[WC-3469] docviewer: update dependencies

[gjulivan]

Pull request type

---

Description

[github-actions]

AI Code Review

⚠️ Approved with suggestions — low-severity items only, safe to merge

---

What was reviewed

File	Change
packages/pluggableWidgets/document-viewer-web/src/components/DocxViewer.tsx	Migrated from parseAsync+renderDocument to renderAsync (docx-preview v0.4 API); added fetch-level error handling with abort-signal guard
packages/pluggableWidgets/document-viewer-web/package.json	Bumped docx-preview ^0.3.6→^0.4.0, pdfjs-dist 4.8.69→5.4.296, react-pdf ^9.2.1→^10.4.1
packages/pluggableWidgets/document-viewer-web/CHANGELOG.md	Added ### Changed entry under [Unreleased]

Skipped (out of scope): pnpm-lock.yaml

---

Findings

⚠️ Low — loadContent is called without awaiting inside useEffect, silencing unhandled rejections

File: packages/pluggableWidgets/document-viewer-web/src/components/DocxViewer.tsx line 42
Note: loadContent(response) is an async function but its returned Promise is not awaited and has no .catch() attached inside the useEffect chain. If renderAsync throws after the fetch resolves, the error is swallowed by the try/catch inside loadContent — but if the ref check (localRef.current) passes and then renderAsync rejects (e.g. due to an abort mid-render), the catch in loadContent handles it correctly. This is functionally fine today; however, chaining .catch() on the call makes the intent explicit and avoids a potential lint warning:

.then(response => {
    loadContent(response).catch(() => {
        // already handled inside loadContent
    });
})

Or simply flatten the chain so both steps are in the same .then:

.then(res => res.arrayBuffer())
.then(response => loadContent(response))
.catch((_error: any) => {
    if (!signal.aborted) {
        setDocumentStatus({ status: DocumentStatus.error, message: "Failed to load DOCX document" });
    }
});

---

⚠️ Low — Abort signal not forwarded into renderAsync

File: packages/pluggableWidgets/document-viewer-web/src/components/DocxViewer.tsx line 23
Note: The AbortController signal is passed to fetch and guards the .catch(), but renderAsync from docx-preview v0.4 does not receive the signal. If the component unmounts mid-render, the abort stops the fetch and the .catch is guarded, but an in-progress renderAsync will continue running and may call setDocumentStatus on an unmounted component. Adding a mounted-ref guard or checking signal.aborted before calling setDocumentStatus inside loadContent's catch block would make this fully safe:

} catch (_error: any) {
    if (!signal.aborted) {
        setDocumentStatus({ status: DocumentStatus.error, message: "Failed to load DOCX document" });
    }
}

This requires threading signal into loadContent (or the useCallback closure).

---

Positives

• The switch from the two-step parseAsync + renderDocument to the single renderAsync call is a correct and clean migration to the docx-preview v0.4 API — noticeably less boilerplate.
• Adding a .catch() with an signal.aborted guard on the fetch chain is a genuine improvement; the original code had no error handling at the fetch layer.
• CHANGELOG entry is present, follows Keep a Changelog format, and is correctly placed in [Unreleased].
• The comment // Keep generated styles out of the document head. explains the non-obvious pattern of passing a dummy styleContainer.