Update dependency pdfjs-dist to v6 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
pdfjs-dist (source)	^5.0.0 → ^6.0.0

---

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

CVE-2026-16633 / GHSA-hq66-cqwq-w95j

More information

Details

Impact

If PDF.js is used to load a malicious PDF, and PDF.js is configured with enableScripting set to true (which is the default value) and no CSP for disallowing script-src, unrestricted attacker-controlled JavaScript will be executed in the context of the hosting domain.

Patches

Workarounds

Set enableScripting to false or set a CSP.

Severity

• CVSS Score: 8.6 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

• https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j
• https://bugzilla.mozilla.org/show_bug.cgi?id=2055885
• https://github.com/advisories/GHSA-hq66-cqwq-w95j

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mozilla/pdf.js (pdfjs-dist)

v6.2.108

Compare Source

v6.1.200

Compare Source

This release contains improvements for annotation rendering, annotation editing, font conversion, image conversion, merging files, SMask rendering and the viewer.

Changes since v6.0.227

• Bump the stable version in pdfjs.config by @​timvandermeij in #​21360
• Disable WebGPU for Firefox tests by @​timvandermeij in #​21364
• Skip the format 4 cmap sub-table when it doesn't fit its 16-bits fields by @​calixteman in #​21365
• Use the MathClamp helper function in the src/display/canvas.js file by @​Snuffleupagus in #​21367
• Update the StringStream constructor to accept an optional dictionary argument by @​Snuffleupagus in #​21366
• Mark a couple of viewer, and editor, EventBus listeners as "internal" by @​Snuffleupagus in #​21368
• Improve the BaseStream.prototype.clone implementations by @​Snuffleupagus in #​21371
• Add an integration-test for clicking on internal links in presentation mode by @​Snuffleupagus in #​21373
• Fix intermittent failure in the "must check that a freetext is still here after having updated it and scroll the doc" freetext editor integration test by @​timvandermeij in #​21361
• Restore editor layer state for unchanged pages after page mutations by @​calixteman in #​21347
• Render gray transparency groups in grayscale by @​calixteman in #​21372
• Fix broken enableSelectionRendering: false by @​wooorm in #​21378
• Implement proper serialization of OptionalContentConfig by @​Snuffleupagus in #​21349
• [api-minor] Add support for /AuthEvent, on-demand decryption by @​wooorm in #​21351
• Run browser tests to collect code coverage data by @​Snuffleupagus in #​21359
• Bump github/codeql-action from 4.35.5 to 4.36.0 by @​dependabot[bot] in #​21382
• Remove the #externalHide field from the AnnotationLayerBuilder class by @​Snuffleupagus in #​21380
• Extend the AppOptions unit-tests to also cover the EVENT_DISPATCH option-kind by @​Snuffleupagus in #​21385
• Shorten the getBytes method in the Stream/ChunkedStream classes by @​Snuffleupagus in #​21384
• Add knockout_inner_backdrop ref test by @​calixteman in #​21383
• Deduplicate shared font/image streams when merging PDFs by @​calixteman in #​21379
• Bug 2035251 - Use toolkit's pdf icon as favicon by @​sfoster in #​21358
• Match editor keyboard shortcuts by event.code as a fallback by @​calixteman in #​21350
• Update the README in order to add some info about code coverage by @​calixteman in #​21389
• fix typo in bit flag value for suppressCropClip by @​KonstantinRight in #​21386
• Reject the stream-capability when aborting the ChunkedStreamManager by @​Snuffleupagus in #​21387
• Strip the JBIG2 file header from JBIG2Decode streams by @​calixteman in #​21388
• Add one more unit-test case for invalid email domains in the Autolinker class by @​Snuffleupagus in #​21392
