chore(deps): update dependency pdfjs-dist to v6.2.108 [security] - autoclosed by renovate[bot] · Pull Request #10912 · TriliumNext/Trilium

renovate · 2026-08-07T05:22:41Z

This PR contains the following updates:

Package	Change	Age	Confidence
pdfjs-dist (source)	`6.1.200` → `6.2.108`

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

CVE-2026-16633 / GHSA-hq66-cqwq-w95j

More information

Details

Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

Workarounds

Set enableScripting to false or set a CSP.

Severity

CVSS Score: 8.6 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

mozilla/pdf.js (pdfjs-dist)

`v6.2.108`

Compare Source

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

codecov · 2026-08-07T05:50:04Z

Bundle Report

Changes will increase total bundle size by 58.26kB (0.06%) ⬆️. This is within the configured threshold ✅

Detailed changes

Bundle name	Size	Change
client-esm	48.92MB	58.26kB (0.12%) ⬆️

Affected Assets, Files, and Routes:

view changes for bundle: standalone-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
`src/src-*.js`	65 bytes	209 bytes	45.14% ⚠️
`src/src-*.js`	-65 bytes	144 bytes	-31.1%
`src/dist-*.js`	-26 bytes	56 bytes	-31.71%
`src/dist-*.js`	1 bytes	57 bytes	1.79%
`src/dist-*.js`	25 bytes	82 bytes	43.86% ⚠️
`assets/zh-*.js`	32 bytes	1.54kB	2.12%
`assets/zh-*.js`	-32 bytes	1.51kB	-2.08%
`assets/pt-*.js`	16 bytes	1.3kB	1.25%
`assets/pt-*.js`	-16 bytes	1.28kB	-1.23%

view changes for bundle: client-esm

Assets Changed:

Asset Name	Size Change	Total Size	Change (%)
`src/Spreadsheet-*.js`	-251 bytes	5.59MB	-0.0%
`src/chunk-*.js`	-41 bytes	528.46kB	-0.01%
`src/geomap-*.js`	62 bytes	1.06MB	0.01%
`src/ru-*.js`	28 bytes	406 bytes	7.41% ⚠️
`src/Canvas-*.js`	-57 bytes	504.75kB	-0.01%
`src/ja-*.js`	8 bytes	290 bytes	2.84%
`src/es-*.js`	-14 bytes	632 bytes	-2.17%
`src/tabulator-*.js`	-46 bytes	337.9kB	-0.01%
`src/fr-*.js`	5 bytes	337 bytes	1.51%
`src/en-*.js`	16 bytes	244 bytes	7.02% ⚠️
`src/ko-*.js`	8 bytes	268 bytes	3.08%
`src/zh-*.js`	8 bytes	267 bytes	3.09%
`src/zh-*.js`	8 bytes	294 bytes	2.8%
`src/de-*.js`	-11 bytes	772 bytes	-1.4%
`src/RelationMap-*.js`	-41 bytes	244.79kB	-0.02%
`src/dist-*.js`	-1 bytes	21.76kB	-0.0%
`src/content_renderer-*.js`	-41 bytes	209.57kB	-0.02%
`src/Code-*.js`	1 bytes	184.02kB	0.0%
`src/presentation-*.js`	-46 bytes	175.69kB	-0.03%
`src/ContentWidget-*.js`	-317 bytes	151.33kB	-0.21%
`src/NoteMap-*.js`	5 bytes	346 bytes	1.47%
`src/NoteMap-*.js`	-36 bytes	126.38kB	-0.03%
`src/MindMap-*.js`	-43 bytes	116.93kB	-0.04%
`src/layout_commons-*.js`	-51 bytes	93.14kB	-0.05%
`src/dashboard-*.js`	-5 bytes	91.03kB	-0.01%
`src/desktop_layout-*.js`	-31 bytes	82.48kB	-0.04%
`src/uk-*.js`	28 bytes	435 bytes	6.88% ⚠️
`src/i18n-*.js`	-51 bytes	7.01kB	-0.72%
`src/ribbon-*.js`	-48 bytes	59.4kB	-0.08%
`src/ar-*.js`	1 bytes	343 bytes	0.29%
`src/hi-*.js`	28 bytes	489 bytes	6.07% ⚠️
`src/pl-*.js`	28 bytes	333 bytes	9.18% ⚠️
`src/calendar-*.js`	15.38kB	45.85kB	50.51% ⚠️
`src/calendar-*.js`	30.2kB	30.63kB	7022.33% ⚠️
`src/timegrid-*.js`	12.61kB	41.66kB	43.41% ⚠️
`src/ImageViewer-*.js`	-41 bytes	40.82kB	-0.1%
`src/hooks-*.js`	-10 bytes	40.55kB	-0.02%
`src/it-*.js`	28 bytes	333 bytes	9.18% ⚠️
`src/cs-*.js`	28 bytes	328 bytes	9.33% ⚠️
`src/ro-*.js`	28 bytes	341 bytes	8.95% ⚠️
`src/pt-*.js`	28 bytes	310 bytes	9.93% ⚠️
`src/pt-*.js`	-4 bytes	700 bytes	-0.57%
*`src/731d9182-.js`** (New)	36.72kB	36.72kB	100.0% 🚀
`src/id-*.js`	28 bytes	318 bytes	9.66% ⚠️
`src/image_upload-*.js`	4 bytes	34.2kB	0.01%
*`src/headless-.js`** (New)	33.66kB	33.66kB	100.0% 🚀
`src/Mermaid-*.js`	-41 bytes	33.44kB	-0.12%
`src/interaction-*.js`	3.51kB	32.72kB	12.02% ⚠️
`src/ChatReadOnlyNotice-*.js`	-40 bytes	32.66kB	-0.12%
*`src/56f74c4a-.js`** (New)	31.95kB	31.95kB	100.0% 🚀
`src/ContentWidget-*.css`	-67 bytes	29.08kB	-0.23%
`src/import_dialog-*.js`	-46 bytes	27.68kB	-0.17%
`src/MediaPreview-*.js`	-46 bytes	27.09kB	-0.17%
`src/attribute_detail-*.js`	-46 bytes	26.75kB	-0.17%
`src/calendar-*.css`	15.2kB	25.35kB	149.9% ⚠️
`src/syntax_highlighting-*.js`	2 bytes	24.84kB	0.01%
`src/AddProviderModal-*.js`	-46 bytes	24.52kB	-0.19%
`src/setup-*.js`	8.99kB	24.05kB	59.64% ⚠️
`src/revisions-*.js`	-36 bytes	22.17kB	-0.16%
*`src/66c53e04-.js`** (New)	21.89kB	21.89kB	100.0% 🚀
`src/EditableText-*.js`	-41 bytes	21.58kB	-0.19%
`src/TitleRow-*.js`	-46 bytes	19.69kB	-0.23%
`src/board-*.js`	-41 bytes	18.57kB	-0.22%
`src/AttributeList-*.js`	-46 bytes	17.71kB	-0.26%
`src/mobile_layout-*.js`	-41 bytes	17.15kB	-0.24%
`src/ChatMessage-*.js`	-51 bytes	16.52kB	-0.31%
*`src/forma-.js`** (New)	15.71kB	15.71kB	100.0% 🚀
`src/bulk_action-*.js`	-46 bytes	14.43kB	-0.32%
`src/Markdown-*.js`	-36 bytes	13.36kB	-0.27%
`src/File-*.js`	-46 bytes	13.05kB	-0.35%
`src/image_compression_dialog-*.js`	-36 bytes	12.24kB	-0.29%
`src/ListOrGridView-*.css`	42 bytes	12.18kB	0.35%
`src/NoteDetail-*.js`	-36 bytes	12.0kB	-0.3%
`src/jsxRuntime.module-*.js`	11.49kB	11.93kB	2605.22% ⚠️
`src/react-*.js`	-56 bytes	11.17kB	-0.5%
`src/values_input-*.js`	-31 bytes	10.71kB	-0.29%
`src/Attachment-*.js`	-56 bytes	10.6kB	-0.53%
`src/compat.module-*.js`	8 bytes	10.53kB	0.08%
`src/Trans-*.js`	4 bytes	10.51kB	0.04%
`src/table-*.js`	-36 bytes	10.11kB	-0.35%
`src/toast-*.js`	-46 bytes	9.55kB	-0.48%
`src/CollectionProperties-*.js`	-36 bytes	9.51kB	-0.38%
`src/color_scheme-*.js`	-46 bytes	9.29kB	-0.49%
`src/TitleRow-*.css`	59 bytes	9.28kB	0.64%
`src/data-*.js`	-46 bytes	9.09kB	-0.5%
*`src/a51991fc-.js`** (New)	8.98kB	8.98kB	100.0% 🚀
`src/frontend_script_api-*.js`	4 bytes	8.63kB	0.05%
`src/ListOrGridView-*.js`	-46 bytes	8.46kB	-0.54%
`src/multimonth-*.js`	1.8kB	8.45kB	27.11% ⚠️
`src/SetupPage-*.css`	-1.02kB	8.35kB	-10.92%
