build: fix dependabot alerts (#52742)

* build: fix dependabot alerts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test: use pdfjs-dist legacy build in pdf-reader fixture

The modern build of pdfjs-dist 4.10.x logs a "please use the legacy
build" warning via console.log, which corrupts the JSON that
pdf-helpers.ts parses from the fixture's stdout.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.github/workflows/package.json

@@ -4,7 +4,7 @@
   "private": true,
   "type": "module",
   "dependencies": {
-    "@actions/cache": "^4.0.3",
+    "@actions/cache": "^5.2.0",
     "@electron/fiddle-core": "^2.0.1",
     "mdast-util-from-markdown": "^2.0.0",
     "semver": "^7.7.2",

package.json

@@ -144,7 +144,10 @@
     "abstract-socket": "patch:abstract-socket@npm%3A2.0.0#~/.yarn/patches/abstract-socket-npm-2.0.0-b025d8ca5a.patch",
     "minimist@npm:~0.0.1": "0.2.4",
     "put": "npm:@nornagon/put@0.0.8",
-    "get-intrinsic": "^1.3.0"
+    "get-intrinsic": "^1.3.0",
+    "js-yaml@npm:4.1.0": "4.3.1",
+    "markdown-it@npm:14.1.0": "14.3.0",
+    "serialize-javascript@npm:^6.0.2": "^7.0.5"
   },
   "packageManager": "yarn@4.12.0",
   "workspaces": [

spec/fixtures/api/pdf-reader.mjs

@@ -2,7 +2,7 @@ import { app } from 'electron';
 
 async function getPDFDoc() {
   try {
-    const pdfjs = await import('pdfjs-dist');
+    const pdfjs = await import('pdfjs-dist/legacy/build/pdf.mjs');
     const doc = await pdfjs.getDocument(process.argv[2]).promise;
     const page = await doc.getPage(1);
     const { items } = await page.getTextContent();

spec/package.json

@@ -42,7 +42,7 @@
     "mocha": "^10.0.0",
     "mocha-junit-reporter": "^1.18.0",
     "mocha-multi-reporters": "^1.1.7",
-    "pdfjs-dist": "4.2.67",
+    "pdfjs-dist": "4.10.38",
     "ps-list": "^7.0.0",
     "q": "^1.5.1",
     "send": "^0.19.0",