npm / pdfjs-dist
pdfjs-dist
What changed in pdfjs-dist 5 to 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
40 breaking8 security24 new APIs and options9 performance46 behavior and defaults66 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initpdfjs-dist 699 changes
Breaking changes 24
Font.ascent and Font.descent are no longer exported by default.
Font.defaultVMetrics is no longer exported by default.
Font.defaultWidth is no longer exported by default.
Font.mimetype is no longer exported.
Font.name is no longer exported by default.
The unused fallback parameter was removed from the localization getter.
ResetForm actions now reset descendants of non-terminal fields.
Validation of xref stream field widths is stricter, rejecting more malformed input.
Custom document information is now returned in a Map.
getFieldObjects now returns data in a Map instead of its previous representation.
getJSActions now returns data in a Map instead of its previous representation.
getPermissions now returns data in a Set instead of its previous representation.
markInfo now returns data in a Map instead of its previous representation.
getDestinations now returns its data in a Map.
getOpenAction now returns its data in a Map.
getViewerPreferences now returns its data in a Map.
The unused PageViewport method was removed.
getAttachments now returns attachment data in a Map.
Calling getDocument without a parameter object is no longer supported; callers must provide a parameter object.
The getXfaPageViewport helper moved into the XfaLayer class, so integrations using its previous location must update.
Chrome now uses ImageDecoder by default, changing image decoding behavior for applications running there.
The minimum supported browser versions were updated, and no longer needed polyfills were removed.
The PDFDocumentProxy.prototype.destroy method was removed, requiring applications to stop calling this API.
The Util.domMatrixToTransform method was removed and can no longer be used by applications.
Security 6
Automatic text-field sizing avoids a CPU denial-of-service condition.
CFF INDEX and FDArray parsing is bounded to constrain malformed font data.
Cumulative CMap range entries are now bounded to limit excessive input.
Embedded media content types are now validated before processing.
PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF
The viewer now includes a Content-Security-Policy, improving the security posture of the built-in viewer.
New APIs and options 13
The operationsFilter callback now receives the operatorList, enabling filtering decisions based on the complete operation list.
GeckoView gains typed signatures for its PDF.js integration.
Table structure attributes are exposed through the structure tree for consumers that inspect tagged PDF structure.
More tagged PDF structure roles are exposed to consumers inspecting document structure.
Digital signatures and certificates can be verified.
Sound annotations can play embedded audio.
GeckoView gains an import map entry for the digital signature properties manager.
Support was added for AuthEvent-based on-demand decryption.
RichMedia annotations are now supported.
The constructor now accepts an optional dictionary argument.
PDF.js now supports encrypted attachments, allowing applications to work with attachments protected by encryption.
PDF editing now supports inserting an image as a new page.
Binary data passed to PDFViewerApplication.open can now always include a filename.
Performance 3
Large JPEG images are downscaled with ImageDecoder, reducing resource use during decoding.
Shared font and image streams are deduplicated when PDFs are merged.
The built worker no longer bundles DOM-related code, reducing unnecessary worker bundle contents.
Behavior and default changes 15
FreeText appearances now use the platform print-to-PDF implementation.
Annotations are positioned using the structure tree.
The viewer supports two-finger panning, with zooming avoided during fast two-finger movement.
defaultOptions in web/app_options.js is now a Map.
Basic support was added for non-embedded TrebuchetMS fonts.
Entire-word search matching now uses Intl.Segmenter.
AES-256 revision 6 passwords now support SASLprep.
SmaskInData value 2 is supported for JPX images.
The text selection workaround is avoided in modern Chromium, and dark-mode selection contrast improves.
Annotation-layer rendering now uses checkbox and radio-button appearances defined in the PDF.
Installing the package no longer downloads Puppeteer browsers.
Screen annotations can now play embedded media.
The AnnotationLayer now supports Optional Content, enabling annotations associated with optional content groups.
The viewer can merge a PDF dropped onto the thumbnail viewer, adding another user-facing PDF editing workflow.
The viewer can merge several PDFs at once through the picker or drag-and-drop.
