17646no-new-symbolandrequire-yieldESLint rules by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176581877426) by @calixteman in https://github.com/mozilla/pdf.js/pull/17650enableStampEditorpreference" (bug1879588) by @calixteman in https://github.com/mozilla/pdf.js/pull/176511879108) by @calixteman in https://github.com/mozilla/pdf.js/pull/176621879281) by @calixteman in https://github.com/mozilla/pdf.js/pull/176641878916) by @calixteman in https://github.com/mozilla/pdf.js/pull/17636__non_webpack_import__re-writing into the Babel plugin by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17637PDFViewerApplication.findBarsafely in more spots (PR 15831 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17676beginMarkedContentPropsoperator when optional content parsing fails (issue 17679) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17680PDFPrintServiceFactory.createPrintServiceto take a parameter object by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17667tweakWebpackOutputusage in the gulpfile (PR 17637 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17678parseMinifiedhandling slightly in the gulpfile by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176811868759) by @calixteman in https://github.com/mozilla/pdf.js/pull/177021867739) by @calixteman in https://github.com/mozilla/pdf.js/pull/177081881692) by @calixteman in https://github.com/mozilla/pdf.js/pull/17719hexNumbersArray, used byUtil.makeHexColor, is built by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177181881802) by @calixteman in https://github.com/mozilla/pdf.js/pull/177201866437) by @calixteman in https://github.com/mozilla/pdf.js/pull/17737HighlightEditor.#telemetryTypegetter at its only call-site (PR 17748 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177501881684) by @calixteman in https://github.com/mozilla/pdf.js/pull/177551882248) by @calixteman in https://github.com/mozilla/pdf.js/pull/177561881219) by @calixteman in https://github.com/mozilla/pdf.js/pull/17757XMLHttpRequest-branch in thefetchDatahelper function (PR 17277 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177101883394) by @calixteman in https://github.com/mozilla/pdf.js/pull/177681832519) by @calixteman in https://github.com/mozilla/pdf.js/pull/177711883632) by @calixteman in https://github.com/mozilla/pdf.js/pull/177751883609) by @calixteman in https://github.com/mozilla/pdf.js/pull/177761867740) by @calixteman in https://github.com/mozilla/pdf.js/pull/177781881743) by @calixteman in https://github.com/mozilla/pdf.js/pull/17788Usagedicts (issue 5764, bug1826783) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17726dist-pretarget (PR 17681 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/177171867742) by @calixteman in https://github.com/mozilla/pdf.js/pull/17732fs/promisesin the Node.js-specific code in thesrc/-folder by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17714AppOptionsby @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176941881746) by @calixteman in https://github.com/mozilla/pdf.js/pull/17790alias-building out of thecreateWebpackConfigfunction by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/176911886427) by @calixteman in https://github.com/mozilla/pdf.js/pull/178141886586) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17818PDFViewerApplication.initPassiveLoadingand directly invoke theopen-method from the extension-specific code by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178131886964) by @calixteman in https://github.com/mozilla/pdf.js/pull/178251886959) by @calixteman in https://github.com/mozilla/pdf.js/pull/17823Path2Dpolyfill for Node.js environments by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17830BasePreferencesclass by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17842addWindowResolutionChangelistener unconditionally (PR 17767 follow-up) by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178651888657) by @calixteman in https://github.com/mozilla/pdf.js/pull/17855compatibilityParamshandling to the GENERIC viewer by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/17861PromiseCapabilitywithPromise.withResolvers()by @Snuffleupagus in https://github.com/mozilla/pdf.js/pull/178541889623) by @calixteman in https://github.com/mozilla/pdf.js/pull/17885Configuration
📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.