fix(security): bump pdfjs-dist 6.2.108 (CVE-2026-16633), undici >=7.29.0, nanoid 3.3.18

[seonghobae]

Security Notes

Findings remediated (all real trivy-fs / npm-audit findings blocking open PRs)

Package	From → To	Advisory	Severity
pdfjs-dist	6.1.200 → 6.2.108	CVE-2026-16633 / GHSA-hq66-cqwq-w95j (XSS via enableScripting)	HIGH (8.0–8.1)
undici (transitive via jsdom)	7.28.0 → 7.29.0 (root override ^7.29.0)	GHSA-8xcm-r25x-g524, GHSA-4cwx-7wf7-3272, GHSA-m8rv-5g2x-5cg5, GHSA-jr45-8vmc-qm54, GHSA-v3r7-h72x-cjcm	HIGH/MEDIUM
nanoid	<3.3.18 → 3.3.18	GHSA-2v37-7h3g-55p8 (infinite loop w/ zero-size custom generator)	HIGH

Untrusted-input context

pdfjs-dist renders untrusted PDF files in the desktop intake path; the fixed
version removes arbitrary-JS execution on crafted PDFs when scripting is
enabled and no CSP restricts script-src. Safe-failure behavior is unchanged:
malformed PDFs still fail closed to an import error.

Verification

• npm audit: 0 vulnerabilities after change.
• Frontend workspace tests: 100% statements / branches / functions / lines.
• Production build succeeds.

Expected effect on PR queue

trivy-fs (CVE-2026-16633 finding) and security-audit (undici/nanoid advisories)
failures across the ~129 open PRs are inherited from develop; merging this to
develop lets PR branches inherit green dependency scans after their next
update-branch.

---

[coderabbitai]

Warning

Review limit reached

Next included review available in 56 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e2838c9d-aff4-4c0c-afa4-0785542c9b46

📥 Commits

Reviewing files that changed from the base of the PR and between acdbea6 and df21254.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• apps/desktop/package.json
• package.json

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

📝 Info: undici override uses a caret, siblings pin exact versions

The new override undici: "^7.29.0" (package.json) is a caret range, while brace-expansion and postcss next to it pin exact versions. It stays bounded below 8.0.0 and the lockfile resolves 7.29.0, so behavior is fine today, but it can float within 7.x on a future lockfile regeneration.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

📝 Info: nanoid fix enforced only by the lockfile

The nanoid 3.3.18 remediation was applied by bumping the lockfile, with no override added. nanoid is transitive via postcss (range ^3.3.x), so regeneration still resolves >=3.3.18 and the fix holds. The remediation rests on the committed lockfile alone, not a pin.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[seonghobae]

Closing this as a semantic duplicate of the canonical dependency-security owner #783 after a fresh exact-head comparison.

Evidence at close time:

• fix(security): bump pdfjs-dist 6.2.108 (CVE-2026-16633), undici >=7.29.0, nanoid 3.3.18 #1023 exact head df21254fb141012e26bf8721b1deaa2373c5cc61 is one commit from protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9 and changes only apps/desktop/package.json, package-lock.json, and root package.json.
• Its substantive targets are pdfjs-dist@6.2.108, nanoid@3.3.18, and undici@7.29.0.
• Canonical fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 exact head 1168c8f4257de5de036ea54bf5ee73edb83e775e already owns those same versions, plus the reviewed npm 10.9.9 lock-generator/runtime provenance, exact root undici@7.29.0 with $undici override, frozen-lock/SRI verification, checkout credential hardening, PDF hardening, regression coverage, and repository-local security gates.
• fix(security): bump pdfjs-dist 6.2.108 (CVE-2026-16633), undici >=7.29.0, nanoid 3.3.18 #1023 is 93 commits behind fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 from the same protected-base merge base. Its unique delta is not product/security behavior that must be preserved: it includes a looser ^7.29.0 override and incidental lockfile peer-marker churn.

The unresolved informational review comments on #1023 reinforce that its lock/provenance contract is weaker than #783; they are not migrated because the canonical branch already has the stronger exact-version/provenance boundary.

This closure does not claim the dependency remediation is shipped on protected develop: #783 is still open and must satisfy its unchanged exact-head central Strix/review/approval gates before ordinary protected merge. Dependency-security writer authority remains #783 only.