chore(deps): override fast-xml-builder to 1.1.7+ (GHSA-5wm8-gmm8-39j9, GHSA-45c6-75p6-83cc)

[jrphilo]

Summary

• Adds pnpm.overrides.fast-xml-builder set to ^1.1.7 to clear two Dependabot alerts on the transitive fast-xml-builder (pulled in via @opennextjs/cloudflare → @aws-sdk/client-cloudfront → @aws-sdk/xml-builder → fast-xml-parser).
• Alerts cleared:
  • fix: use relative links for logo and mobile waitlist button #4 GHSA-5wm8-gmm8-39j9 — attribute values with unwanted quotes can bypass malicious-attribute filtering (CVE-2026-44665, patched 1.1.7)
  • hotfix: redirect docs.happyhq.workers.dev to docs-preview #3 GHSA-45c6-75p6-83cc — comment-value regex bypass (CVE-2026-44664, patched 1.1.6)
• Path into the tree:

docs@0.1.0
└─┬ @opennextjs/cloudflare 1.19.2
  └─┬ @opennextjs/aws 3.10.2
    └─┬ @aws-sdk/client-cloudfront 3.984.0
      └─┬ @aws-sdk/core 3.974.2
        └─┬ @aws-sdk/xml-builder 3.972.18
          └─┬ fast-xml-parser 5.7.1
            └── fast-xml-builder 1.1.5 → 1.2.0 (post-override)

• Exposure: fast-xml-builder is reached only through the AWS SDK's CloudFront client, which is itself pulled in by the @opennextjs/cloudflare build/deploy tooling. We do not directly serialize attacker-controlled data to XML. Both advisories describe attacker-controlled values that bypass filtering when building XML — not applicable to our deploy path. Bumping is still the correct deterministic fix.

Test plan

• pnpm install succeeds; lockfile updated
• pnpm why fast-xml-builder reports 1.2.0 (>= 1.1.7 patched floor)
• CI green (lint + build + check:links)

---

AI-assistance disclosure: this PR was drafted by an AI agent (Claude / Ralphie) as part of the docs repo dependency-triage loop. The change is mechanical (a pnpm.overrides entry) and the exposure note is grounded in repo grep + advisory text. A maintainer should still skim the diff before merging.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	docs-preview	c89849f	Commit Preview URL Branch Preview URL	May 13 2026, 01:39 PM

[jrphilo]

Ralphie verified this — ready to merge.

Verification

• lint: ✓ (one pre-existing <img> warning in src/components/Logo.tsx, unrelated)
• build: ✓ (Next.js type-check + bundle)
• check:links: ✓ (39 files, 3 internal links, 0 broken)

Changelog highlights

• GHSA-5wm8-gmm8-39j9 — attribute-value quote bypass of malicious-attribute filtering; patched 1.1.7
• GHSA-45c6-75p6-83cc — comment-value regex bypass; patched 1.1.6

Investigation

• Ownership: same maintainer (NaturalIntelligence org, publisher of both fast-xml-parser and fast-xml-builder).
• Auth/secrets: none — the override is a pnpm.overrides floor bump on a transitive dep, no auth/token-handling code on either side.
• Security advisory: both GHSAs are the reason for the PR — investigated → both describe attacker-controlled values fed into XML attribute/comment serialization. Repo grep for fast-xml-builder in src/ returned no matches; the only path into the tree is @opennextjs/cloudflare → AWS SDK CloudFront/S3 clients (build/deploy tooling), which doesn't serialize attacker-controlled data. Override resolves to 1.2.0 (≥ both patched floors) per pnpm why.
• Deprecations: none we'd hit.
• Breaking API: none — transitive override floor, no direct caller in this repo.

Recommendation

Mechanical pnpm.overrides floor bump to clear two open Dependabot alerts. Lockfile already resolves to 1.2.0, build/lint/links all green, no direct usage in our code. Safe to merge.

[jrphilo]

Closing — superseded by #57, which batches this override with the protobufjs override (#52) onto current main to avoid a rebase cascade after the recent merge wave.