[renovate-bot-cbcoutinho]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
pdfjs-dist (source)	6.3.289 → 6.4.299

---

Release Notes

mozilla/pdf.js (pdfjs-dist)

v6.4.299

Compare Source

This release contains improvements for annotation rendering, font conversion, form handling, pattern rendering, performance, text selection and the viewer.

Changes since v6.3.289

• Bump the stable version in pdfjs.config by @​timvandermeij in #​21843
• Update dependencies to the most recent versions by @​timvandermeij in #​21844
• Improve the runtime of Chrome tests by @​timvandermeij in #​21846
• Fix the adjacent-page reordering integration test by @​calixteman in #​21847
• Implement unit tests for the error cases in src/core/xml_parser.js by @​timvandermeij in #​21848
• Use arrow functions consistently with Promise catch methods by @​Snuffleupagus in #​21849
• Fix the [Object] param entry in createAndAddNewEditor and three similar slips by @​darkdi in #​21850
• Fix incorrect text stroke width caused by stale pixel-width cache by @​HyeryongChoi in #​21829
• Remove old info logging from the "GetOperatorList"/"GetTextContent" handlers (issue 21836) by @​Snuffleupagus in #​21840
• Get the l10n arguments at once in PDFDocumentProperties.prototype.#parsePageSize by @​Snuffleupagus in #​21856
• Move checks into the ScreenAnnotation.#isPlayAction method by @​Snuffleupagus in #​21862
• Remove the unused fallback parameter from L10n.prototype.get by @​Snuffleupagus in #​21857
• Add a helper to reduce duplication in the collectActions function by @​Snuffleupagus in #​21863
• [api-minor] Expose the operatorList to the operationsFilter callback function (issue 20399) by @​Snuffleupagus in #​21868
• Bump github/codeql-action/analyze from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​21864
• Bump github/codeql-action/autobuild from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​21865
• Bump github/codeql-action/init from 4.37.7 to 4.37.8 by @​dependabot[bot] in #​21866
• Set deployment: false on the code-coverage environment jobs by @​calixteman in #​21853
• Add JSDoc linting by @​calixteman in #​21855
• Account for the Firefox font size quantization in the text layer by @​calixteman in #​21810
• Bump fast-uri from 3.1.5 to 3.1.7 by @​dependabot[bot] in #​21875
• Bump @​humanfs/node from 0.16.7 to 0.16.8 by @​dependabot[bot] in #​21876
• Address the high-severity zizmor findings by @​calixteman in #​21854
• Fix the fill area computation for a rotated tiling pattern by @​calixteman in #​21880
• Fix the vertical alignment of the views manager header by @​calixteman in #​21871
• Use moz-message-bar for the Firefox features notification (bug 2057608) by @​calixteman in #​21874
• Replace simple callback functions with arrow functions by @​Snuffleupagus in #​21879
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21882
• Improve the filename extension detection in MediaAnnotation.prototype._getContentType by @​Snuffleupagus in #​21887
• Shorten some Pattern-handling code a little bit by @​Snuffleupagus in #​21893
• Convert the font seacMap and seacs structures into Maps by @​Snuffleupagus in #​21884
• Modernize the MessageHandler class by @​Snuffleupagus in #​21883
• Convert the CmdCache, NameCache, and RefCache to use Maps by @​Snuffleupagus in #​21888
• Wait for the deferred focus changes in the editor integration tests by @​calixteman in #​21892
• Remove the unused @babel/runtime dependency by @​calixteman in #​21894
• Replace kleur with util.styleText by @​calixteman in #​21895
• Use @napi-rs/canvas for PNG decoding in integration tests by @​calixteman in #​21896
• Fix TextWidgetAnnotation not inheriting text alignment from AcroForm by @​diogotcorreia in #​21886
• Keep the ToUnicode mapping of unencoded glyphs in non-embedded Type1 fonts by @​calixteman in #​21872
• Avoid a CPU DoS when auto-sizing text fields (bug 2069428) by @​calixteman in #​21889
• Fix comment tooltip and highlight test races by @​calixteman in #​21897
• Prevent NaN values in sampled functions with a degenerate Domain by @​NakuRei in #​21891
• Make Ref.fromString more strict, by not accepting "bad" arguments by @​Snuffleupagus in #​21898
• Move the the interpolate helper, such that it can be re-used more in src/core/function.js code by @​Snuffleupagus in #​21905
• Convert the CFFOffsetTracker offsets into a Map by @​Snuffleupagus in #​21910
• Convert the missingGlyphs, used in the Font class, into a Set by @​Snuffleupagus in #​21911
• Bump actions/deploy-pages from 5.0.0 to 5.0.1 by @​dependabot[bot] in #​21908
• Keep editing disabled when switching documents by @​calixteman in #​21901
• Bump github/codeql-action/analyze from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​21909
• Bump github/codeql-action/init from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​21907
