{
  "$comment": "ngx-extended-pdf-viewer bundles a fork of Mozilla pdf.js, so pdfjs-dist cannot appear in package.json. This file records which pdf.js each bundle is derived from. Generated by build-tools/base-library/update-pdfjs-provenance.js.",
  "generatedBy": "build-tools/base-library/update-pdfjs-provenance.js",
  "channels": {
    "bleedingEdge": {
      "bundle": "bleeding-edge",
      "pdfjsBuildVersion": "6.1.1164",
      "upstream": {
        "project": "mozilla/pdf.js",
        "repository": "https://github.com/mozilla/pdf.js",
        "release": "6.1.200",
        "tag": "v6.1.200",
        "commit": "6353acefe5007cd4899247a8c4e83cb7c9435a54",
        "committedAt": "2026-06-27T13:51:54+02:00"
      },
      "fork": {
        "repository": "https://github.com/stephanrauh/pdf.js",
        "branch": "bleeding-edge",
        "commit": "14922696fc0b001d328db934f4846f64391ec19d",
        "committedAt": "2026-08-06T21:50:57+02:00"
      },
      "securityFixes": [
        {
          "id": "GHSA-hq66-cqwq-w95j",
          "cve": "CVE-2026-16633",
          "url": "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
          "summary": "Arbitrary JavaScript execution upon opening a malicious PDF",
          "fixedUpstreamIn": "6.2.108",
          "appliedVia": "cherry-pick",
          "upstreamCommits": [
            {
              "upstream": "6c18df5768a9cf12e725ebf12fc70e32358be1fa",
              "inFork": "a2b7ddd18bc14f270f2f1744348037d12c61ba78",
              "via": "cherry-pick"
            },
            {
              "upstream": "4ea07c2431141fe66df3a2f53af53cc8ad854191",
              "inFork": "250ae2598bfcce4d55afd9589d88a3e0fec7a4bf",
              "via": "cherry-pick"
            }
          ],
          "detail": "Upstream requires enableScripting (true by default in pdf.js) for the sandbox half of this issue; ngx-extended-pdf-viewer ships enableScripting=false by default. The XFA rich-text half is reachable whenever enableXfa is true, which IS the default here, so we do not claim the default configuration was safe. Both upstream fix commits are applied to the bundled engine."
        }
      ]
    },
    "stable": {
      "bundle": "assets",
      "pdfjsBuildVersion": "6.1.1164",
      "upstream": {
        "project": "mozilla/pdf.js",
        "repository": "https://github.com/mozilla/pdf.js",
        "release": "6.1.200",
        "tag": "v6.1.200",
        "commit": "6353acefe5007cd4899247a8c4e83cb7c9435a54",
        "committedAt": "2026-06-27T13:51:54+02:00"
      },
      "fork": {
        "repository": "https://github.com/stephanrauh/pdf.js",
        "branch": "6.1",
        "commit": "95ad784282ae10686787b477b0691f5c684bce02",
        "committedAt": "2026-08-06T21:51:16+02:00"
      },
      "securityFixes": [
        {
          "id": "GHSA-hq66-cqwq-w95j",
          "cve": "CVE-2026-16633",
          "url": "https://github.com/mozilla/pdf.js/security/advisories/GHSA-hq66-cqwq-w95j",
          "summary": "Arbitrary JavaScript execution upon opening a malicious PDF",
          "fixedUpstreamIn": "6.2.108",
          "appliedVia": "cherry-pick",
          "upstreamCommits": [
            {
              "upstream": "6c18df5768a9cf12e725ebf12fc70e32358be1fa",
              "inFork": "d12ca786c55be8e7d6b9cbed89202c20051a5629",
              "via": "cherry-pick"
            },
            {
              "upstream": "4ea07c2431141fe66df3a2f53af53cc8ad854191",
              "inFork": "4801a3c254d78fac8c5b4187e249d6f290e9d7a5",
              "via": "cherry-pick"
            }
          ],
          "detail": "Upstream requires enableScripting (true by default in pdf.js) for the sandbox half of this issue; ngx-extended-pdf-viewer ships enableScripting=false by default. The XFA rich-text half is reachable whenever enableXfa is true, which IS the default here, so we do not claim the default configuration was safe. Both upstream fix commits are applied to the bundled engine."
        }
      ]
    }
  }
}