From 5090a6fdc1ad41d9aaac5edeb6bcad4da4c52460 Mon Sep 17 00:00:00 2001
From: haritowa <6107211+haritowa@users.noreply.github.com>
Date: Fri, 23 Oct 2026 17:31:25 +0000
Subject: [PATCH] chore(deps): say what the pdf-parse copy of pdfjs is still
 for

The override comment said pdf-parse's pdfjs 5.4.296 drives local text
extraction. Extraction now reads with the app's own pdfjs; only the tests
still use pdf-parse, which has to stay on pdfjs 5 because its teardown
calls an API pdfjs 6 removed. The range itself is unchanged.
---
 pnpm-workspace.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 2f95c35f1..aade691c4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -73,8 +73,10 @@ overrides:
   # transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
   # the store into the standalone image — so an unused transitive copy is still
   # a copy in the runtime image. The range is bounded on both ends deliberately:
-  # `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
-  # text-extraction path, so it must not be dragged onto a new major.
+  # `pdf-parse` resolves 5.4.296, which predates the flaw. Only the tests use it
+  # now (they read generated PDFs back); it must not be dragged onto a new
+  # major, because its teardown calls `PDFDocumentProxy.destroy()`, which pdfjs
+  # 6 no longer has. Local text extraction reads with the app's own pdfjs.
   "pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
   # Deeply nested input drives DeepmergeTS into unbounded recursion until the
   # stack gives out. The copy here is Prisma's: `@prisma/config` still asks for