chore: upgrade xml-crypto to v6

[abhinavkrin]

Proposed changes (including videos or screenshots)

Upgrades xml-crypto from ~3.2.1 to ~6.1.2 (the only usage site is apps/meteor/app/meteor-accounts-saml/server/lib/parsers/Response.ts). The 3.x line is EOL; 6.x is maintained and has stronger anti-signature-wrapping protections. Follow-up to CORE-2357.

Issue(s)

Closes: https://rocketchat.atlassian.net/browse/CORE-2374

Steps to test or reproduce

1. Configure SAML SSO and log in with signatureValidationType set to Response, Assertion, All, and Either.
2. Expected result: login succeeds in all configurations; tampered/invalid signatures are still rejected.

Further comments

CORE-2374

Summary by CodeRabbit

• Bug Fixes
  • Improved SAML response signature verification for greater compatibility with modern XML security libraries.
  • Added clearer validation handling for signed references and signature coverage.
  • Enhanced reporting of signature validation errors.

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 7e84bc9

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Walkthrough

Updates xml-crypto and adapts SAML response signature discovery, reference coverage checks, and validation error handling to the newer API.

Changes

SAML signature modernization

Layer / File(s)	Summary
xml-crypto API upgrade apps/meteor/package.json, apps/meteor/server/lib/saml/lib/parsers/Response.ts	Upgrades xml-crypto, removes its obsolete type dependency, and switches parser imports to the newer SignedXml and Reference interfaces.
Signature discovery and coverage validation apps/meteor/server/lib/saml/lib/parsers/Response.ts	Discovers XMLDSIG signatures through DOM namespace queries, validates references returned by getReferences(), configures publicCert, and logs per-reference validation errors. —

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested labels: type: chore, area: authentication

Suggested reviewers: sampaiodiego, d-gubert

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: upgrading xml-crypto to version 6.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (3)

• CORE-2357: Request failed with status code 401
• CORE-2374: Request failed with status code 401
• CRYPTO-6: Request failed with status code 401

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/meteor/server/lib/saml/lib/parsers/Response.ts`:
- Around line 362-364: Remove the explanatory comment immediately preceding the
signedReference null check in the Response parser, leaving the existing
conditional logic unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 031af725-4202-4f4a-b46a-807273f4f221

📥 Commits

Reviewing files that changed from the base of the PR and between a60e261 and 7e84bc9.

⛔ Files ignored due to path filters (1)

• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (2)

• apps/meteor/package.json
• apps/meteor/server/lib/saml/lib/parsers/Response.ts

📜 Review details

⏰ Context from checks skipped due to timeout. (3)

• GitHub Check: CodeQL-Build
• GitHub Check: Hacktron Security Check
• GitHub Check: CodeQL-Build

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

• apps/meteor/server/lib/saml/lib/parsers/Response.ts

🧠 Learnings (3)

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.

Applied to files:

• apps/meteor/server/lib/saml/lib/parsers/Response.ts

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.

Applied to files:

• apps/meteor/server/lib/saml/lib/parsers/Response.ts

📚 Learning: 2026-05-06T12:21:44.083Z

Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.

Applied to files:

• apps/meteor/server/lib/saml/lib/parsers/Response.ts

🔇 Additional comments (5)

apps/meteor/package.json (2)

322-322: LGTM!

---

423-424: LGTM!

apps/meteor/server/lib/saml/lib/parsers/Response.ts (3)

2-3: LGTM!

---

321-325: LGTM!

---

374-385: 🎯 Functional Correctness

xml-crypto v6.1.2 supports these accesses. SignedXml accepts publicCert, Reference includes validationError and signedReference, and getReferences() returns Reference[], so the null-safe .map() change isn’t needed.

			> Likely an incorrect or invalid review comment.

[codecov]

Codecov Report

❌ Patch coverage is 92.30769% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 68.18%. Comparing base (a60e261) to head (7e84bc9).
⚠️ Report is 5 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41379      +/-   ##
===========================================
- Coverage    68.21%   68.18%   -0.04%     
===========================================
  Files         3968     3968              
  Lines       154740   154740              
  Branches     27809    27821      +12     
===========================================
- Hits        105562   105502      -60     
- Misses       44387    44449      +62     
+ Partials      4791     4789       -2     

Flag	Coverage Δ
e2e	59.20% <ø> (-0.17%)	⬇️
e2e-api	44.08% <0.00%> (+0.03%)	⬆️
unit	70.59% <69.23%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.