fix(security): raise npm HIGH baseline for pdfjs-dist, nanoid, undici

[seonghobae]

Summary

• Bumps pdfjs-dist 6.1.200 → 6.2.108 (GHSA-hq66-cqwq-w95j / CVE-2026-16633, arbitrary JS execution via malicious PDF)
• Bumps nanoid 3.3.16 → 3.3.18 (GHSA-2v37-7h3g-55p8, custom generator infinite loop)
• Bumps undici 7.28.0 → 7.29.0 (response desynchronization, cache-directive disclosure, CRLF injection, cookie attribute advisories)
• Adds Keep-a-Changelog Fixed entry

Why now

security-audit (npm audit --workspaces --audit-level=high) and trivy-fs (CVE-2026-16633) fail on every open PR and on protected develop@acdbea63 itself. This is the canonical baseline fix tracked by #783; merging it unblocks the required-gate contract for the whole PR queue.

Verification

• npm audit --workspaces --audit-level=high → 0 vulnerabilities (local, exact worktree)
• npm run test --workspace apps/desktop → all pass, coverage 100% statements/branches/functions/lines
• pdfjs usage sites: features/score/pdfjs.ts, ScoreViewer.tsx (minor-version bump within 6.x, no API change)

Closes #783

Security Notes

• Untrusted input surface unchanged: no new runtime code paths; dependency-only lockfile/package manifest update.
• Trust boundary: PDF rendering path in desktop viewer receives the patched pdfjs-dist; malicious-PDF execution advisory is remediated at the dependency layer.
• Safe failure: no behavior change expected on scan failure paths; CI gates re-run on this exact head.

---

Summary by CodeRabbit

• 버그 수정
  • PDF 처리 및 네트워크 관련 구성 요소의 보안 취약점을 해결했습니다.
  • 관련 보안 권고 사항과 수정 내역을 릴리스 기록에 반영했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a607717-fc7c-46d2-8efc-7635801b083d

📥 Commits

Reviewing files that changed from the base of the PR and between acdbea6 and ffb81da.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• CHANGELOG.md
• apps/desktop/package.json

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

pdfjs-dist를 6.1.200에서 6.2.108로 업데이트했습니다. CHANGELOG에 관련 보안 의존성 기준선과 권고 사항을 추가했습니다.

Changes

보안 의존성 기준선

Layer / File(s)	Summary
PDF.js 버전 및 변경 기록 업데이트 apps/desktop/package.json, CHANGELOG.md	pdfjs-dist 버전을 6.2.108로 변경했습니다. pdfjs-dist, nanoid, undici의 보안 업데이트 기준과 권고 사항을 기록했습니다.

Estimated code review effort: 1 (매우 낮음) | ~5분

Merge Risk: ⚪ Minimal · up to ffb81

This PR updates vulnerable dependencies and the lockfile without adding runtime code paths; no actionable merge-blocking risk remains after the reported checks pass.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	pdfjs-dist 변경과 CHANGELOG 기록은 확인되지만 nanoid, undici, 잠금 파일 및 필수 런타임·CI 조건은 검증할 수 없습니다.	제외된 package-lock.json과 관련 런타임·CI 설정의 정확한 현재 헤드 증거를 제공하십시오.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 보안 의존성 기준 상향이라는 주요 변경을 정확하고 간결하게 설명합니다.
Out of Scope Changes check	✅ Passed	변경된 CHANGELOG.md와 apps/desktop/package.json은 연결된 보안 의존성 기준 목표와 직접 관련됩니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/security-npm-baseline-783

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 0 potential issues.

[seonghobae]

Ownership/succession check against the live dependency-security lane:

• fix(security): raise npm HIGH baseline for pdfjs-dist, nanoid, undici #1015 exact head: ffb81da335fdd9d3a379d51a910eb323571dea42, one commit over protected develop@acdbea6344fe1231c39535b575f4de35e4c607c9, changing only CHANGELOG.md, apps/desktop/package.json, and package-lock.json.
• Canonical owner fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 exact head: 1168c8f4257de5de036ea54bf5ee73edb83e775e, same protected base.
• fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 already contains pdfjs-dist@6.2.108, nanoid@3.3.18, and root undici@7.29.0, plus the reviewed npm 10.9.9 lock-generator/runtime provenance, frozen-lock validation, credential-persistence hardening, PDF byte/worker hardening, and regression/doctoring evidence for this baseline.
• Direct commit comparison shows the branches diverge from the same protected base, with fix(security): raise npm HIGH baseline for pdfjs-dist, nanoid, undici #1015 carrying one independent dependency-only commit while fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783 carries the wider canonical dependency-root implementation. fix(security): raise npm HIGH baseline for pdfjs-dist, nanoid, undici #1015 therefore has no unique dependency version or buyer/security behavior to preserve.
• fix(security): raise npm HIGH baseline for pdfjs-dist, nanoid, undici #1015's independently regenerated lock also removes generated peer metadata in the diff; transferring that lock churn would conflict with fix(security): establish canonical npm, PDF.js, Nanoid, and Undici baseline #783's explicit generator-sensitive provenance contract.

Closing #1015 unmerged as a competing/superseded dependency-security writer. Continue all remediation, current-head review, coverage and merge gating on #783. This closure does not mean #783 is merge-ready and does not waive any required exact-head checks or independent approval.