Fixes and other changes 38
Doc.resetForm now resets descendants of non-terminal fields.
ToUnicode mappings for unencoded glyphs are preserved in non-embedded Type1 fonts.
Fill-area computation is corrected for rotated tiling patterns.
Sampled functions no longer produce NaN values for degenerate domains.
Text-layer rendering now accounts for Firefox font-size quantization.
Text stroke width is corrected when the pixel-width cache is stale.
Text widgets now inherit text alignment from the AcroForm.
Transfer function arrays containing /Identity entries no longer cause crashes.
A software fallback was added for transfer maps, improving support when the accelerated path is unavailable.
Escaped literals are now preserved when formatting dates with util.printd.
PDF alternative text is exposed without prohibited ARIA names, improving accessibility integrations.
Cyclic field Parent chains no longer cause an infinite loop.
Scripts are added correctly when setting field actions.
Glyph mapping for non-embedded CID fonts is improved, producing more reliable text rendering.
PDF exports containing only images are handled correctly.
JPEG dimension mismatches are handled with ImageDecoder without resizing.
Invalid XML character references no longer cause an exception.
Marked content sections left open in a text object are automatically closed.
Numbers are no longer written in exponential notation when saving a PDF.
Selection rendering is corrected when a page is destroyed and rendered again.
Text is vertically centered in single-line and comb text fields.
Missing AcroForm fields are rebuilt, and inherited resources, appearances, flags, and signature fields are preserved or detected.
Decryption now handles non-ASCII passwords for AES-256 revision 5 PDFs.
The current editing session is committed before saving.
Non-local PDF link destinations are preserved.
OBJR children are preserved without restoring deleted pages.
Indirect and dangling structure tree root kids are handled.
Unicode names for destinations and attachments are preserved.
V=5 documents with a mislabeled AESV2 crypt filter now use AES256.
Annotation attachment content is re-derived from the xref after cleanup.
Comb text fields render more accurately, including vertically centered glyphs.
PDFs lacking a Kids array and containing an inline Page dictionary are now handled.
Selection rendering with this option disabled now works correctly.
Gray transparency groups are now rendered in grayscale.
JBIG2 file headers are stripped from JBIG2Decode streams.
Non-isolated blend-mode groups are now drawn against their backdrop.
Checkbox and radio export values are now resolved from the Opt entry.
Optional content configurations now serialize properly.
pdfjs-dist 594 changes
Breaking changes 16
The minimum supported Node.js version is now 22.
PostScriptCompiler and PostScriptEvaluator were removed because they are dead code.
The QuickJS sandbox now uses a Wasm file.
The enableHWA option was removed from viewer components.
Separate CMapReaderFactory, StandardFontDataFactory, and WasmFactory options were replaced by a single factory/option.
getDocument now requires one of data, range, or url to be provided.
The length parameter was removed from getDocument.
The deprecated PDFWorker.fromPort method was removed.
The xfatest command was removed.
Relevant BasePDFStream implementations now require an actual URL instance.
sendRequest is now asynchronous, changing how callers invoke and consume it.
The onDataProgress method was removed from PDFDataRangeTransport.
getTextContent is now asynchronous, so callers must handle its asynchronous result.
The minimum supported Google Chrome version is now 118.
deleteAnnotationElement now takes a full editor object.
FreeText annotations no longer support commenting because they do not have attached popups.
Security 2
PDF data is encrypted when merging the same PDF.
Usernames and passwords are removed from URLs.
New APIs and options 11
The viewer now provides UI for merging PDFs and prompts the user to save the merged PDF.
npx gulp server gained an option to allow external connections.
Gouraud-based shading is implemented using WebGPU.
PDF.js can extract selected pages from a PDF.
The viewer now supports deleting, cutting, copying, and pasting pages.
Pages in an extracted PDF can be reordered.
The thumbnail view gains a manage button for saving an edited PDF.
Some FontFaceObject properties can now be assigned through setters.
PDFs can be created by combining different source PDFs.
The viewer now exposes a sidebar object.
Text extraction is available through an external service.
Performance 6
Pattern creation is avoided for some basic gradients, reducing unnecessary rendering work.
