fix: Pin pdfjs-dist to exact 4.0.189

The PDF viewer explicitly sets "isEvalSupported" to "false", so it is
not affected by the security issue reported for versions <= 4.1.392,
which assume the default value of "true".

pdfjs-dist is the main dependency of the PDF viewer, and any version
update requires additional work in the PDF viewer, it is not just
increasing the version and that is it.

Due to all of the above, the pdfjs-dist version is pinned for now to
exact 4.0.189 to avoid dealing again and again with incorrect updates
after running "npm audit fix".

Signed-off-by: Daniel Calviño Sánchez <[email protected]>

Author: danxuliu

package-lock.json

@@ -34,7 +34,7 @@
     "@nextcloud/logger": "^3.0.2",
     "@nextcloud/router": "^3.0.1",
     "@nextcloud/sharing": "^0.2.4",
-    "pdfjs-dist": "^4.0.189"
+    "pdfjs-dist": "4.0.189"
   },
   "browserslist": [
     "extends @nextcloud/browserslist-config"