• Add a unit-test for passing a filesystem URL-string (in Node.js) to getDocument by @​Snuffleupagus in #​21391
• Add a unit-test for passing a binary string to getDocument by @​Snuffleupagus in #​21390
• Add basic integration-tests for the PDFCursorTools functionality by @​Snuffleupagus in #​21393
• Shorten the DrawLayerBuilder.prototype.cancel method a tiny bit by @​Snuffleupagus in #​21395
• Prevent intermittent issues when invoking the PDFPageView.prototype.#injectLinkAnnotations method by @​Snuffleupagus in #​21396
• Upgrade codecov/codecov-action to version 7.0.0 by @​timvandermeij in #​21398
• Run various test-suite when the external/ folder is modified by @​Snuffleupagus in #​21400
• Update dependencies to the most recent versions by @​timvandermeij in #​21402
• Update quickjs to rev 3d5e064 by @​calixteman in #​21399
• fixed typo in README.md by @​matasaru in #​21404
• Fix transparent color of ::selection in Firefox by @​wooorm in #​21408
• Remove the Map.prototype.getOrInsertComputed polyfill from the scripting implementation (PR 21399 follow-up) by @​Snuffleupagus in #​21405
• Bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​21420
• Bump github/codeql-action from 4.36.0 to 4.36.1 by @​dependabot[bot] in #​21421
• Handle TR2 with /Default entry by @​calixteman in #​21414
• [api-minor] Convert getAttachments to return data in a Map by @​Snuffleupagus in #​21418
• Add a PDFViewer helper method for setting #printingAllowed and dispatching the event by @​Snuffleupagus in #​21409
• Fix form fields with their own canvas updated on non-rendered pages by @​calixteman in #​21407
• [CRX] List all viewer-accessible schemes in the connect-src CSP by @​calixteman in #​21419
• Improve rendering of comb text fields by @​calixteman in #​21413
• Drop 'unsafe-inline' from the CSP style-src directives by @​calixteman in #​21416
• Use the convertBlackAndWhiteToRGBA helper with grayscale images in putBinaryImageData by @​Snuffleupagus in #​21427
• Fix the unit-tests for on-demand password handling of encrypted attachments (issue 21425) by @​Snuffleupagus in #​21429
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21433
• Handle corrupt PDFs that lack /Kids array and just inline the /Page dictionary (issue 21436) by @​Snuffleupagus in #​21437
• Use the checkboxes and radio button appearances as defined in the pdf to render them in the annotation layer (bug 1802506) by @​calixteman in #​18907
• [api-minor] Remove the unused convertToViewportRectangle method in the PageViewport class by @​Snuffleupagus in #​21426
• Use the isDict helper function in a few more places by @​Snuffleupagus in #​21431
• Use Map.prototype.getOrInsertComputed() more in the code-base by @​Snuffleupagus in #​21439
• Re-factor the isSourcePDF handling in the JpegImage class by @​Snuffleupagus in #​21441
• Reduce duplication when invoking finishWorkerTask by @​Snuffleupagus in #​21443
• Update dependencies to the most recent versions by @​timvandermeij in #​21446
• Add an integration-test for merging a corrupt PDF by @​Snuffleupagus in #​21452
• Add an integration-test for merging a password-protected PDF by @​Snuffleupagus in #​21444
• Use the convertRGBToRGBA helper with RGB images in putBinaryImageData by @​Snuffleupagus in #​21440
• Fix intermittent failure in the must check that the comment sidebar is resizable comment integration test by @​timvandermeij in #​21448
• Don't download Puppeteer browsers on npm install by @​timvandermeij in #​21453
• Upgrade eslint-plugin-unicorn to version 66.0.0 by @​timvandermeij in #​21454
• Resolve checkbox/radio export values from the 'Opt' entry by @​calixteman in #​21428
