pdfjs-dist 5.6.205 -> 6.2.108 (kept as an exact pin)
- GHSA-hq66-cqwq-w95j (high): arbitrary JavaScript execution when
opening a malicious PDF; affects >=5.6.83 <6.2.108
The exact pin dates from d8ece9e11, when the viewer moved onto
pdf_viewer.mjs internals (PDFViewer options, TouchManager, a copied CSS
subset) that PDF.js changes without semver. 6.2.108 is the first fixed
release and keeps that surface: PDFViewer options, updateScale and
increase/decreaseScale, the pagesinit/pagerendered events, the viewer's
DOM classes and TouchManager are unchanged from 5.6.205 (6.3 adds
two-finger panning to TouchManager, so it is not taken here).
The one break is PDF.js 6.0 removing PDFDocumentProxy.destroy(), which
was an alias for loadingTask.destroy(); the viewer's cleanup now calls
the loading task directly, which behaves the same on 5.x.
pdfjs-dist 6 declares engines node >=22.13. The viewer is only loaded
client-side (next/dynamic with ssr: false), so the Node 20 CI and
Docker images only see an install-time engine warning.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
345e989280