• Bump github/codeql-action/autobuild from 4.37.8 to 4.37.9 by @​dependabot[bot] in #​21906
• Fix few intermittents in integration tests with Chrome by @​calixteman in #​21902
• Don't crash when a transfer function array contains /Identity entries by @​calixteman in #​21903
• Add a software fallback for transfer maps by @​calixteman in #​21912
• Wait for editor focus before integration test input by @​calixteman in #​21913
• [GeckoView] Add typed signatures (bug 2069485) by @​calixteman in #​21900
• Use platform print-to-PDF for FreeText appearances (bug 1794809) by @​calixteman in #​21858
• Replace forEach callback functions with arrow functions by @​Snuffleupagus in #​21915
• Remove the ViewHistory.prototype.{get, set} methods by @​Snuffleupagus in #​21914
• Add a way to run the reference tests from a PR label by @​calixteman in #​21918
• Use a "normal" import statement to access the importPrintedAppearances function, in the src/core/worker.js file (PR 21858 follow-up) by @​Snuffleupagus in #​21923
• Let the reftest analyzer load images from absolute URLs by @​calixteman in #​21928
• Fix the magnifier of the reftest analyzer when the images are displayed scaled by @​calixteman in #​21930
• Fix the DirectWrite rendering mode used by the reference tests on Windows by @​calixteman in #​21931
• Bump library version to 6.4 by @​Snuffleupagus in #​21929
• Pin all the ClearType parameters used by the reference tests on Windows by @​calixteman in #​21932
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21933
• Bump js-yaml by @​dependabot[bot] in #​21919
• Add unit tests checking that a CMap's own mappings take precedence over usecmap ones by @​calixteman in #​21916
• Add a badge showing whether the reference images are up to date by @​calixteman in #​21925
• Stub out OptionalContentConfig, FontLoader, and FontFaceObject code when building for workers by @​Snuffleupagus in #​21926
• Avoid manual loops when generating some simple Arrays/TypedArrays by @​Snuffleupagus in #​21935
• Run the "gets current workerSrc" unit-test in Node.js (PR 17055 follow-up) by @​Snuffleupagus in #​21937
• Utilize Fluent better when localizing the PDFDocumentProperties dialog by @​Snuffleupagus in #​21938
• Update dependencies to the most recent versions by @​timvandermeij in #​21940
• Fix intermittent failures in the PDFDocumentProperties tests (PR 21938 follow-up) by @​Snuffleupagus in #​21941
• Use the waitForTooltipToBe helper function in the annotation integration tests by @​timvandermeij in #​21943
• Change the FontFaceObject.prototype.getPathGenerator cache into a Map by @​Snuffleupagus in #​21947
• Inline the _loadTestFont definition in the FontLoader.prototyp._prepareFontLoadEvent method by @​Snuffleupagus in #​21948
• Use the waitForTextToBe helper function in the editor undo bar integration tests by @​timvandermeij in #​21949
• Re-factor the FontLoader.prototype.isFontLoadingAPISupported getter by @​Snuffleupagus in #​21950
• Use the waitForTextToBe helper function in the editor alert bar integration tests by @​timvandermeij in #​21951
• Re-factor the test-font fallback loading in the FontLoader class by @​Snuffleupagus in #​21952
• Use the waitForTextToBe helper function in the remaining integration tests by @​timvandermeij in #​21953
• Convert the CFFDict classes to use Maps, rather than plain Objects by @​Snuffleupagus in #​21955
• Mark IdentityCMap.prototype.getMap as unreachable by @​Snuffleupagus in #​21956
• Use grayscale text antialiasing in Windows Firefox tests by @​calixteman in #​21945
• Allow tests to reuse installed browsers by @​calixteman in #​21963
• Convert charCodeToGlyphId, used in various font-code, into a Map by @​Snuffleupagus in #​21961
• Fix two FreeText integration tests when running headed on a HiDPI screen by @​calixteman in #​21962
• Define the "argument is Dictionary" callback validation function just once by @​Snuffleupagus in #​21967
• [Firefox] Remove the about:pdf href from the PDF features notification link (bug 2071624) by @​calixteman in #​21964
• Fix unexpected border-radius on the pdfFeaturesNotification bar (bug 2071593) by @​jsimplicio in #​21966
• Remove the createWithNullProto helper from the CFFParser unit-tests by @​Snuffleupagus in #​21973
• Add a helper function for writing array-data in compileFontInfo by @​Snuffleupagus in #​21976
• Validate embedded media content types by @​calixteman in #​21977
• Recover from browser startup and reload failures by @​calixteman in #​21944
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21979
• Update JBIG2 decoder to pdfium@bb1f9f7 by @​calixteman in #​21980
• Defer the Firefox features notification until after first-page rendering (bug 2072145) by @​calixteman in #​21981
• Settle editor focus before page.focus in integration tests by @​calixteman in #​21982
• Convert the Differences Array, used with non-composite fonts, into a Map by @​Snuffleupagus in #​21984
