feat: retrieve pdfjs worker locally instead of cdn

Author: gjulivan

packages/pluggableWidgets/document-viewer-web/CHANGELOG.md

@@ -6,6 +6,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 
 ## [Unreleased]
 
+### Changed
+
+- We moved the bundle of pdfjs worker to local build instead of using CDN for better CSP compliance.
+
 ## [1.0.0] - 2025-05-05
 
 ### Added

packages/pluggableWidgets/document-viewer-web/components/PDFViewer.tsx

@@ -6,10 +6,15 @@ import { downloadFile } from "../utils/helpers";
 import { useZoomScale } from "../utils/useZoomScale";
 import BaseViewer from "./BaseViewer";
 import { DocRendererElement, DocumentRendererProps, DocumentStatus } from "./documentRenderer";
-pdfjs.GlobalWorkerOptions.workerSrc = `//unpkg.com/pdfjs-dist@${pdfjs.version}/build/pdf.worker.min.mjs`;
+
+pdfjs.GlobalWorkerOptions.workerSrc = new URL(
+    "/widgets/com/mendix/shared/pdfjs/pdf.worker.mjs",
+    import.meta.url
+).toString();
+
 const options = {
-    cMapUrl: `https://unpkg.com/pdfjs-dist@${pdfjs.version}/cmaps/`,
-    standardFontDataUrl: `https://unpkg.com/pdfjs-dist@${pdfjs.version}/standard_fonts`
+    cMapUrl: "/widgets/com/mendix/shared/pdfjs/cmaps/",
+    standardFontDataUrl: "/widgets/com/mendix/shared/pdfjs/standard_fonts"
 };
 
 const PDFViewer: DocRendererElement = (props: DocumentRendererProps) => {

packages/pluggableWidgets/document-viewer-web/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@mendix/document-viewer-web",
     "widgetName": "DocumentViewer",
-    "version": "1.0.0",
+    "version": "1.1.0",
     "description": "View PDF and other document types",
     "copyright": "© Mendix Technology BV 2025. All rights reserved.",
     "license": "Apache-2.0",
@@ -38,8 +38,8 @@
         "@mendix/widget-plugin-component-kit": "workspace:*",
         "@mendix/widget-plugin-platform": "workspace:*",
         "classnames": "^2.5.1",
-        "docx-preview": "^0.3.5",
-        "pdfjs-dist": "^5.0.375",
+        "docx-preview": "^0.3.6",
+        "pdfjs-dist": "4.8.69",
         "react-pdf": "^9.2.1",
         "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz"
     },

packages/pluggableWidgets/document-viewer-web/rollup.config.mjs

@@ -1,5 +1,6 @@
 import commonjs from "@rollup/plugin-commonjs";
 import replace from "@rollup/plugin-replace";
+import copy from "rollup-plugin-copy";
 import { copyDefaultFilesPlugin } from "@mendix/rollup-web-widgets/copyFiles.mjs";
 
 export default args => {
@@ -43,7 +44,26 @@ export default args => {
                         "!PDFWorkerUtil.isWorkerDisabled && !PDFWorker.#mainThreadWorkerMessageHandler": "false"
                     }
                 }),
-                copyDefaultFilesPlugin()
+                copyDefaultFilesPlugin(),
+                copy({
+                    targets: [
+                        {
+                            src: "node_modules/pdfjs-dist/cmaps",
+                            dest: "dist/tmp/widgets/com/mendix/shared/pdfjs/",
+                            flatten: false
+                        },
+                        {
+                            src: "node_modules/pdfjs-dist/standard_fonts",
+                            dest: "dist/tmp/widgets/com/mendix/shared/pdfjs/",
+                            flatten: false
+                        },
+                        {
+                            src: "node_modules/pdfjs-dist/build/pdf.worker.min.mjs",
+                            dest: "dist/tmp/widgets/com/mendix/shared/pdfjs/",
+                            rename: "pdf.worker.mjs"
+                        }
+                    ]
+                })
             ]
         };
     });