Chore: update pdfjs to 3.11.174, resolve CVE #1092
Merged
+16
−12
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
VadimDez
approved these changes
May 14, 2024
12 tasks
|
@shamoon , vulnerability issue is not getting fixed with "ng2-pdf-viewer": "10.2.2" & "pdfjs-dist": "^3.11.174" version , any idea how to resolve this? |
|
NPM is giving me this warning on audit. There is still a vulnerability issue.
|
|
Npm does not recognize the fix automatically because the dependency wasn’t upgraded. It was fixed using the described workaround. |
|
@shamoon, by when we can expect an update for this ng2-pdf-viewer version updated or npm audit does not through any vulnerability warning ? |
|
How about upgrading pdfjs-dist to v4? 
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hey glad to see the project is still going! Thanks for merging my other update PR 🙏
Not to be annoying but I figured we might as well go to the latest 3.x, I also included a change to disable JS execution which is an acceptable solution to https://www.cve.org/CVERecord?id=CVE-2024-4367 AFAIK
Closes #1088
Supersedes #1089