• Convert the toFontChar Array, in the Font class, into a Map by @​Snuffleupagus in #​21985
• Tighten xref stream field-width validation by @​calixteman in #​21987
• Update dependencies to the most recent versions by @​timvandermeij in #​21986
• [api-minor] Stop sending a separate "test" message during Worker loading by @​Snuffleupagus in #​21988
• Limit cumulative CMap range entries by @​calixteman in #​21989
• Enable the unicorn/prefer-combined-guards linting rule by @​timvandermeij in #​21990
• Remove CLAUDE.md in favor of AGENTS.md by @​jarrensj in #​21983
• Bump codecov/codecov-action from 7.0.0 to 7.1.0 by @​dependabot[bot] in #​22006
• Bump github/codeql-action/analyze from 4.37.9 to 4.38.0 by @​dependabot[bot] in #​22004
• Bump github/codeql-action/autobuild from 4.37.9 to 4.38.0 by @​dependabot[bot] in #​22005
• Bump github/codeql-action/init from 4.37.9 to 4.38.0 by @​dependabot[bot] in #​22007
• Enable the unicorn/prefer-set-methods linting rule by @​timvandermeij in #​21992
• Remove some redundant loop variables by @​Snuffleupagus in #​22008
• Increase the browser protocol timeout by @​calixteman in #​21995
• Remove unnecessary Array copying in the PatternInfo class (PR 20340 follow-up) by @​Snuffleupagus in #​22003
• Enable the unicorn/prefer-smaller-scope linting rule by @​timvandermeij in #​21993
• Enable the unicorn/prefer-short-arrow-method linting rule by @​timvandermeij in #​21994
• Route worker messages using stable page IDs by @​calixteman in #​22000
• Convert the CMap and ToUnicodeMap classes to store its data in Maps by @​Snuffleupagus in #​21975
• Preserve escaped literals in util.printd by @​Shubham-Padkonde in #​21965
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​22018
• Use a Uint8Array to track missing TrueType glyphs (bug 2075570) by @​calixteman in #​22025
• Add a helper function for writing buffer-data in compileFontInfo by @​Snuffleupagus in #​22022
• Introduce a helper to reduce duplication when reading compiled string-data from fonts by @​Snuffleupagus in #​22019
• Avoid scanning identity /ToUnicode maps for font fallback (bug 2075550) by @​calixteman in #​22027
• Add helper functions for encoding and writing strings in src/core/obj_bin_transform_core.js by @​Snuffleupagus in #​22016
• Remove unneeded async functions when creating StructTreeRoot-data during saving (PR 19026) by @​Snuffleupagus in #​22015
• Remove the unused SystemFontInfo.prototype.guessFallback getter by @​Snuffleupagus in #​22026
• Reset the descendants of non-terminal fields in a ResetForm action by @​fstandhartinger in #​22014
• Stop exporting the Font defaultWidth by default by @​Snuffleupagus in #​22028
• Bound CFF INDEX and FDArray parsing by @​calixteman in #​22037
• Use srcPos for the remaining pixels in convertRGBToRGBA by @​Prafyl in #​22036
• Stop exporting the Font defaultVMetrics by default by @​Snuffleupagus in #​22042
• Use the glyph width for the default vertical origin by @​calixteman in #​22047
• Reset the descendants of non-terminal fields in Doc.resetForm by @​calixteman in #​22034
• Update OpenJpeg to 8314119 by @​calixteman in #​22049
• Bump markdown-it from 14.2.0 to 14.3.2 by @​dependabot[bot] in #​22055
• Bump undici from 7.29.0 to 7.30.0 by @​dependabot[bot] in #​22053
• Bump brace-expansion by @​dependabot[bot] in #​22054
• Bump codecov/codecov-action from 7.1.0 to 7.1.1 by @​dependabot[bot] in #​22031
• Bump github/codeql-action/analyze from 4.38.0 to 4.38.1 by @​dependabot[bot] in #​22030
• Bump github/codeql-action/autobuild from 4.38.0 to 4.38.1 by @​dependabot[bot] in #​22032
• Bump github/codeql-action/init from 4.38.0 to 4.38.1 by @​dependabot[bot] in #​22033
• Stop exporting the Font mimetype property by @​Snuffleupagus in #​22038
• Directly lookup entries in the cidToGidMap when building the charCodeToGlyphId map, for embedded composite fonts by @​Snuffleupagus in #​22056
• Bound tiling pattern folding work for tiny steps by @​calixteman in #​22012
• Shadow the getters in FontInfo, CssFontInfo, and SystemFontInfo (PR 20197 follow-up) by @​Snuffleupagus in #​22035
• Stop exporting the Font name by default by @​Snuffleupagus in #​22057
• Stop passing extra properties to the FontInfo class by @​Snuffleupagus in #​22059
• Avoid resetting the text-layer measurement font by @​calixteman in #​22058
• Stop exporting the Font ascent and descent by default, and remove handling of standalone number entries in the compiled font-info by @​Snuffleupagus in #​22060
• Check shading function dimensions and bound sampled interpolation by @​calixteman in #​22041
• Convert SupportedImageMimeTypes into a Set by @​Snuffleupagus in #​22061
• Update dependencies to the most recent versions by @​timvandermeij in #​22062
• Avoid creating a pointless requestId in the ChunkedStreamManager.prototype._requestChunks method by @​Snuffleupagus in #​22064

---

Configuration

📅 Schedule: (in timezone Europe/Amsterdam)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astrolabe-docs	Ready	Preview	Oct 24, 2026 4:04am UTC

[claude]

Claude finished @renovate-bot-cbcoutinho[bot]'s task in 14s —— View job

---

Review: pdfjs-dist 6.3.289 → 6.4.299

• Inspect diff and usages

Summary: Lockfile-only change (package-lock.json). It bumps pdfjs-dist to 6.4.299 and its optional dependency @napi-rs/canvas from 1.0.8 to 1.0.12, including all platform sub-packages. package.json keeps ^6.0.0, so the new version is already in range. The lockfile also shows a 0.45.2 → 0.46.0 version change, which looks like a rebase artifact from main.

Usage: The app imports only pdfjs-dist/legacy/build/pdf.mjs and the legacy worker (src/components/PDFViewer.vue:50,56) and PDFDataRangeTransport (src/services/pdfRangeTransport.js:3). I checked the release notes against these.

• The release has a [api-minor] change: "Stop sending a separate 'test' message during Worker loading" (#21988). This touches worker bootstrap. We bundle the worker inline via ?worker&inline, so it should be unaffected, but it is the most relevant change to check in a smoke test.
• Another [api-minor] change exposes operatorList to the operationsFilter callback. We don't use that callback.
• Worker message routing now uses stable page IDs (#22000). This is internal, but it matters for our range-transport PDF streaming.
• There are several security hardenings: CMap limits, CFF bounds, a text-field auto-size DoS fix, and tiling pattern bounds. These are good to have.

Risks / suggestions

• I found nothing blocking. @napi-rs/canvas is only an optional Node-side dependency of pdfjs and isn't used in the browser bundle.
• The behavioural changes sit in the worker and range-transport path. Before merging, I suggest running npm run build and manually opening a PDF with range requests, or running the e2e suite. I have not run any build, lint or tests here.
• Per CLAUDE.md, this PR adds no API surface, so the Pact and e2e requirements don't apply.

Verdict: Looks safe to merge once CI is green and the PDF viewer has been checked quickly.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud