From 0acdcfe1b19cc0ccfc2ea24764905a9c090224c1 Mon Sep 17 00:00:00 2001 From: Olivier Chafik Date: Fri, 25 Sep 2026 14:25:56 +0000 Subject: [PATCH] Pin @cantoo/pdf-lib to 2.6.5 in pdf-server The ^2.6.5 range lets a fresh install of @modelcontextprotocol/server-pdf resolve @cantoo/pdf-lib 2.11.x, which the lockfile and CI never test. 2.11.0 also added new dependencies with open-ended ranges (culori >=4, node-html-better-parser), and the supply-chain checks on 2.11.0 and culori 4.0.2 report findings. The lockfile and CI already use 2.6.5, whose dependency tree passes those checks, so pin exactly that version. --- examples/pdf-server/package.json | 2 +- package-lock.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/examples/pdf-server/package.json b/examples/pdf-server/package.json index 9a2368390..75f5902d4 100644 --- a/examples/pdf-server/package.json +++ b/examples/pdf-server/package.json @@ -28,7 +28,7 @@ "build:mcpb": "npm run build && node build-mcpb.mjs" }, "dependencies": { - "@cantoo/pdf-lib": "^2.6.5", + "@cantoo/pdf-lib": "2.6.5", "@modelcontextprotocol/client": "2.0.0", "@modelcontextprotocol/express": "2.0.0", "@modelcontextprotocol/ext-apps": "^2.0.0", diff --git a/package-lock.json b/package-lock.json index 10464e3be..238d784a1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -758,7 +758,7 @@ "version": "2.0.2", "license": "MIT", "dependencies": { - "@cantoo/pdf-lib": "^2.6.5", + "@cantoo/pdf-lib": "2.6.5", "@modelcontextprotocol/client": "2.0.0", "@modelcontextprotocol/express": "2.0.0", "@modelcontextprotocol/ext-apps": "^2.0.0",