Text rendering skips unnecessary pattern calculations, improving rendering performance.
Thumbnail handling uses slightly less memory.
Glyph lookup for annotation bounding boxes is more efficient.
Glyph paths use a binary format, improving path representation and processing efficiency.
Building the structure tree is faster.
Behavior and default changes 31
The Ink editor replaces its opacity slider with an alpha-enabled color input.
The CCITT fallback decoder was replaced with a JavaScript PDFium decoder.
Function-based shadings are now supported when rendering PDFs.
A GPU device is now created unconditionally, while mesh drawing uses it only above 16 triangles.
The JBig2 fallback decoder was replaced with a JavaScript PDFium decoder.
The thumbnail viewer now uses OffscreenCanvas unconditionally.
PDFDataRangeTransport now uses a single internal listener.
Merging and extracting PDFs can merge or update AcroForms.
Added annotations can be saved when reorganizing a PDF.
The worker thread now creates the filename for BaseCMapReaderFactory.
Hardware acceleration is enabled by default.
The maximum viewer scale increased to 2500 percent.
The onProgress callback consistently reports percent === NaN.
Outlines can be saved after PDF reorganization or merging.
The alt-text dialog toggle now downloads or deletes the model and enables or disables alt-text guessing.
The Annotation constructor now sets annotationType automatically.
PDF.js can now decompress Brotli-compressed data.
Keyboard shortcuts were added for copying, cutting, and deleting pages.
Loading progress is now reported automatically when using PDFDataTransportStream.
TH elements in tagged PDFs can now be interpreted as either column headers or row headers.
Deleting a comment can be undone.
PDFium's JBIG2 decoder is compiled into WebAssembly, changing how JBIG2 images are decoded.
Thumbnails can be dragged and dropped to reorganize pages, and the dropped thumbnail is selected.
The standard-font glyph map now includes additional Russian entries, improving rendering for affected text.
MathML text content is now aria-hidden and injected into MathML tags when they are in the structure tree, improving accessibility.
Edited comments can be saved using the CTRL+Enter shortcut.
The default max value in the XFA occur tag is now -1.
Editing buttons no longer use the radio role.
PT Astra Serif is available as a substitution for Times New Roman.
MathML elements are now visible in the structure tree.
StructTree now collects all child nodes of lists and tables.
Fixes and other changes 28
Attachments are preserved when merging or reorganizing a PDF.
Free-highlighting can now be applied on top of image placeholders.
TextLayerBuilder now works correctly when abortSignal is omitted.
Calling progressiveDone now resolves pending requests.
Text selection now works under search highlights.
Find-in-page continues to work correctly after pages are reorganized.
Links and the outline are corrected after reorganizing a PDF.
Local PDF requests smaller than two range requests no longer abort the full request, and standard ReadableStreams are used.
Accessibility artifacts associated with text and MathML are hidden from assistive technology and duplicate MathML labels are avoided.
Encoding was corrected for some missing Chinese fonts, improving font rendering.
CIDToGIDMap is used for Type 2 fonts with an OpenType font, improving glyph mapping.
File URL parameters are no longer decoded twice, preventing incorrect parameter handling.
Rendering no longer throws an exception for some glyph contours.
The JBIG2 decoder no longer enters an infinite loop when processing more than four referred-to segments.
The loca table length is corrected when sufficient space is available, improving font conversion correctness.
Strings matching ddd@d.dddd are no longer incorrectly treated as mail links.
Punctuation signs in search queries are escaped, improving search handling for punctuation-containing queries.
Named page destinations are updated when PDFs are combined.
The regex used to find characters normalized with NFKC during search was corrected.
Page labels are updated when a PDF is extracted.
Searching groups of punctuation signs now adds extra spaces only around the group.
Annotation positions in the DOM now follow their visual order.
Annotation DOM ordering uses annotation rectangles.
The annotation is correctly focused after its comment is removed in the annotation layer.
Deleting an editor removes its associated comment data.
The editor is focused after its comment is deleted.
All editors can receive focus from the keyboard.
Attributes in MathML tags no longer use the MathML namespace.