fix(pdf-viewer): bundle legacy pdfjs-dist build to resolve WASM issues#21
Merged
fix(pdf-viewer): bundle legacy pdfjs-dist build to resolve WASM issues#21
Conversation
Bundles the legacy build of pdfjs-dist which includes JS fallbacks for environments with strict WASM policies or lacking top-level await support. This resolves compatibility issues with consumers using older bundlers or strict CSPs.
When pdfjs-dist runs its worker as a data URI, WASM files cannot be found via relative paths (import.meta.url resolves to the data URI). Providing wasmUrl to getDocument() gives the worker an absolute URL to fetch WASM from. Defaults to unpkg.com using the bundled pdfjs version so no consumer configuration is needed. Consumers can override with the wasm-url attribute if needed (e.g. for offline environments or self-hosted WASM).
… default Replace the DEFAULT_WASM_URL (unpkg.com CDN) with a LocalWasmFactory that uses ?url imports to bundle jbig2.wasm, openjpeg.wasm, and qcms_bg.wasm directly into the dist output. This eliminates the supply-chain risk of loading unverified WASM from an external CDN. - wasmUrl now defaults to null (bundled WASM used automatically) - loadPDF() uses WasmFactory: LocalWasmFactory by default; falls back to the URL-based approach only when wasm-url is explicitly set by a consumer - Document wasm-url in the README attributes table with a security note Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…M loading Remove the wasm-url attribute/property entirely. LocalWasmFactory is sufficient for all use cases — there is no need for a consumer-facing URL override that would allow arbitrary WASM to be loaded without integrity checks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
julliancalkins
approved these changes
Feb 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
WHY
Some PDFs on C12 were throwing errors and not loading certain pages. This seems to be because the WASM distribution was not being found and was not loading in. React pdf got around this by staying pinned to an older version of PDF.js but I think this is a better fix. Bundle the extra stuff with the web component.
Problem
pdfjs-distv5 requires WebAssembly binaries (jbig2.wasm,openjpeg.wasm,qcms_bg.wasm) at runtime. The initial approach defaulted to loading these from unpkg.com with no integrity verification, creating a supply-chain attack vector where a compromised CDN could deliver arbitrary WASM executed in the user's browser.Changes
?urlso they are emitted intodist/at build time. ALocalWasmFactoryserves them to PDF.js on demand; no external network requests are made.pdfjs-distimports to thelegacybuild variant (same v5, transpiled with polyfills), resolving compatibility issues with strict CSPs and older bundlers.