Pin pdfjs-dist to 5.4.530 in pdf-server

[ochafik]

Summary

@modelcontextprotocol/server-pdf declares pdfjs-dist: ^5.0.0, so a fresh install resolves the newest 5.x (currently 5.7.284). That release is affected by GHSA-hq66-cqwq-w95j / CVE-2026-16633 (arbitrary JavaScript execution when opening a crafted PDF), which covers pdfjs-dist 5.6.83 up to 6.2.108.

This pins the exact version the lockfile and CI already use, 5.4.530, which is outside the affected range. Node support does not change: server-pdf keeps engines.node >=20 (pdfjs-dist 5.4.530 itself declares >=20.16.0 || >=22.3.0, as before).

Moving to pdf.js 6 is a larger change (it needs Node 22.13+ and API changes in both the server and the viewer), so it can follow separately.

Test plan

• The diff is one line in examples/pdf-server/package.json and the matching workspace entry in package-lock.json. The lockfile already resolved pdfjs-dist@5.4.530, so no installed code changes.
• npm ci installs pdfjs-dist@5.4.530, and npm pack of examples/pdf-server shows "pdfjs-dist": "5.4.530" with engines.node still >=20.
• The pre-commit build (build:all, prettier) passes; the full suite is left to CI on this PR.

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/ext-apps

npm i https://pkg.pr.new/@modelcontextprotocol/ext-apps@789

@modelcontextprotocol/server-basic-preact

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-preact@789

@modelcontextprotocol/server-basic-react

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-react@789

@modelcontextprotocol/server-basic-solid

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-solid@789

@modelcontextprotocol/server-basic-svelte

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-svelte@789

@modelcontextprotocol/server-basic-vanillajs

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-vanillajs@789

@modelcontextprotocol/server-basic-vue

npm i https://pkg.pr.new/@modelcontextprotocol/server-basic-vue@789

@modelcontextprotocol/server-budget-allocator

npm i https://pkg.pr.new/@modelcontextprotocol/server-budget-allocator@789

@modelcontextprotocol/server-cohort-heatmap

npm i https://pkg.pr.new/@modelcontextprotocol/server-cohort-heatmap@789

@modelcontextprotocol/server-customer-segmentation

npm i https://pkg.pr.new/@modelcontextprotocol/server-customer-segmentation@789

@modelcontextprotocol/server-debug

npm i https://pkg.pr.new/@modelcontextprotocol/server-debug@789

@modelcontextprotocol/server-lazy-auth

npm i https://pkg.pr.new/@modelcontextprotocol/server-lazy-auth@789

@modelcontextprotocol/server-map

npm i https://pkg.pr.new/@modelcontextprotocol/server-map@789

@modelcontextprotocol/server-pdf

npm i https://pkg.pr.new/@modelcontextprotocol/server-pdf@789

@modelcontextprotocol/server-scenario-modeler

npm i https://pkg.pr.new/@modelcontextprotocol/server-scenario-modeler@789

@modelcontextprotocol/server-shadertoy

npm i https://pkg.pr.new/@modelcontextprotocol/server-shadertoy@789

@modelcontextprotocol/server-sheet-music

npm i https://pkg.pr.new/@modelcontextprotocol/server-sheet-music@789

@modelcontextprotocol/server-system-monitor

npm i https://pkg.pr.new/@modelcontextprotocol/server-system-monitor@789

@modelcontextprotocol/server-threejs

npm i https://pkg.pr.new/@modelcontextprotocol/server-threejs@789

@modelcontextprotocol/server-transcript

npm i https://pkg.pr.new/@modelcontextprotocol/server-transcript@789

@modelcontextprotocol/server-video-resource

npm i https://pkg.pr.new/@modelcontextprotocol/server-video-resource@789

@modelcontextprotocol/server-wiki-explorer

npm i https://pkg.pr.new/@modelcontextprotocol/server-wiki-explorer@789

commit: 0f78156

[charredlatte]

This is gas