vscode-pdf Next

Modern, lightweight PDF viewer for VS Code.

vscode-pdf Next is Ricardo's security-hardened successor to the classic tomoki1207.vscode-pdf preview extension. It focuses on fast local PDF viewing, predictable reload behavior, and a small packaged runtime.

Features

• PDF.js 5 viewer runtime bundled for VS Code webviews.
• Live reload with debounce and focus preservation for TeX/Typst-style build loops.
• Outline and bounded thumbnail sidebars.
• Per-PDF view-state restore for page, zoom, scroll, sidebar, and active sidebar panel.
• Appearance modes for clear, dark chrome, Night, Reader-compatible Night, and full inversion fallback.
• Local inter-PDF links that preserve fragments such as #page=2.
• Host-side print command with a no-shell custom command override.
• Keyboard navigation for scrolling, paging, first/last page, and zoom.

Install

From Marketplace or Open VSX

Once published, install ricardofrantz.pdf-preview-next from the VS Code Marketplace or Open VSX. In VS Code, run:

code --install-extension ricardofrantz.pdf-preview-next

From a VSIX release

Download the VSIX from the GitHub release and install it directly:

code --install-extension pdf-preview-next-<version>.vsix --force

To make VS Code use this viewer for PDFs:

"workbench.editorAssociations": {
  "*.pdf": "pdf-preview-next.preview"
}

Settings

Resource-scoped settings can be overridden per workspace folder or PDF resource where VS Code supports resource configuration. Reload settings remain global because they control file watching rather than document rendering defaults. Custom print commands execute local programs without a shell and are restricted under VS Code Workspace Trust. The toolbar Print action deliberately opens the PDF in the system viewer; direct queue printing is available through the separate vscode-pdf Next: Print Directly to Default Printer command.

Commands And Controls

Security Model

This repository has been security-audited by Claude Opus 4.7 (April 2026). The current runtime uses pdfjs-dist@5.6.205 with:

• nonce-bound webview scripts;
• scoped localResourceRoots;
• explicit PDF.js worker loading;
• PDF.js eval and WASM execution disabled;
• no shell execution for the default print path;
• a packaged artifact scanner that rejects source files, maps, tests, scratch files, and missing runtime assets.

Build From Source

bun install --frozen-lockfile
bun run typecheck
bun run lint
bun run test
bun run package -- --no-dependencies
bun run package:scan -- pdf-preview-next-<version>.vsix

Useful scripts:

The release workflow is guarded for maintainers: third-party actions are pinned by full commit SHA, CI/release jobs use concurrency groups, and tag pushes only verify/package the release. GitHub Release, Marketplace, and Open VSX publishing require a manual workflow_dispatch run with dry_run=false, a matching confirm_publish phrase, and approval through the marketplace-publish GitHub environment. Configure that environment with required reviewers before adding publish tokens.

Maintenance

The extension is intentionally stable. Routine work should mostly be dependency, PDF.js, VS Code, packaging, and release-infrastructure upkeep rather than new features. See docs/MAINTENANCE.md for the update cadence, verification ladder, PDF.js upgrade flow, security-review triggers, and release checklist.

Upgrade PDF.js

1. Update tools/update_pdfjs.jsonc with the target pdfjs-dist version and npm integrity value.

2. Run:

   bun run update:pdfjs
   

3. Verify with bun run typecheck, bun run lint, bun run test, and bun run package:scan -- <vsix>.

Known Non-goals

This extension is intentionally a previewer, not a PDF editor or platform API. The following remain out of scope unless the project direction changes:

• PDF editing;
• persistent annotations;
• delete-pages or rearrange-pages support;
• a public cross-extension PDF.js API;
• cloud synchronization or document storage;
• broad automation features unrelated to previewing local PDFs.

Changelog

See CHANGELOG.md.

License

Please see LICENSE.