Downgrade pdfjs-dist to 5.5.207 to address security advisory

[MelvinBot]

Explanation of Change

Downgrades pdfjs-dist from 5.6.205 to 5.5.207 and pins it exactly, to fix GHSA-hq66-cqwq-w95j (high: arbitrary JS execution on opening a malicious PDF). The bug was introduced in 5.6.83, so 5.5.207 predates it. There is no patched 5.x.

Why downgrade instead of upgrading to 6.x:

• 6.x requires react-pdf@11 (via react-fast-pdf), which makes Suspense the default and raises the minimum browsers to Chrome 125 / Safari 18. Other projects are pinning below the affected range for the same reason, e.g. modelcontextprotocol/ext-apps#789.
• We were already on 5.5.207 on purpose: Upgrade react-fast-pdf and webpack #80160 set it to drop our worker patch. The bump to 5.6.205 was an unintended side effect of the lockfile refresh in Introduce a Bottom Tab Navigator for Top-Level Navigation #85234, not a fix we needed.

The react-pdf@11 / pdf.js 6 upgrade will be a separate follow-up.

Usage: transitive via react-fast-pdf → react-pdf. Renders PDF attachments/receipts on web/desktop (PDFView, ReceiptPDFOverlay, PDFThumbnail, LocalPDFReceiptPreview). Native uses react-native-pdf (unaffected).

Fixed Issues

$ https://github.com/Expensify/Expensify/issues/688714
PROPOSAL:

Tests

1. Upload a multi-page PDF in a chat. Verify the preview renders.
2. Open it. Verify all pages render and scroll, and rotate works.
3. Upload a password-protected PDF. Verify the password prompt appears and the PDF opens with the right password.
4. Add a PDF receipt to an expense. Verify the receipt thumbnail renders and opens.

• Verify that no errors appear in the JS console

Offline tests

N/A, no network behavior change.

QA Steps

Same as tests.

• Verify that no errors appear in the JS console

PR Author Checklist

• I linked the correct issue in the ### Fixed Issues section above
• I wrote clear testing steps that cover the changes made in this PR
  • I added steps for local testing in the Tests section
  • I added steps for the expected offline behavior in the Offline steps section
  • I added steps for Staging and/or Production testing in the QA steps section
  • I added steps to cover failure scenarios (i.e. verify an input displays the correct error message if the entered data is not correct)
  • I turned off my network connection and tested it while offline to ensure it matches the expected behavior (i.e. verify the default avatar icon is displayed if app is offline)
  • I tested this PR with a High Traffic account against the staging or production API to ensure there are no regressions (e.g. long loading states that impact usability).
• I included screenshots or videos for tests on all platforms
• I ran the tests on all platforms & verified they passed on:
  • Android: Native
  • Android: mWeb Chrome
  • iOS: Native
  • iOS: mWeb Safari
  • MacOS: Chrome / Safari
• I verified there are no console errors (if there's a console error not related to the PR, report it or open an issue for it to be fixed)
• I followed proper code patterns (see Reviewing the code)
  • I verified that comments were added to code that is not self explanatory
  • I verified that any new or modified comments were clear, correct English, and explained "why" the code was doing something instead of only explaining "what" the code was doing.
  • I verified any copy / text that was added to the app is grammatically correct in English. It adheres to proper capitalization guidelines (note: only the first word of header/labels should be capitalized), and is either coming verbatim from figma or has been approved by marketing (in order to get marketing approval, ask the Bug Zero team member to add the Waiting for copy label to the issue)
• If a new code pattern is added I verified it was agreed to be used by multiple Expensify engineers
• I followed the guidelines as stated in the Review Guidelines
• I tested other components that can be impacted by my changes (i.e. if the PR modifies a shared library or component like Avatar, I verified the components using Avatar are working as expected)
• If a new CSS style is added I verified that:
  • A similar style doesn't already exist
  • The style can't be created with an existing StyleUtils function (i.e. StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))
• If new assets were added or existing ones were modified, I verified that:
  • The assets are optimized and compressed (for SVG files, run npm run compress-svg)
  • The assets load correctly across all supported platforms.
• If the PR modifies code that runs when editing or sending messages, I tested and verified there is no unexpected behavior for all supported markdown - URLs, single line code, code blocks, quotes, headings, bold, strikethrough, and italic.
• If the PR modifies a generic component, I tested and verified that those changes do not break usages of that component in the rest of the App (i.e. if a shared library or component like Avatar is modified, I verified that Avatar is working as expected in all cases)
• If the PR modifies a component related to any of the existing Storybook stories, I tested and verified all stories for that component are still working as expected.
• If the PR modifies a component or page that can be accessed by a direct deeplink, I verified that the code functions as expected when the deeplink is used - from a logged in and logged out account.
• If the PR modifies the UI (e.g. new buttons, new UI components, changing the padding/spacing/sizing, moving components, etc) or modifies the form input styles:
  • I verified that all the inputs inside a form are aligned with each other.
  • I added Design label and/or tagged @Expensify/design so the design team can review the changes.
• If the PR adds or modifies the UI:
  • I asked an AI agent to review the changes for accessibility issues and addressed its findings.
  • I tested with a screen reader (VoiceOver on macOS) and verified all new/changed elements are reachable with a logical focus order.
  • I verified all new/changed elements have meaningful accessible names and roles.
  • I verified state changes are announced (e.g. checked/unchecked, expanded/collapsed, selected).
• I added unit tests for any new feature or bug fix in this PR to help automatically prevent regressions in this user flow.
• If the main branch was merged into this PR after a review, I tested again and verified the outcome was still expected according to the Test steps.

Screenshots/Videos

Android: Native

Android: mWeb Chrome

iOS: Native

iOS: mWeb Safari

MacOS: Chrome / Safari

[melvin-bot]

@eVoloshchak Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

[MelvinBot]

The failing check is unrelated to this PR, so I didn't push a fix.

Analysis: test (job 1) fails on 9 tests in tests/unit/hooks/useGettingStartedItems.test.ts (the row 4 - Set up spend rules and item ordering blocks). Each one throws ReferenceError: Request is not defined. The error comes from Expo's fetch polyfill when the test reaches a real network call at src/libs/HttpUtils.ts:118.

Evidence:

• This PR only changes package.json and package-lock.json: pdfjs-dist 5.6.205 → 6.3.289 and its @napi-rs/canvas dependency. It doesn't touch Expo, HttpUtils, or the hook under test.
• The same 9 tests fail in Jest runs for 4 unrelated PRs from the same time window: claude-upgradeXlsxSecurity, claude-bumpFastXmlParser, claude-updateUndici, and claude-fixImageSizeVulnerability. Each run shows 9 failed, 3928 passed.

The test needs a fix on main, for example by mocking the network call it reaches. Once that lands, merge main into this branch and the check should pass. Check independent approval also fails, but that check only needs a review approval.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 361f463ac5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[MelvinBot]

I re-checked, and nothing has changed. The failure is still unrelated to this PR, so I didn't push a fix.

• Same failure: test (job 1) still fails on the same 9 tests in useGettingStartedItems.test.ts with ReferenceError: Request is not defined. The PR head is still 361f463.
• Still failing elsewhere: 2 more unrelated PRs failed the same 9 tests after my last comment: ishpaul/683105-rillet-fx-expense-account and krishna2323/issue/101898-members-bulk-action-bar.
• No fix on main yet: Nothing merged to main since then touches this test or its setup.

When a fix lands on main, ask me to merge main into this branch. The other 2 failing checks, checklist and Check independent approval, only need a reviewer.

[MelvinBot]

The failing check is still unrelated to this PR, so I didn't push a fix.

• Same failure: test (job 1) still fails the same 9 tests in tests/unit/hooks/useGettingStartedItems.test.ts with ReferenceError: Request is not defined. The PR head (361f463) hasn't changed.
• Still broken on other PRs: a Jest run for an unrelated branch (krishna2323/issue/101898-members-bulk-action-bar) started at 12:57 UTC shows the same 9 failed, 3928 passed.
• No fix on main yet: none of the commits merged to main since 10:00 UTC touch this test, HttpUtils, or the Jest setup.

When a fix for that test lands on main, merge main into this branch and re-run the checks. The other failing checks, Check independent approval and checklist, only need a reviewer approval and the reviewer checklist.

[MelvinBot]

The failing check is unrelated to this PR, so I didn't push a fix.

Analysis: In Jest Unit Tests / test (job 2), the OS killed the Jest worker (signal=SIGKILL) while it ran tests/unit/PolicyConnectionsTest.ts. No test assertion failed: 4302 of 4302 tests passed. This usually means the CI runner ran out of memory.

Evidence: This PR only changes package.json and package-lock.json to bump pdfjs-dist. PolicyConnectionsTest.ts doesn't use PDFs. The other 7 Jest jobs passed.

Next step: Rerun the failed job. It should pass.

The PR Author Checklist and Check independent approval checks are also failing. A code change can't fix those. They pass after you complete the author checklist and someone else approves the PR.

---

view run

[melvin-bot]

@Pujan92 @robertjchen One of you needs to copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button]

[github-actions]

🚧 robertjchen has triggered a test Expensify/App build. You can view the workflow run here.

[OSBotify]

✋ This PR was not deployed to staging yet because QA is ongoing. It will be automatically deployed to staging after the next production release.

[github-actions]

🧪🧪 Use the links below to test this adhoc build on Android, iOS, and Web. Happy testing! 🧪🧪
Built from App PR #103023.

Android 🤖	iOS 🍎
https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-android-Adhoc-7c5b050-b8010af-0c05f3ac2cda9b4e145f4da735e872ced7fc0600/index.html	https://ad-hoc-expensify-cash.s3.us-east-1.amazonaws.com/rock-artifacts/ad-hoc/rock-ios-device-AdHoc-7c5b050-b8010af-aefc3ebc5afc33e41539418597f45bb49ca6bc1e/index.html

Web 🕸️
https://103023.pr-testing.expensify.com

---

👀 View the workflow run that generated this build 👀

[OSBotify]

🚀 Deployed to staging by https://github.com/robertjchen in version: 9.5.6-0 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

[OSBotify]

🚀 Deployed to production by https://github.com/puneetlath in version: 9.5.6-6 🚀

platform	result
🕸 web 🕸	success ✅
🤖 android 🤖	success ✅
🍎 iOS 🍎	success ✅

Bundle Size Analysis (Sentry):

• Android
• iOS