From 0f78156f3cbd05d0f90d6016d52e02f5e26254ee Mon Sep 17 00:00:00 2001 From: Olivier Chafik Date: Thu, 24 Sep 2026 15:14:13 +0000 Subject: [PATCH] Pin pdfjs-dist to 5.4.530 in pdf-server The ^5.0.0 range lets a fresh install of @modelcontextprotocol/server-pdf resolve pdfjs-dist 5.7.x, which is affected by GHSA-hq66-cqwq-w95j (arbitrary JavaScript execution when opening a crafted PDF; fixed only in 6.2.108). The lockfile and CI already use 5.4.530, which is outside the affected range (5.6.83 to 6.2.108), so pin exactly that version. --- examples/pdf-server/package.json | 2 +- package-lock.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/pdf-server/package.json b/examples/pdf-server/package.json index 15472f9fc..57d4debab 100644 --- a/examples/pdf-server/package.json +++ b/examples/pdf-server/package.json @@ -36,7 +36,7 @@ "@modelcontextprotocol/server": "2.0.0", "cors": "^2.8.5", "express": "^5.1.0", - "pdfjs-dist": "^5.0.0", + "pdfjs-dist": "5.4.530", "zod": "^4.2.0" }, "devDependencies": { diff --git a/package-lock.json b/package-lock.json index d56d11e00..2fee93003 100644 --- a/package-lock.json +++ b/package-lock.json @@ -766,7 +766,7 @@ "@modelcontextprotocol/server": "2.0.0", "cors": "^2.8.5", "express": "^5.1.0", - "pdfjs-dist": "^5.0.0", + "pdfjs-dist": "5.4.530", "zod": "^4.2.0" }, "bin": {