• Remove the unused HighlightOutline.prototype.classNamesForOutlining getter by @​Snuffleupagus in #​21456
• Remove unneeded check in the "GetAnnotationsByType" worker-thread handler by @​Snuffleupagus in #​21457
• Draw non-isolated blend-mode groups against their backdrop (bug 1873345) by @​calixteman in #​21455
• Bump github/codeql-action from 4.36.1 to 4.36.2 by @​dependabot[bot] in #​21461
• Use ternary expressions to shorten code in src/core/editor/pdf_editor.js by @​Snuffleupagus in #​21459
• Bump markdown-it from 14.1.1 to 14.2.0 by @​dependabot[bot] in #​21464
• Adjust the 'BaseException' unit-test for the 'Error.stack' changes in Firefox by @​calixteman in #​21463
• Don't clamp BlueScale up when a font genuinely has small zones by @​calixteman in #​21462
• Check every LinkAnnotation when testing if inferred links overlap (issue 21458) by @​Snuffleupagus in #​21460
• Add a 'supportsDownloading' browser option to gate saving/downloading by @​calixteman in #​21310
• Re-derive annotation attachment content from the xref after cleanup by @​calixteman in #​21465
• Remove unused branches in the src/display/canvas.js file by @​Snuffleupagus in #​21467
• Avoid too long BlueScale value when rewriting a CFF font by @​calixteman in #​21469
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21471
• Add a unit-test for relative URI actions specified as /Name instances by @​Snuffleupagus in #​21476
• Remove unnecessary explicit return statements in CanvasGraphics.prototype.showText by @​Snuffleupagus in #​21473
• Bump undici from 7.24.3 to 7.28.0 by @​dependabot[bot] in #​21472
• Stop event propagation, for the Enter key, in the passwordPrompt input by @​Snuffleupagus in #​21482
• Remove the unused AnnotationEditorUIManager.prototype.isSelected method by @​Snuffleupagus in #​21470
• Use the isDict helper in the Catalog.prototype.metadata getter by @​Snuffleupagus in #​21481
• Don't swallow MissingDataExceptions in the Annotation.prototype.#setOptionalContent method (PR 21313 follow-up) by @​Snuffleupagus in #​21479
• A couple of small tweaks of the StructElementNode.prototype.mathML getter by @​Snuffleupagus in #​21480
• Vertically center the glyphs in comb text fields by @​calixteman in #​21478
• Reset alpha before drawing a colored glyph in type 3 font by @​calixteman in #​21483
• Use AES256 for V=5 documents with a mislabeled AESV2 crypt filter (bug 2046659) by @​calixteman in #​21485
• Add support for RichMedia annotations by @​calixteman in #​21474
• Remove the AnnotationEditorUIManager and IdManager test-only reset methods (PR 19809 follow-up) by @​Snuffleupagus in #​21489
• Sort the mappings last in the readCmapTable function (PR 19321 follow-up) by @​Snuffleupagus in #​21491
• Improve the sink handling in getTextContent for Highlight annotations (PR 20019 follow-up) by @​Snuffleupagus in #​21486
• Add support for Screen annotations playing embedded media by @​calixteman in #​21490
• Update dependencies to the most recent versions by @​timvandermeij in #​21492
• Include the catalog instance in the annotationGlobals data by @​Snuffleupagus in #​21488
• Bump library version to 6.1 by @​Snuffleupagus in #​21499
• Tweak some String.prototype.substring() usage by @​Snuffleupagus in #​21497
• Change issue17906 to test "forms" rendering by @​Snuffleupagus in #​21502
• Move SVG text selection styles to pdf_viewer.css (bug 2049302) by @​nicolo-ribaudo in #​21504
• Render non-empty glyph 0 for char code 0 by @​calixteman in #​21487
• Disable selection rendering when backdrop-filter is unsupported (bug 2050191) by @​calixteman in #​21500
• Inline the init method in the StructTreeRoot constructor by @​Snuffleupagus in #​21505
• Use more optional chaining in the src/ and web/ folders by @​Snuffleupagus in #​21508

v6.0.227

Compare Source

PDF.js 6.0 is a major release that contains a number of API changes, features and bugfixes.

The complete list of changes in this release is shown below. If you're upgrading to PDF.js 6.0 we recommend checking the changes prefixed with [api-minor] and [api-major] since those might require updates to your code.

Changes since v5.7.284

• Bump the stable version in pdfjs.config by @​timvandermeij in #​21177
• Improve the performances of "gulp lint" by @​calixteman in #​21169
• Convert Catalog.prototype.getPageIndex to an asynchronous method by @​Snuffleupagus in #​21181
• Split integration tests into per-browser jobs by @​calixteman in #​21179
• Bump actions/setup-node from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​21182
• Split the unit/font tests into per-browser jobs by @​timvandermeij in #​21183
• Send 'Terminate' to the worker when destroy races the load-time handshake (bug 1942304) by @​calixteman in #​21175
• Collect worker-side coverage for browser unit tests by @​calixteman in #​21178
• Fix HCM colors for the views-manager massive unselect button (bug 2035551) by @​calixteman in #​21187
• Use Istanbul instrumentation for unittestcli code coverage by @​calixteman in #​21189
• Add an abstract readBlock method in the DecodeStream class by @​Snuffleupagus in #​21190
• Move unittestcli coverage collection to ci.yml by @​timvandermeij in #​21191
• Fix the intermittent test failure 'performs a search in a text containing some Hangul syllables' by @​calixteman in #​21193
• Slighty improve codecov stuff in gh actions by @​calixteman in #​21194
• Improve error handling in the PDFFindController.prototype.#extractText method by @​Snuffleupagus in #​21197
• Wait for the first page to be ready in the reorganize pages integration tests by @​timvandermeij in #​21186
• Simplify the nextChunk handling in the DecryptStream class by @​Snuffleupagus in #​21198
• Shorten how intersectors are added to the grid in the Intersector constructor by @​Snuffleupagus in #​21200
• Optimize memory usage in the unit tests by @​timvandermeij in #​21195
• Remove obsolete pdfBug: true flag in the image caching unit test by @​timvandermeij in #​21203
• Add some colors in the logs in order to easily see failures and add a summary of the failures at the end by @​calixteman in #​21192
• Improve performance of the "caches image resources at the document/page level as expected (issue 11878)" unit-test by @​Snuffleupagus in #​21206
• Use a reduced test-case for the "caches image resources at the document/page level as expected (issue 11878)" unit-test by @​Snuffleupagus in #​21207
• Fix free highlight on pages without images (bug 2035530) by @​calixteman in #​21196
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21208
• [api-major] Update the minimum supported browsers, and remove no longer needed polyfills by @​Snuffleupagus in #​21152
• [api-minor] Use the ImageDecoder by default on Chrome by @​calixteman in #​20961
• Bump library version to 6.0 by @​Snuffleupagus in #​21209
• Optimize runtime of the find controller unit tests by @​timvandermeij in #​21210
• Don't provide unused /DecodeParms when initializing JpxStream by @​Snuffleupagus in #​21211
• Remove the CompilerOutput.prototype.finalData getter, and a few other font improvements (PR 21053 follow-up) by @​Snuffleupagus in #​21214
• Replace a loop with TypedArray.prototype.set() in the compileFDSelect method by @​Snuffleupagus in #​21215
• Remove the unused raw field from the CFFCharset class by @​Snuffleupagus in #​21216
• Replace TrueTypeTableBuilder and CompilerOutput with a single class by @​Snuffleupagus in #​21220
• Add an abstract WasmImage class, that JBig2CCITTFaxImage and JpxImage inherit from by @​Snuffleupagus in #​21225
• Clear the text layer container when cancelling rendering by @​calixteman in #​21219
• Run unit-tests in Node.js version 26 by @​Snuffleupagus in #​21224
• A couple of small tweaks of the getPdfFilenameFromUrl helper by @​Snuffleupagus in #​21222
• Include the external/ folder in the coverage report for gulp unittestcli by @​Snuffleupagus in #​21226
• Tweak the WasmImage implementation a little bit (PR 21225 follow-up) by @​Snuffleupagus in #​21229
• Bump ip-address from 10.1.0 to 10.2.0 by @​dependabot[bot] in #​21232
• Make sure the focus moves on the first page of the added pdf after a merge (bug 2034827) by @​calixteman in #​21223
• Place new annotations on the correct page when extracting pages (bug 2027682) by @​calixteman in #​21228
• Improve soft mask composition performance (bug 2033095) by @​calixteman in #​21235
• Simplify '#getFilteredPageIndices' and '#resolveInsertAfterIndices' by @​calixteman in #​21231
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21237
• Bump fast-xml-builder from 1.1.5 to 1.2.0 by @​dependabot[bot] in #​21243
• Bump fast-uri from 3.1.0 to 3.1.2 by @​dependabot[bot] in #​21244
• Bump @​babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.4 by @​dependabot[bot] in #​21248
• Make the PDFDataRangeTransport streaming unit-tests faster by @​Snuffleupagus in #​21238
• Use Uint8Array.fromHex in test/unit/crypto_spec.js by @​Snuffleupagus in #​21246
• Fall back to pixel-buffer SMask filtering when ctx.filter is unavailable by @​calixteman in #​21236
• [api-major] Remove support for calling getDocument without a parameter object, and remove the PDFDocumentProxy.prototype.destroy method by @​Snuffleupagus in #​21245
• Support providing a filename unconditionally, when passing binary data to PDFViewerApplication.open by @​Snuffleupagus in #​21249
• perf: Avoid multi-second getDestinations stalls for PDFs with many named destinations by @​saripovdenis in #​21213
• Avoid cycles when getting operator list in patterns by @​calixteman in #​21230
• Move the getModificationDate helper function into src/core/core_utils.js by @​Snuffleupagus in #​21258
• Update the deepCompare helper function to handle Refs and Names correctly by @​Snuffleupagus in #​21257
• Render knockout transparency groups by @​calixteman in #​21242
• Update dependencies to the most recent versions by @​timvandermeij in #​21256
• Bump github/codeql-action from 4.35.2 to 4.35.3 by @​dependabot[bot] in #​21265
• Use FeatureTest.isCanvasFilterSupported in _bakeSMaskCanvas by @​calixteman in #​21264
• [Editor] Avoid "generating" the l10n-ids used for the a11yAlert by @​Snuffleupagus in #​21263
• Fix nested non-isolated groups in knockout rendering by @​calixteman in #​21262
• Remove the executable bit from test PDF files by @​timvandermeij in #​21267
• Avoid bundling DOM-related code in the built pdf.worker.mjs file by @​Snuffleupagus in #​21269
• Collect coverage information for the integration tests by @​timvandermeij in #​21173
• Add a lint-chmod task to catch stray executable bits by @​calixteman in #​21268
• Add a simple API unit-test for /BrotliDecode by @​Snuffleupagus in #​21271
• Enable Codecov flag carryforward for accurate coverage badge by @​calixteman in #​21274
• Ensure TextLayer hiddenCanvasElement is layout-neutral by default by @​RolandWArnold in #​21218
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21278
• Move the stringToPDFString helper function to the worker-thread by @​Snuffleupagus in #​21279
• Remove the Util.domMatrixToTransform method by @​Snuffleupagus in #​21281
• Clear the full SMask scratch canvas in compose() by @​calixteman in #​21277
• [api-minor] Move the getXfaPageViewport helper into the XfaLayer class by @​Snuffleupagus in #​21283
• Move the SVG_NS definition into src/shared/util.js by @​Snuffleupagus in #​21284
• Add a couple of very basic ColorConverters unit-tests by @​Snuffleupagus in #​21286
• Remove the unused Outline._normalizePagePoint method by @​Snuffleupagus in #​21287
• Add an integration-test for the page-name fuzzy matching in the PDFDocumentProperties dialog by @​Snuffleupagus in #​21289
• Add an integration-test for documents without contentLength available in the PDFDocumentProperties dialog by @​Snuffleupagus in #​21291
• Enable the must check that an existing highlight is ignored on hovering integration test on Windows by @​timvandermeij in #​21288
• Optimize runtime and memory usage of the integration tests by @​timvandermeij in #​21275
• Recover CFF private dict defaults zeroed by Ghostscript by @​calixteman in #​21290
• Add a Content-Security-Policy to pdf.js' viewer.html (bug 1960363) by @​calixteman in #​21261
• Move the Util.scaleMinMax helper into src/display/canvas_dependency_tracker.js by @​Snuffleupagus in #​21294
• Add more integration-tests, with multi-page documents, for the PDFDocumentProperties dialog by @​Snuffleupagus in #​21295
• Introduce integration tests for the presentation mode functionality by @​timvandermeij in #​21292
• Disable hardware acceleration for Chrome tests by @​timvandermeij in #​21299
• Make text selection more visible (bug 1879559) by @​wooorm in #​20981
• Fix 'Select all' after #​20981 by @​calixteman in #​21309
• Don't use "internal" EventBus methods in the integration-tests by @​Snuffleupagus in #​21305
• Bump actions/create-github-app-token from 3.1.1 to 3.2.0 by @​dependabot[bot] in #​21301
• Bump github/codeql-action from 4.35.3 to 4.35.4 by @​dependabot[bot] in #​21302
• Extend unit-test coverage for the getPdfFilenameFromUrl helper function by @​Snuffleupagus in #​21311
• Add basic integration-tests for the PdfTextExtractor class by @​Snuffleupagus in #​21304
• Allow merging a PDF by dropping it onto the thumbnail viewer by @​calixteman in #​21306
• Sanitize glyf composite cycles, OS/2 length and maxp version mismatches by @​calixteman in #​21300
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21316
• Use the CFF program directly for CID fonts wrapped in OpenType FontFile3 by @​calixteman in #​20542
• Shorten the fontFile lookup a tiny bit by @​Snuffleupagus in #​21322
• Shorten the XfaLayerBuilder.prototype.render method by @​Snuffleupagus in #​21317
• Use Uint8Array.fromBase64 in the test/integration/highlight_editor_spec.mjs file by @​Snuffleupagus in #​21323
• Simplify how the character BBox is scaled in src/display/canvas_dependency_tracker.js by @​Snuffleupagus in #​21324
• Add support for Optional Content in the AnnotationLayer (issue 20433) by @​Snuffleupagus in #​21313
• Fix the XRefWrapper implementation, in the src/core/editor/pdf_editor.js file by @​Snuffleupagus in #​21319
• Keep the first /Subrs and /CharStrings block by @​calixteman in #​21315
• Substitute a system font when an embedded CFF is truncated by @​calixteman in #​21320
• Update dependencies to the most recent versions by @​timvandermeij in #​21328
• Recover CFF FontBBox with negative coordinates encoded as unsigned 16-bit by @​calixteman in #​21314
• Force the text selection color to be in light mode by @​calixteman in #​21329
• Prevent inherited spacing from affecting text layer by @​danyalahmed1995 in #​21321
• Avoid a temporary variable and return results directly in a couple of functions by @​Snuffleupagus in #​21332
• Load the predefined CMap for composite fonts that omit the FontDescriptor by @​calixteman in #​21331
• Enable 'eslint-plugin-regexp' and fix existing findings by @​calixteman in #​21330
• Recover the browser session on test timeout to keep running subsequent tests by @​calixteman in #​21333
• Run unit-tests and integration-tests when the external/builder/ folder is changed by @​Snuffleupagus in #​21340
• Remove unused variables with the Babel plugin by @​nicolo-ribaudo in #​21339
• Revert "Remove unused variables with the Babel plugin" by @​Snuffleupagus in #​21342
• Add support for encrypted attachments by @​wooorm in #​21234
• Bump github/codeql-action from 4.35.4 to 4.35.5 by @​dependabot[bot] in #​21344
• Bump codecov/codecov-action from 6.0.0 to 6.0.1 by @​dependabot[bot] in #​21345
• Use a black backdrop for Luminosity SMasks when /BC is missing by @​calixteman in #​21348
• Allow merging several PDFs at once via the picker or drag-and-drop by @​calixteman in #​21335
• Parse CID-keyed Type 1 fonts instead of falling back to a system font by @​calixteman in #​21336
• l10n: Update locale files by @​sync-l10n-for-pdf-js[bot] in #​21354
• Allow inserting an image as a new page when editing a PDF (bug 2032967) by @​calixteman in #​21334
• Clamp out-of-range BlueScale to Adobe's valid window by @​calixteman in #​21343
• Add a pref to postMessage when mozPrintCallback has completed (bug 2036265) by @​calixteman in #​21308
• Fix missing non-zero exit code for failure cases in test.mjs by @​timvandermeij in #​21357
• Upgrade Puppeteer to version 25.1.0 by @​timvandermeij in #​21285
• Re-factor how "internal" EventBus listeners are handled in the viewer by @​Snuffleupagus in #​21355

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.