Failed to update from version 3.0.279 to 4.2.67 of pdfjs-dist

[stefanheinze]

Because of a security vulnerability we need to update in our product the pdfjs-dist version from 3.0.279 to 4.2.67.

We have the library integrated in an angular 17 application, so the application runs in a browser.

In version 3.0.279 our setups looked like that. We have the depenedency added to our package.json and initialize the pdfjs library when our module is created.

import * as pdfJs from 'pdfjs-dist';
import pdfjsWorker from 'pdfjs-dist/build/pdf.worker.entry';

export function loadPdfJs() {
  pdfJs.GlobalWorkerOptions.workerSrc = pdfjsWorker;
  return pdfJs;
} 

After initializing the library we can use it in our component:

this.loadingTask = this.pdfJs.getDocument(src);
....

In version 4.2.67 we tried to initialize the library in the same way:

import * as pdfJs from 'pdfjs-dist';
import * as pdfWorker from 'pdfjs-dist/build/pdf.worker.mjs';

export function loadPdfJs() {
  pdfJs.GlobalWorkerOptions.workerSrc = pdfjsWorker;
  return pdfJs;
} 

But the pdfJs can not be loaded, therefore i can not set the worker. I saw also different ways to set the worker (by url or whatever). But i can not go the first step.

Can someone help on that topic. For us its very urgend these days to do the update to a newer version.

[atkallie]

This seemed to work for me if you want to give it a try (inspired by react-pdf docs — make sure you read this note as well):

import * as pdfJs from 'pdfjs-dist';

export function loadPdfJs() {
    pdfJs.GlobalWorkerOptions.workerSrc = new URL('pdfjs-dist/build/pdf.worker.min.mjs', import.meta.url).toString();
    return pdfJs;
}

[stefanheinze]

Thanks a lot @atkallie. i was able to test this in our project setup and it is working. Thanks for the solution and the fast reply :)

[dapperdandev]

Did you get any errors like

Cannot destructure property 'AbortException' of 'globalThis.pdfjsLib' as it is undefined.?

or...

12073|        const worker = yield import(
12074|          /*webpackIgnore: true*/
12075|          this.workerSrc
   |          ^^^^^^^^^^^^^^
12076|        );
12077|        return worker.WorkerMessageHandler;
The above dynamic import cannot be analyzed by Vite.

I'm also going through a similar upgrade.