[tianxiaochannel-oss88]

Summary

• upgrade the officeparser-scoped pdfjs-dist dependency from 6.1.200 to 6.2.108 for CVE-2026-16633
• remove daemon's direct image-size dependency and replace its JPEG/PNG/WebP dimension inspection with a bounded parser that does not execute ICNS/JXL/HEIF paths
• keep the existing patched image-size@1.2.1 for Expo/Metro transitive usage and retain regression coverage for the patch

Security notes

• image-size remains transitively present through Expo/Metro and pptxgenjs; the tracked pnpm patch hardens the affected ICNS/JXL/HEIF parsers because upstream has no fixed release in the vulnerable range.
• The two open daemon alerts (Fix teammate roster delete display #74/Polish model workbench UI #75) were direct-dependency findings; this PR removes that direct dependency. The dismissed transitive findings (docs: close skill import rollout status #72/Fix deleted teammate history display #73) remain covered by the existing patch and tests.

Validation

• corepack pnpm install --frozen-lockfile
• corepack pnpm --filter @ling-stack/daemon build
• corepack pnpm check:dependency-security (9/9)
• PATH=/Users/tianxiao/.cargo/bin:$PATH corepack pnpm --filter @ling-stack/daemon test (1135/1135)
• git diff --check

[tianxiaochannel-oss88]

CI was rerun and is blocked before any workflow step starts by the repository's GitHub Actions billing/spending-limit gate (GitHub annotation: "recent account payments have failed or your spending limit needs to be increased").

Local validation for this commit is green:

• corepack pnpm --filter @ling-stack/daemon build
• corepack pnpm check:dependency-security (9/9)
• PATH=/Users/tianxiao/.cargo/bin:$PATH corepack pnpm --filter @ling-stack/daemon test (1135/1135)