Skip to content

fix(deps): update dependency pdfjs-dist to v4 [security]#1010

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-pdfjs-dist-vulnerability
Open

fix(deps): update dependency pdfjs-dist to v4 [security]#1010
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-pdfjs-dist-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented May 7, 2024

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
pdfjs-dist (source) ^2.1.266^4.2.67 age confidence
pdfjs-dist (source) 2.12.3134.2.67 age confidence

GitHub Vulnerability Alerts

CVE-2024-4367

Impact

If pdf.js is used to load a malicious PDF, and PDF.js is configured with isEvalSupported set to true (which is the default value), unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

The patch removes the use of eval:
https://github.com/mozilla/pdf.js/pull/18015

Workarounds

Set the option isEvalSupported to false.

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1893645


Release Notes

mozilla/pdf.js (pdfjs-dist)

v4.2.67

Compare Source

This release includes a new JPX decoder, based on OpenJPEG, which improves JPX image rendering performance and correctness. Moreover, this release contains improvements for the annotation editor, font conversion and the viewer.

Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in #​17561.

Changes since v4.1.392

v4.1.392

Compare Source

This release features improvements, bugfixes and optimizations for accessibility, annotation rendering, annotation editing, font rendering, form handling, image rendering, text selection and the viewer.

Note that text selection boxes for some PDF files may overlap visually. This is a known issue that we currently track in #​17561.

Changes since v4.0.379

v4.0.379

Compare Source

This release mainly contains improvements and bugfixes for the annotation editor functionality.

Changes since v4.0.269


Configuration

📅 Schedule: (in timezone Europe/Paris)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner May 7, 2024 14:27
@renovate renovate bot added the dependencies Pull requests that update a dependency file label May 7, 2024
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 2 times, most recently from f7defb6 to 0f28a30 Compare May 23, 2024 14:35
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from 0f28a30 to c2a7cda Compare June 17, 2024 08:21
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 2 times, most recently from bac3091 to dd98cea Compare July 18, 2024 10:28
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 3 times, most recently from 5f618c9 to 829911e Compare July 26, 2024 13:55
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from 829911e to 8b6629b Compare August 6, 2024 08:10
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 2 times, most recently from 89eb1e0 to 4d90677 Compare September 17, 2024 07:26
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 2 times, most recently from 1d4b3fe to 881bd4f Compare October 9, 2024 12:53
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 3 times, most recently from 528fe28 to 418e1ba Compare October 16, 2024 20:01
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 2 times, most recently from 51677f7 to 1f98ec2 Compare October 28, 2024 19:04
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 2 times, most recently from 8245af5 to f866175 Compare December 2, 2024 14:37
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 4 times, most recently from 3e95e80 to 485c0d4 Compare December 22, 2024 18:55
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 4 times, most recently from d346589 to f3dbc5d Compare January 14, 2025 21:28
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 5 times, most recently from 7392af8 to d51006b Compare March 17, 2025 17:10
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist to v4 [security] fix(deps): update dependency pdfjs-dist [security] Mar 17, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from d51006b to d97cd41 Compare March 17, 2025 23:28
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist [security] fix(deps): update dependency pdfjs-dist to v4 [security] Mar 17, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from d97cd41 to 3caab9d Compare March 27, 2025 14:57
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist to v4 [security] fix(deps): update dependency pdfjs-dist [security] Mar 27, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from 3caab9d to 7856f78 Compare March 27, 2025 19:47
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist [security] fix(deps): update dependency pdfjs-dist to v4 [security] Mar 27, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from 7856f78 to aa8085c Compare April 1, 2025 10:20
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist to v4 [security] fix(deps): update dependency pdfjs-dist [security] Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from aa8085c to 5f3ee93 Compare April 1, 2025 12:21
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist [security] fix(deps): update dependency pdfjs-dist to v4 [security] Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from 5f3ee93 to 6aef748 Compare April 1, 2025 13:35
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist to v4 [security] fix(deps): update dependency pdfjs-dist [security] Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from 6aef748 to e68c810 Compare April 1, 2025 13:38
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist [security] fix(deps): update dependency pdfjs-dist to v4 [security] Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from e68c810 to eb6051e Compare April 1, 2025 13:54
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist to v4 [security] fix(deps): update dependency pdfjs-dist [security] Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch 4 times, most recently from 207e583 to e5d039d Compare April 1, 2025 19:49
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist [security] fix(deps): update dependency pdfjs-dist to v4 [security] Apr 1, 2025
@renovate renovate bot force-pushed the renovate/npm-pdfjs-dist-vulnerability branch from e5d039d to 60ebec9 Compare April 2, 2025 08:55
@renovate renovate bot changed the title fix(deps): update dependency pdfjs-dist to v4 [security] fix(deps): update dependency pdfjs-dist [security] Apr 2, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants