Bump pdfjs-dist from 5.7.284 to 6.2.108

[dependabot]

Bumps pdfjs-dist from 5.7.284 to 6.2.108.

Release notes

Sourced from pdfjs-dist's releases.

v6.2.108

This release contains improvements for annotation rendering, annotation editing, font conversion, image conversion, performance, SMask handling and text selection.

Changes since v6.1.200

• Bump the stable version in pdfjs.config by @​timvandermeij in mozilla/pdf.js#21510
• Add a workflow to publish the per-test coverage index by @​calixteman in mozilla/pdf.js#21507
• Add support for Sound annotations playing embedded audio by @​calixteman in mozilla/pdf.js#21501
• Remove the BOM from html files (bug 2051221) by @​calixteman in mozilla/pdf.js#21513
• Digital Signature and Certificate verification by @​beurdouche in mozilla/pdf.js#21247
• Bump actions/setup-python from 6.2.0 to 6.3.0 by @​dependabot[bot] in mozilla/pdf.js#21516
• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in mozilla/pdf.js#21518
• Bump actions/cache/save from 5.0.5 to 6.1.0 by @​dependabot[bot] in mozilla/pdf.js#21515
• Bump actions/cache/restore from 5.0.5 to 6.1.0 by @​dependabot[bot] in mozilla/pdf.js#21517
• Take into account the current transform when getting font size for FreeText by @​calixteman in mozilla/pdf.js#20505
• Fix the version comment in the font tests GitHub Actions workflow by @​timvandermeij in mozilla/pdf.js#21519
• Fix escapePDFName producing malformed name escapes for control characters by @​spokodev in mozilla/pdf.js#21522
• A couple of SignaturePropertiesManager improvements (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21524
• Serialize GitHub Pages deployments to avoid concurrent deploy failures by @​calixteman in mozilla/pdf.js#21528
• Deduplicate the signature-properties warn/error toolbar icon by @​beurdouche in mozilla/pdf.js#21530
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in mozilla/pdf.js#21532
• [GeckoView] Add web-digital_signature_properties_manager import map (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21529
• Reduce duplication when updating undoButton/undoCloseButton in PDFThumbnailViewer.prototype.#updateStatus by @​Snuffleupagus in mozilla/pdf.js#21531
• Add basic support for non-embedded TrebuchetMS fonts (issue 21523) by @​Snuffleupagus in mozilla/pdf.js#21527
• Avoid text selection workaround in modern Chromium by @​nicolo-ribaudo in mozilla/pdf.js#21514
• Use the #getPageL10nArgs helper in the PDFThumbnailView.prototype.addPasteButton method by @​Snuffleupagus in mozilla/pdf.js#21534
• Move the bannerStateForResults helper into the SignaturePropertiesManager class (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21533
• Update to Babel 8 by @​nicolo-ribaudo in mozilla/pdf.js#21475
• Apply the appearance-stream scale factor when text is shown, not on setFont by @​calixteman in mozilla/pdf.js#21525
• Do not drop the character after U+FFFE or U+FFFF in encodeToXmlString by @​spokodev in mozilla/pdf.js#21526
• Enable the unicorn/logical-assignment-operators ESLint plugin rule by @​Snuffleupagus in mozilla/pdf.js#21511
• Remove unneeded this.#signatureData = null; lines in src/core/document.js by @​Snuffleupagus in mozilla/pdf.js#21536
• Use the MathClamp helper in the PDFImage.prototype.getComponents method by @​Snuffleupagus in mozilla/pdf.js#21537
• Update dependencies to the most recent versions by @​timvandermeij in mozilla/pdf.js#21539
• Add API unit-tests for getSignatures and getSignatureData (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21541
• Do not drop the character after U+FFFE or U+FFFF in Font.prototype.encodeString by @​mahirhir in mozilla/pdf.js#21538
• Don't needlessly wrap the marked content id-attribute in a string by @​Snuffleupagus in mozilla/pdf.js#21545
• Lookup "lenIV" inline in the Type1Parser.prototype.extractFontProgram method by @​Snuffleupagus in mozilla/pdf.js#21544
• Use Intl.Segmenter for the entire-word search matching by @​calixteman in mozilla/pdf.js#21521
• Implement a unit test for passing unsupported data types to MurmurHash3_64.update() by @​timvandermeij in mozilla/pdf.js#21546
• Add a FakeSignatureVerifier for development mode and TESTING builds (PR 21247 follow-up) by @​Snuffleupagus in mozilla/pdf.js#21543
• Implement unit tests for the getRotationMatrix core utility function by @​timvandermeij in mozilla/pdf.js#21547
• Change Promise-returning worker message-handler functions to be asynchronous by @​Snuffleupagus in mozilla/pdf.js#21550
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in mozilla/pdf.js#21555
• Replace a couple of indexOf calls with startsWith by @​Snuffleupagus in mozilla/pdf.js#21554
• Bug 2048531 - Improve selection contrast in dark mode by @​nicolo-ribaudo in mozilla/pdf.js#21553
• Use for...of even more in the code-base by @​Snuffleupagus in mozilla/pdf.js#21560
• Update dependencies to the most recent versions by @​timvandermeij in mozilla/pdf.js#21561
• Use direct return await a bit more in the src/core/ folder by @​Snuffleupagus in mozilla/pdf.js#21563
• Improve the GitHub Actions workflow triggers and requirements by @​timvandermeij in mozilla/pdf.js#21562
• Commit the current editing session before saving (bug 2047516) by @​calixteman in mozilla/pdf.js#21568

... (truncated)

Commits

• 0365cbd Merge pull request #21654 from calixteman/fix/cycles
• f704f2e Merge pull request #21652 from Snuffleupagus/signatures-async-helpers
• 01ba4c4 Merge pull request #21646 from calixteman/update/pdf.js.qcms
• 0299cdc Merge pull request #21653 from Snuffleupagus/jsActions-_getElementsByName-sho...
• 8c3e101 Merge pull request #21650 from mozilla/dependabot/github_actions/github/codeq...
• 14afb86 Merge pull request #21649 from mozilla/dependabot/github_actions/github/codeq...
• 14fc73b Merge pull request #21648 from mozilla/dependabot/github_actions/github/codeq...
• 257f4c2 Merge pull request #21647 from mozilla/dependabot/github_actions/actions/setu...
• 93958e4 Merge pull request #21640 from Snuffleupagus/defaultOptions-Map
• bc6b5b0 Merge pull request #21651 from mozilla/dependabot/github_actions/actions/chec...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​pdfjs-dist@​6.2.108

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @sentry/node-core is 60.0% likely obfuscated Confidence: 0.60 Location: Package overview From: pnpm-lock.yaml → npm/react-scan@0.5.7 → npm/@sentry/node-core@10.69.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@sentry/node-core@10.69.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report