[alekswebnet]

Summary

Updates the bundled PDF.js from 6.4.299 to 6.5.438 and adds a renderer-src attribute for the renderer worker that 6.5 introduces.

This supersedes #73. Dependabot only bumps package.json and the lockfile, but the viewer files in src/build and src/web are vendored, so the update also needs pnpm sync:pdfjs.

PDF.js 6.5.438 (96f4f3c)

• Bumps pdfjs-dist to 6.5.438 and regenerates src/build and src/web with pnpm sync:pdfjs. Running the sync at 6.4.299 first left the tree unchanged, so the vendored files carry no local patches.
• Updates the version pins in the README, in demo/custom-worker-src.html, and in the CDN worker-src test.
• Nothing the element relies on changed. Every viewer option and PDFViewerApplication member it uses still exists, no CSS variable the theme overrides was removed, and viewer.html is unchanged.

renderer-src (dd8a6e9)

• PDF.js 6.5 can draw pages in a second worker, pdf.renderer.mjs. The viewer keeps this off (disableWorkerRendering: true), and its default URL ../build/pdf.renderer.mjs never resolves in the element's srcdoc frame. Turning it on therefore logged Renderer worker disabled: … is not a valid URL and drew on the main thread.
• renderer-src works like worker-src. It defaults to pdf.renderer.min.mjs next to the element, follows assets-base, applies to the next document, and its origin is allowed in the frame's script-src and worker-src.
• The sync script vendors the renderer files, and the build ships dist/pdf.renderer.min.mjs (175 KB). Bundlers emit that file the same way they emit the worker, so bundled apps get one more file even though the feature is off by default.
• demo/worker-rendering.html shows how to turn it on: setViewerOptions({ disableWorkerRendering: false }).

The docs site needs a renderer-src row and a line under Hosting after the release.

Pre-existing test problems found during review are tracked in #76.

Validation

• pnpm test -- --run: 40 passed (36 before). The suite also passes with the public/ fixtures moved away, as CI sees the repository. Each of the four new tests fails when the feature it covers is broken.
• pnpm build passes, and types/ is unchanged.
• Firefox against dist/ with worker rendering turned on: the renderer worker starts and draws pages, with no warning and no CSP violation, in three setups. These are the same-origin default, a cross-origin assets-base, and a cross-origin renderer-src. With the renderer origin removed from the CSP, the cross-origin case fails, so the CSP entry is needed.
• A Vite app built from the packed package emits pdf.renderer.min-<hash>.mjs next to the worker.
• pnpm install --frozen-lockfile passes.

Checklist

• The change is focused and includes tests for behavior changes.
• Relevant tests and the build pass locally.
• Public API, behavior, or user-guidance documentation is updated where needed. The demos are updated; the docs site gets renderer-src after the release.
• Accessibility impact has been considered, including keyboard navigation and focus visibility. viewer.html is unchanged in 6.5.438, and the element adds no UI.
• This pull request does not disclose a security vulnerability.

🤖 Generated with Claude Code

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	pdfjs-dist@​6.4.299 ⏵ 6.5.438	+1		+1	+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

Ignoring alerts on:

• pdfjs-dist@6.5.438

View full report

[alekswebnet]

@SocketSecurity ignore npm/pdfjs-dist@6.5.438

This is a false positive. pdfjs-dist is Mozilla's PDF.js, which ships minified and machine-generated code, the kind of code this heuristic flags. These checks were run on 2026-11-07:

• npm audit signatures verifies the package's registry signatures and its provenance attestation. The package was published by Mozilla's release workflow on GitHub Actions.
• The package's gitHead, 0a4153349d, is the commit that the v6.5.438 tag in mozilla/pdf.js points to.
• 205 of the 206 files it shares with pdfjs-6.5.438-dist.zip, the separately published GitHub release asset, are byte-identical. The exception, build/pdf.mjs, differs only in INTERNAL_EVT, a random ID that PDF.js generates on every build.