`src/BasicPropertiesTab-*.js`	-46 bytes	8.32kB	-0.55%
`src/print_preview-*.js`	-46 bytes	7.48kB	-0.61%
`src/board-*.css`	-4 bytes	7.24kB	-0.06%
`src/dashboard-*.css`	-2 bytes	6.92kB	-0.03%
`src/Ribbon-*.js`	-51 bytes	6.61kB	-0.77%
`src/about-*.js`	-46 bytes	5.98kB	-0.76%
`src/IconPackPreview-*.js`	-46 bytes	5.89kB	-0.78%
`src/SidebarChat-*.js`	-46 bytes	5.75kB	-0.79%
`src/list-*.js`	-2.6kB	5.74kB	-31.14%
`src/NoteList-*.js`	-5 bytes	5.53kB	-0.09%
`src/help-*.js`	-46 bytes	5.12kB	-0.89%
`src/IconPicker-*.js`	-46 bytes	5.04kB	-0.9%
`src/recent_changes-*.js`	-46 bytes	4.32kB	-1.05%
*`src/ad0c00be-.js`** (New)	4.12kB	4.12kB	100.0% 🚀
`src/delete_notes-*.js`	-46 bytes	3.96kB	-1.15%
`src/hooks.module-*.js`	4 bytes	3.83kB	0.1%
*`src/setup-.css`** (New)	3.68kB	3.68kB	100.0% 🚀
`src/FormList-*.js`	-41 bytes	3.67kB	-1.1%
`src/EmbeddedNotePane-*.js`	-46 bytes	3.63kB	-1.25%
`src/add_link-*.js`	-46 bytes	3.57kB	-1.27%
`src/Modal-*.js`	-51 bytes	3.49kB	-1.44%
`src/print-*.js`	-46 bytes	3.3kB	-1.38%
`src/export-*.js`	-46 bytes	3.29kB	-1.38%
`src/login-*.js`	-41 bytes	3.09kB	-1.31%
`src/ocr_text-*.js`	-46 bytes	3.02kB	-1.5%
`src/SplitEditor-*.js`	-46 bytes	2.96kB	-1.53%
`src/SqlConsole-*.js`	-46 bytes	2.67kB	-1.7%
`src/Dropdown-*.js`	-5 bytes	2.66kB	-0.19%
`src/NotePropertyMenu-*.js`	-46 bytes	2.55kB	-1.77%
`src/branch_prefix-*.js`	-46 bytes	2.54kB	-1.78%
`src/master_detail-*.js`	-51 bytes	2.51kB	-1.99%
`src/bulk_actions-*.js`	-46 bytes	2.46kB	-1.83%
`src/Render-*.js`	-46 bytes	2.42kB	-1.86%
`src/HelpDropdown-*.js`	5 bytes	2.36kB	0.21%
`src/relation_values_input-*.js`	-46 bytes	2.28kB	-1.98%
`src/sort_child_notes-*.js`	-41 bytes	2.26kB	-1.78%
*`src/d5a70381-.js`** (New)	2.13kB	2.13kB	100.0% 🚀
`src/clone_to-*.js`	-46 bytes	2.12kB	-2.12%
*`src/1da0ed53-.js`** (New)	2.1kB	2.1kB	100.0% 🚀
`src/ReadOnlyText-*.js`	-36 bytes	2.05kB	-1.73%
`src/rrule-*.js`	-53 bytes	2.04kB	-2.53%
`src/set_password-*.js`	-41 bytes	1.94kB	-2.07%
`src/Empty-*.js`	-46 bytes	1.87kB	-2.41%
`src/note_type_chooser-*.js`	5 bytes	1.86kB	0.27%
`src/confirm-*.js`	-36 bytes	1.79kB	-1.97%
`src/OptionsRow-*.js`	-46 bytes	1.73kB	-2.59%
`src/NoteLink-*.js`	-46 bytes	1.67kB	-2.69%
`src/RightPanelWidget-*.js`	-46 bytes	1.61kB	-2.77%
`src/table-*.css`	-49 bytes	1.58kB	-3.0%
`src/move_to-*.js`	-46 bytes	1.56kB	-2.86%
`src/context-*.js`	4 bytes	1.48kB	0.27%
`src/Badge-*.js`	-46 bytes	1.35kB	-3.28%
`src/markdown_import-*.js`	5 bytes	1.33kB	0.38%
`src/prompt-*.js`	-46 bytes	1.3kB	-3.41%
`src/OverlayPanel-*.js`	5 bytes	1.27kB	0.4%
`src/FormTextBox-*.js`	5 bytes	1.23kB	0.41%
`src/info-*.js`	-41 bytes	1.19kB	-3.34%
`src/protected_session_password-*.js`	5 bytes	1.14kB	0.44%
`src/incorrect_cpu_arch-*.js`	-46 bytes	1.11kB	-3.98%
`src/FormFileUpload-*.js`	-46 bytes	1.06kB	-4.17%
`src/Card-*.js`	-41 bytes	1.03kB	-3.83%
`src/FormSelect-*.js`	-46 bytes	995 bytes	-4.42%
`src/SetupPage-*.js`	16 bytes	972 bytes	1.67%
`src/ProtectedSession-*.js`	-5 bytes	967 bytes	-0.51%
`src/highlights_list_options-*.js`	-46 bytes	865 bytes	-5.05%
`src/TablePrintView-*.js`	-46 bytes	818 bytes	-5.32%
`src/TabStrip-*.js`	5 bytes	811 bytes	0.62%
`src/Admonition-*.js`	5 bytes	795 bytes	0.63%
`src/FormDropdownList-*.js`	-46 bytes	791 bytes	-5.5%
`src/FormRadioGroup-*.js`	-46 bytes	738 bytes	-5.87%
`src/Book-*.js`	-46 bytes	715 bytes	-6.04%
*`src/DatabaseFileBadges-.js`** (New)	681 bytes	681 bytes	100.0% 🚀
`src/CollectionProperties-*.css`	27 bytes	660 bytes	4.27%
`src/Icon-*.js`	5 bytes	654 bytes	0.77%
`src/OptionsSection-*.js`	-46 bytes	633 bytes	-6.77%
`src/SegmentedChoice-*.js`	5 bytes	601 bytes	0.84%
`src/BlobStub-*.js`	5 bytes	575 bytes	0.88%
`src/FormGroup-*.js`	-46 bytes	566 bytes	-7.52%
`src/react_utils-*.js`	-41 bytes	525 bytes	-7.24%
`src/NoteMapGraph-*.js`	10 bytes	394 bytes	2.6%
`src/NoItems-*.js`	5 bytes	318 bytes	1.6%
*`src/client-.js`** (New)	155 bytes	155 bytes	100.0% 🚀
*`src/69261bb4-.js`** (New)	100 bytes	100 bytes	100.0% 🚀
*`src/DatabaseFileBadges-.css`** (New)	80 bytes	80 bytes	100.0% 🚀
`src/daygrid-*.js`	-381 bytes	64 bytes	-85.62%
~~*`src/core-.js`*~~ (Deleted)*	-158.33kB	0 bytes	-100.0% 🗑️
~~*`src/internal-.js`*~~ (Deleted)*	-24.76kB	0 bytes	-100.0% 🗑️
~~*`src/preact.module-.js`*~~ (Deleted)*	-11.55kB	0 bytes	-100.0% 🗑️

