Skip to content

fix(deps): update dependency fast-xml-parser to v5.10.1 [security] - autoclosed#578

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-fast-xml-parser-vulnerability
Closed

fix(deps): update dependency fast-xml-parser to v5.10.1 [security] - autoclosed#578
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-fast-xml-parser-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
fast-xml-parser 5.7.3 → 5.10.1 age confidence
fast-xml-parser 5.9.3 → 5.10.1 age confidence

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

GHSA-8r6m-32jq-jx6q

More information

Details

Impact

fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().

addInputEntities() resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

Workarounds
  • Manually check if multiple DOCTYPEs are not present in input contents
  • Update to v5.10.1
  • Keep processEntity flag off

Severity

  • CVSS Score: 8.7 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.10.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

Compare Source

What's Changed

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

Compare Source

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

v5.9.0: update strnum, use is-unsafe

Compare Source

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

v5.8.0: update strnum, FXB. Use xml-naming for DOCTYPE

Compare Source

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is by deault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added dependencies Pull requests that update a dependency file security labels Jul 21, 2026
@renovate renovate Bot added dependencies Pull requests that update a dependency file security labels Jul 21, 2026
@vercel

vercel Bot commented Jul 21, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
drydock-website Ready Ready Preview, Comment Jul 21, 2026 11:09pm
drydockdemo-website Ready Ready Preview, Comment Jul 21, 2026 11:09pm

@scttbnsn scttbnsn mentioned this pull request Jul 21, 2026
Merged
scttbnsn added a commit that referenced this pull request Jul 22, 2026
@scttbnsn
📦 deps: refresh v1.6 security dependencies (#579)
54d404a 
## Summary

- pin `fast-uri` 3.1.4 in app and UI for CVE-2026-16221
- pin `fast-xml-parser` 5.10.1 in app for GHSA-8r6m-32jq-jx6q
- override the Next.js transitive `sharp` dependency to 0.35.3 for
GHSA-f88m-g3jw-g9cj
- add lockfile regression coverage and record the refresh in the rc.3
changelog

## Why

The approved rc.3 tree passed PR CI, but the GitHub Advisory Database
updated before the post-merge `main` run completed. Qlty then correctly
blocked the release on these three newly recognized advisories. The
release workflow was canceled before any publication side effects.

This combined PR supersedes the incomplete single-package Renovate PRs
#577 and #578; neither can pass the all-plugin Qlty gate independently.

## Validation

- Qlty all-plugin gate: pass
- npm audit, app/UI/website production trees: 0 vulnerabilities
- backend: 392 files, 12,288 tests, 100% coverage
- UI: 213 files, 4,273 tests, 100% coverage
- website: 44 script tests, typecheck, 348-page production build
- root scripts: 111 tests
- workflow policy: 40 tests
- pre-push repository gate: pass
- rc.3 precheck: pass with five informational discussion-reply reminders

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
🔒 **Security**
- Pin `fast-uri` to `3.1.4` in `app` and `ui` for CVE-2026-16221.
- Pin `fast-xml-parser` to `5.10.1` in `app` (via `dependencies` +
`overrides`) for GHSA-8r6m-32jq-jx6q.
- Override Next.js transitive `sharp` to `0.35.3` in `apps/web` for
GHSA-f88m-g3jw-g9cj.

✨ **Added**
- Add `scripts/security-dependency-versions.test.mjs` to regression-test
that:
  - workspace manifests include the expected pins/overrides,
- `package-lock.json` resolved versions are semver-equal-or-greater than
the patched targets,
- `CHANGELOG.md` `## [1.6.0-rc.3]` contains the expected CVE/GHSA
identifiers and patched-version statements.

🔧 **Changed**
- Update `app/package.json` to pin/override `fast-uri@3.1.4` and
`fast-xml-parser@5.10.1`.
- Update `ui/package.json` to override `fast-uri@3.1.4`.
- Update `apps/web/package.json` to override `sharp@0.35.3`.
- Record the security dependency refresh in `CHANGELOG.md` under `##
[1.6.0-rc.3]`.
- Supersede prior Renovate updates.

- Confirm the previously canceled release workflow / post-merge advisory
failure no longer blocks publication.
- Verify all listed CI/validation gates remain passing (Qlty, audit,
test, coverage, build, typecheck, workflow policy, pre-push, rc.3
precheck).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@renovate renovate Bot changed the title fix(deps): update dependency fast-xml-parser to v5.10.1 [security] fix(deps): update dependency fast-xml-parser to v5.10.1 [security] - autoclosed Jul 22, 2026
@renovate renovate Bot closed this Jul 22, 2026
@renovate
renovate Bot deleted the renovate/npm-fast-xml-parser-vulnerability branch July 22, 2026 00:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@scttbnsn scttbnsn Awaiting requested review from scttbnsn scttbnsn is a code owner
@ALARGECOMPANY ALARGECOMPANY Awaiting requested review from ALARGECOMPANY ALARGECOMPANY is a code owner
@biggest-littlest biggest-littlest Awaiting requested review from biggest-littlest biggest-littlest is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants