ng2-pdfjs-viewer 26.5.0

Release v26.5.0

on Node.js NPM

Bundled PDF.js: 6.4.299 (was 6.0.227).

Security

• The bundled PDF.js moves from 6.0.227 to 6.4.299, which includes Mozilla's security
  fixes from the 6.1 to 6.4 releases. Every earlier 26.x release bundles 6.0.227, so
  please upgrade. Mozilla's release notes:
  https://github.com/mozilla/pdf.js/releases

Changed

• customCSS is now applied with a constructable stylesheet (adoptedStyleSheets) inside
  the viewer instead of a <style> element. The viewer page's Content Security Policy in
  PDF.js 6.4 no longer allows inline <style> elements (PDF.js moved its own print styles
  the same way), so the old approach would have been blocked. CSP doesn't apply to
  constructable stylesheets, so cspNonce is no longer needed for customCSS and is
  ignored. One limit: @import rules inside customCSS aren't supported there.
• The polyfills injected into the bundled PDF.js now also cover Map/WeakMap
getOrInsert and WeakMap.getOrInsertComputed, which PDF.js 6.4 calls in the worker
  and the viewer.

Fixed

• The CHANGELOG entry for the PDF.js 5.3.93 upgrade was headed "20.4.0 - 2024-12-07";
  it is 25.0.0, published 2025-09-08, and the upgrade was from PDF.js 2.2.171.
• BILL-OF-MATERIALS.md lists the bundled components and licences as they are: the
  Liberation Sans fonts PDF.js ships are version 1.07.4 under the Liberation font licence
  (GPL-2.0 with a font exception), not the SIL OFL, and the JBIG2 decoder is Apache-2.0.