Update dependency pdfjs-dist to v6.2.108 [SECURITY]

01bc3da

renovate Bot added dependencies PRs or issues relating to dependencies renovate labels Aug 7, 2026

renovate Bot changed the title ~~Update dependency pdfjs-dist to v6.2.108 [SECURITY]~~ chore(deps): update dependency pdfjs-dist to v6.2.108 [security] Aug 7, 2026

renovate Bot changed the title ~~chore(deps): update dependency pdfjs-dist to v6.2.108 [security]~~ chore(deps): update dependency pdfjs-dist to v6.2.108 [security] - autoclosed Aug 8, 2026

renovate Bot closed this Aug 8, 2026

renovate Bot deleted the renovate/npm-pdfjs-dist-vulnerability branch August 8, 2026 13:10

Navigation Menu

Uh oh!

Uh oh!

chore(deps): update dependency pdfjs-dist to v6.2.108 [security] - autoclosed - #10912

chore(deps): update dependency pdfjs-dist to v6.2.108 [security] - autoclosed#10912
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-pdfjs-dist-vulnerability

renovate Bot commented Aug 7, 2026

Uh oh!

codecov Bot commented Aug 7, 2026

Assets Changed:

Assets Changed:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Uh oh!

Conversation

renovate Bot commented Aug 7, 2026

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Details

Impact

Patches

Workarounds

Severity

References

Release Notes

v6.2.108

Configuration

Uh oh!

codecov Bot commented Aug 7, 2026

Bundle Report

Affected Assets, Files, and Routes:

Assets Changed:

Assets Changed:

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`v6.2.108`