From b260e17bf7100dcc48b171bffc2f37939a57f862 Mon Sep 17 00:00:00 2001 From: Aleksandr Shevchuk Date: Fri, 30 Oct 2026 15:52:24 +0200 Subject: [PATCH 1/2] Note the CSP connect-src requirement for locale files The locale file is the only request the viewer makes for a locale once pdfjs-viewer 4.4.1 serves the locale map from memory, so a page CSP only needs the file's origin in connect-src, and a file that can't be loaded leaves the interface in English. Adds the sentence to Localization and a migration note for dropping `connect-src blob:`. Co-Authored-By: Claude Fable 5.1 --- src/pdfjs-viewer/index.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/pdfjs-viewer/index.md b/src/pdfjs-viewer/index.md index 089f891..f5e3816 100644 --- a/src/pdfjs-viewer/index.md +++ b/src/pdfjs-viewer/index.md @@ -205,6 +205,8 @@ To serve locale files yourself, which is useful under a strict CSP or when you c ``` +If your page has a Content Security Policy, allow the locale file's origin in `connect-src`: `https://cdn.jsdelivr.net` for the default files, or `'self'` for your own. If the file can't be loaded, the interface stays in English. + ## Hosting The element loads the viewer at runtime from five files next to `pdfjs-viewer-element.js` in the package's `dist` folder: `viewer.mjs`, `pdf.mjs`, `pdf.worker.min.mjs`, `viewer.css` and `paper-and-ink.css`. All of them must come from the same release as the element. The [data some PDFs need](#cmaps-fonts-and-other-resources) sits beside them. @@ -468,6 +470,7 @@ import '@missing-elements/pdfjs-viewer' // was: import 'pdfjs-viewer-element' If you're coming from an older version: +- **From 4.4.0 or earlier:** if your Content Security Policy allows `blob:` in `connect-src` only for locales, you can remove it. - **From 4.3 or earlier:** if you worked around region locales with a lowercase code and lowercase locale folders, rename the folders back to their original case, such as `pt-BR`, and use any case in `locale`. PDF JavaScript now runs; see [PDF.js resources](#cmaps-fonts-and-other-resources) to turn it off. Absolute resource URLs keep working, and `debugger-src` is gone (it never had an effect). - **From 3.x:** version 4 moved from PDF.js 5 to PDF.js 6. If you set `worker-src`, point it at `pdfjs-dist@{{ pdfjsViewer.pdfjsVersion }}`. From 3.0.x, also replace `viewer-extra-styles` and `viewer-extra-styles-urls` with [`injectViewerStyles()`](#injectviewerstyles-css). - **From 2.x:** PDF.js is now bundled, so remove `viewer-path` and your copy of the PDF.js prebuild. Replace `initialize()` with [`initPromise`](#initpromise), and `viewer-extra-styles` and `viewer-extra-styles-urls` with [`injectViewerStyles()`](#injectviewerstyles-css). The `nameddest`, `text-layer`, `disable-*` and `verbosity` attributes are gone: From d3ca9d31c3b59209b3e5489376b315689a382954 Mon Sep 17 00:00:00 2001 From: Aleksandr Shevchuk Date: Fri, 30 Oct 2026 16:16:31 +0200 Subject: [PATCH 2/2] Bump pdfjs-viewer to 4.4.1 The release that serves the locale map from memory, so the live preview and the version numbers match the Localization and Migrating notes. Co-Authored-By: Claude Opus 5.5 --- package.json | 2 +- pnpm-lock.yaml | 10 +++++----- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/package.json b/package.json index 0baf015..233fea1 100644 --- a/package.json +++ b/package.json @@ -12,6 +12,6 @@ "@11ty/eleventy-plugin-syntaxhighlight": "5.0.2" }, "dependencies": { - "@missing-elements/pdfjs-viewer": "4.4.0" + "@missing-elements/pdfjs-viewer": "4.4.1" } } diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index d7e9729..d4fbde1 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -9,8 +9,8 @@ importers: .: dependencies: '@missing-elements/pdfjs-viewer': - specifier: 4.4.0 - version: 4.4.0 + specifier: 4.4.1 + version: 4.4.1 devDependencies: '@11ty/eleventy': specifier: 3.1.7 @@ -77,8 +77,8 @@ packages: resolution: {integrity: sha512-oI7m8pa7/IAU/3lqRU9vjBbs20iKFo7x+1K9kT3aVira6scc1X9MjBdgLCHzLJeJ7iB6wydioA+kr9/qPnvmlQ==} engines: {node: '>=18'} - '@missing-elements/pdfjs-viewer@4.4.0': - resolution: {integrity: sha512-jiJqZpFip1glhltNZXJblkdGrmk2cI90HE814ccvXVTISLn8Cl/MUEa5m3EdA2NOlzyiXuF0tECc7mrj2xCvvg==} + '@missing-elements/pdfjs-viewer@4.4.1': + resolution: {integrity: sha512-FBwaTOeNMsd0aXxio2ChQ9IBGLNmsdTYJ+ZUrOFvCg9L+/jyiDUE+fndOw1MwAXowZeWaKdAjNiFAU87Myy+zQ==} '@napi-rs/canvas-android-arm64@1.0.13': resolution: {integrity: sha512-trn7AaDzQ+yeeA0ezhkC7cB1ZDPtp4UYk0EvB5F8qtYL9jEVWtVrU30WOpI52DszoTxaTsCgf5PP4ZVaOlOIHQ==} @@ -678,7 +678,7 @@ snapshots: minimatch: 3.1.5 slash: 3.0.0 - '@missing-elements/pdfjs-viewer@4.4.0': + '@missing-elements/pdfjs-viewer@4.4.1': dependencies: pdfjs-dist: 6.4.299