[dependabot]

Bumps the production-dependencies group with 1 update in the / directory: pdfjs-dist.

Updates pdfjs-dist from 6.4.299 to 6.5.438

Release notes

Sourced from pdfjs-dist's releases.

v6.5.438

This release contains improvements for accessibility, annotation editing, annotation rendering, font conversion, image conversion, performance, scripting, tiling pattern rendering and the viewer.

Changes since v6.4.299

• Bump the stable version in pdfjs.config by @​timvandermeij in mozilla/pdf.js#22066
• Fix a few edge cases when converting RGB images in convertRGBToRGBA and ImageResizer by @​calixteman in mozilla/pdf.js#22046
• Directly call Set.prototype.delete in the ChunkedStreamManager code by @​Snuffleupagus in mozilla/pdf.js#22065
• Don't stop at the first broken /Kids entry in Catalog.getAllPageDicts (issue 22011) by @​xjtu-ctgg in mozilla/pdf.js#22013
• Keep the sign of negative numbers greater than -1 in util.printf by @​kwy404 in mozilla/pdf.js#22017
• Downscale large images without a full-size RGBA buffer by @​calixteman in mozilla/pdf.js#22067
• Create the LIGATURE_TO_UNICODE Map only once by @​Snuffleupagus in mozilla/pdf.js#22068
• Replace gulp-replace with transform for the Chromium manifest by @​calixteman in mozilla/pdf.js#22072
• [api-minor] Don't re-layout the textLayer on update (PR 20492 follow-up) by @​Snuffleupagus in mozilla/pdf.js#22045
• Bump library version to 6.5 by @​Snuffleupagus in mozilla/pdf.js#22073
• Remove the explicit gulp-cli dependency by @​calixteman in mozilla/pdf.js#22077
• Replace ttest with a local Welch's t-test by @​calixteman in mozilla/pdf.js#22075
• Add a reference test for issue 7802 by @​Snuffleupagus in mozilla/pdf.js#22074
• Replace webpack-stream with the Webpack API by @​calixteman in mozilla/pdf.js#22070
• Match the whole string in the getCharUnicodeCategory regular expression (issue 21890) by @​Om-singhaI in mozilla/pdf.js#21960
• Add pull request viewer previews by @​calixteman in mozilla/pdf.js#22090
• [api-minor] Offload canvas drawing operations to a worker by @​Aditi-1400 in mozilla/pdf.js#21860
• Check preview deployment before posting links by @​calixteman in mozilla/pdf.js#22093
• Bump source-map-js from 1.2.1 to 1.2.2 by @​dependabot[bot] in mozilla/pdf.js#22091
• Bump github/codeql-action/init from 4.38.1 to 4.38.2 by @​dependabot[bot] in mozilla/pdf.js#22084
• Bump github/codeql-action/analyze from 4.38.1 to 4.38.2 by @​dependabot[bot] in mozilla/pdf.js#22085
• Bump github/codeql-action/autobuild from 4.38.1 to 4.38.2 by @​dependabot[bot] in mozilla/pdf.js#22086
• Ensure that errors in the Optional Content won't prevent all rendering by @​Snuffleupagus in mozilla/pdf.js#22082
• Replace Metalsmith with a docs gulp task by @​calixteman in mozilla/pdf.js#22081
• Don't swallow postMessage errors when replying to sendWithPromise messages (issue 22079) by @​Snuffleupagus in mozilla/pdf.js#22080
• Collect renderer worker coverage by @​calixteman in mozilla/pdf.js#22094
• Extract viewer preview checks and preparation into scripts by @​calixteman in mozilla/pdf.js#22095
• Use CharCodeMap for font character mappings (bug 2077176) by @​calixteman in mozilla/pdf.js#22092
• Ensure that the RendererWorker version matches the API version, and reduce the size of the built pdf.renderer.mjs file (PR 21860 follow-up) by @​Snuffleupagus in mozilla/pdf.js#22097
• Fix the DOMCanvasFactory import in the new debugger (PR 22097 follow-up) by @​Snuffleupagus in mozilla/pdf.js#22098
• Resolve PDF.js aliases when linting imports by @​calixteman in mozilla/pdf.js#22099
• A couple of RendererWorker improvements (PR 21860 follow-up) by @​Snuffleupagus in mozilla/pdf.js#22103
• Move renderer worker support out of api.js (PR 21860 follow-up) by @​calixteman in mozilla/pdf.js#22105
• Always check if crypto.randomUUID is available in the getUuid helper (issue 22107) by @​Snuffleupagus in mozilla/pdf.js#22108
• Split the src/display/display_utils.js file into multiple ones (PR 21860 follow-up) by @​Snuffleupagus in mozilla/pdf.js#22101
• Reduce duplication in the type1FontGlyphMapping function by @​Snuffleupagus in mozilla/pdf.js#22104
• Create canvasFactory and filterFactory just once in the RendererMessageHandler (PR 21860 follow-up) by @​Snuffleupagus in mozilla/pdf.js#22114
• Cache decoded page images in the worker in Firefox (PR 22105 follow-up) by @​calixteman in mozilla/pdf.js#22112
• Test main-thread and worker rendering paths by @​calixteman in mozilla/pdf.js#22096
• Use the main-thread pixel ratio for worker image smoothing by @​calixteman in mozilla/pdf.js#22120
• Fit the Nova zoom select in the compact toolbar (bug 2075731) by @​calixteman in mozilla/pdf.js#22118
• Add unit-tests for the StatTimer.prototype.toString method by @​Snuffleupagus in mozilla/pdf.js#22109
• Add a method in BaseCanvasFactory for getting a no-alpha canvas context by @​Snuffleupagus in mozilla/pdf.js#22116
• Update the thumbnail status label and controls together (bug 2080269) by @​calixteman in mozilla/pdf.js#22119
• Keep scripting internals out of the global scope (issue 22121) by @​calixteman in mozilla/pdf.js#22122
• Parse structure trees without a ParentTree by @​calixteman in mozilla/pdf.js#22115

... (truncated)

Commits

• 0a41533 Merge pull request #22371 from andrewfader/stream-reader-cancel-errored
• 956f0cd Merge pull request #22375 from andrewfader/xref-discard-corrupt-state
• 743422f Prevent unhandled rejections when cancelling an errored stream reader
• 4794c39 Discard the state of a corrupt XRef table/stream before parsing the next one
• ab3819f Merge pull request #22409 from Snuffleupagus/initAnnotationLayer-inline
• b1b2849 Merge pull request #22402 from calixteman/truncated-rgb-image-data
• 5b02155 Merge pull request #22386 from calixteman/bug2084610
• 4ef78fe Inline the AnnotationLayerBuilder.prototype.#initAnnotationLayer method
• 079921e Regenerate button appearances for NeedAppearances (bug 2084610)
• 743102c Merge pull request #22408 from Snuffleupagus/AnnotationElement-shadow-svgFactory
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pdfjs-dist@​6.4.299 ⏵ 6.5.438	+1		+1	+1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Obfuscated code: npm pdfjs-dist is 72.0% likely obfuscated Confidence: 0.72 Location: Package overview From: package.json → npm/pdfjs-dist@6.5.438 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/pdfjs-dist@6.5.438. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

[dependabot]

Looks like pdfjs-dist is no longer updatable, so this is no longer needed.