[WC-3469] docviewer: update dependencies

[gjulivan]

Pull request type

---

Description

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
packages/pluggableWidgets/document-viewer-web/src/components/DocxViewer.tsx	Migrated from parseAsync+renderDocument to renderAsync; added .catch for fetch errors
packages/pluggableWidgets/document-viewer-web/package.json	Bumped docx-preview ^0.3.6→^0.4.0, pdfjs-dist 4.8.69→^6.1.200, react-pdf ^9.2.1→^10.4.1
packages/pluggableWidgets/document-viewer-web/CHANGELOG.md	Added ### Changed entry for dependency updates

Skipped (out of scope): pnpm-lock.yaml

---

Findings

⚠️ Low — renderAsync errors silenced after abort

File: packages/pluggableWidgets/document-viewer-web/src/components/DocxViewer.tsx line 17–33

Note: The loadContent callback awaits renderAsync and catches all errors via a shared catch block. But it doesn't check whether the abort signal has fired before calling setDocumentStatus. If the effect cleanup runs (controller aborts) while renderAsync is still in flight, and then renderAsync throws/rejects due to the abort, the error handler will still call setDocumentStatus — causing a state update on an unmounted/re-rendered component. Compare with the outer fetch .catch, which correctly guards with if (!signal.aborted). The loadContent function should receive or close over the signal and apply the same guard.

Fix:

const loadContent = useCallback(
    async (arrayBuffer: any, signal: AbortSignal) => {
        try {
            if (localRef.current) {
                const styleContainer = document.createElement("div");
                await renderAsync(arrayBuffer, localRef.current, styleContainer, DOC_CONFIG);
            }
        } catch (_error: any) {
            if (!signal.aborted) {
                setDocumentStatus({
                    status: DocumentStatus.error,
                    message: "Failed to load DOCX document"
                });
            }
        }
    },
    [setDocumentStatus]
);
// then pass signal through: .then(response => loadContent(response, signal))

---

⚠️ Low — pdfjs-dist version constraint changed from pinned to range

File: packages/pluggableWidgets/document-viewer-web/package.json line 50

Note: pdfjs-dist was previously pinned at an exact version (4.8.69); it's now a range (^6.1.200). PDF.js is notoriously sensitive to minor version changes (worker/API compatibility, CMaps paths). Pinning or at least using a tighter range (e.g. ~6.1.200) would make future lockfile regenerations more predictable and reduce the risk of a silent breakage when a patch lands.

---

Positives

• The refactor from the two-step parseAsync+renderDocument to the single renderAsync call is cleaner and matches the current docx-preview 0.4.x public API correctly.
• Adding .catch on the fetch chain (with signal.aborted guard) properly prevents spurious error states on cleanup — good defensive pattern.
• CHANGELOG entry is present and follows Keep a Changelog format.
• The styleContainer side-channel trick to prevent library styles from leaking into document.head is preserved and now carries an explanatory comment.