Skip to content

Build(deps-dev): bump fast-xml-builder from 1.1.5 to 1.3.0 - #208

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/fast-xml-builder-1.3.0
Open

Build(deps-dev): bump fast-xml-builder from 1.1.5 to 1.3.0#208
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/fast-xml-builder-1.3.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 21, 2026

Copy link
Copy Markdown
Contributor

Bumps fast-xml-builder from 1.1.5 to 1.3.0.

Changelog

Sourced from fast-xml-builder's changelog.

1.3.0 (2026-07-11)

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix

1.2.1 (2026-07-03)

  • fix: escape quotes in stopNode attribute values (By greymoth)
  • fix: neutralize double hyphen in multi-key comment object (By spokodev)

1.2.0 (2026-05-08)

  • Add support for sanitizeName option
  • Support xml-naming for validating and sanitizing tag and attribute names

1.1.9 (2026-05-06)

  • fix: format output for preserve order when indent by is set to empty string

1.1.8 (2026-05-05)

  • fix: skip text property for PI tags
  • improve typings

1.1.7 (2026--05-04)

  • fix security issues when attribute value contains quotes

1.1.6 (2026--05-04)

  • fix security issues related to comment
  • skip comment with null value

1.1.5 (2026-04-17)

  • fix security issues related to comment and cdata

1.1.4 (2026-03-16)

  • support maxNestedTags option

1.1.3 (2026-03-13)

  • declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

1.1.2 (2026-03-11)

  • fix typings

1.1.1 (2026-03-11)

  • upgrade path-expression-matcher to 1.1.3

1.1.0 (2026-03-10)

Commits
  • 11829bf 1.3.0
  • 60774c1 browser bundle
  • 740bd54 update dependency
  • ed22f02 1.2.1
  • 9dc1fc9 update release info
  • 64808e5 Merge pull request #15 from spokodev/fix/multikey-comment-double-hyphen
  • e930f89 Merge pull request #14 from greymoth-jp/fix/stopnode-attr-escape
  • 121d93e fix: neutralize double hyphen in multi-key comment object
  • 0235eb0 fix: escape quotes in stopNode attribute values
  • e6d7c63 Update funding sources in FUNDING.yml
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Build(deps-dev): bump fast-xml-builder from 1.1.5 to 1.3.0
4744b33 
Bumps [fast-xml-builder](https://github.com/NaturalIntelligence/fast-xml-builder) from 1.1.5 to 1.3.0.
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-builder/blob/main/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-builder@v1.1.5...v1.3.0)

---
updated-dependencies:
- dependency-name: fast-xml-builder
  dependency-version: 1.3.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependabot Dependabot issues and PRs npm Node.js issues and PRs labels Jul 21, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 21, 2026 02:18
@dependabot dependabot Bot added dependabot Dependabot issues and PRs npm Node.js issues and PRs labels Jul 21, 2026
@dependabot dependabot Bot mentioned this pull request Jul 21, 2026
Closed
@github-actions

github-actions Bot commented Jul 21, 2026

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 5 0 0 0.04s
❌ ACTION zizmor 5 1 0 0.2s
✅ JSON jsonlint 5 0 0 0.18s
✅ JSON npm-package-json-lint yes no no 1.13s
✅ JSON prettier 5 0 0 2.25s
✅ JSON v8r 5 0 0 12.51s
✅ MARKDOWN markdownlint 1 0 0 0.71s
✅ REPOSITORY betterleaks yes no no 1.33s
✅ REPOSITORY checkov yes no no 23.34s
✅ REPOSITORY gitleaks yes no no 1.88s
✅ REPOSITORY git_diff yes no no 0.04s
❌ REPOSITORY grype yes 5 no 77.65s
❌ REPOSITORY osv-scanner yes 27 no 1.74s
✅ REPOSITORY secretlint yes no no 1.08s
✅ REPOSITORY syft yes no no 9.36s
✅ REPOSITORY trivy-sbom yes no no 3.98s
✅ REPOSITORY trufflehog yes no no 36.51s
✅ TYPESCRIPT eslint 9 0 0 12.79s
✅ TYPESCRIPT prettier 9 0 0 1.55s
✅ YAML prettier 13 0 0 0.76s
✅ YAML v8r 13 0 0 8.55s
✅ YAML yamllint 13 0 0 0.75s

Detailed Issues

❌ REPOSITORY / grype - 5 errors 
[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME             INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS         RISK   
undici           6.24.1     6.27.0    npm   GHSA-vxpw-j846-p89q  High      0.8% (52nd)  0.6    
brace-expansion  5.0.5      5.0.6     npm   GHSA-jxxr-4gwj-5jf2  Medium    0.3% (19th)  0.2    
undici           6.24.1     6.27.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
undici           6.24.1     6.27.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (16th)  < 0.1  
undici           6.24.1     6.27.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (13th)  < 0.1
[0077] ERROR discovered vulnerabilities at or above the severity threshold
❌ REPOSITORY / osv-scanner - 27 errors 
Scanning dir .
Starting filesystem walk for root: /
Scanned package-lock.json file and found 827 packages
End status: 34 dirs visited, 113 inodes visited, 1 Extract calls, 61.444912ms elapsed, 61.445124ms wall time

Total 11 packages affected by 27 known vulnerabilities (0 Critical, 13 High, 8 Medium, 6 Low, 0 Unknown) from 1 ecosystem.
27 vulnerabilities can be fixed.

+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-4x5r-pxfx-6jf8 | 3.2  | npm       | @babel/core (dev)     | 7.28.0  | 7.29.6        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev) | 1.1.14  | 1.1.16        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev) | 2.1.0   | 2.1.2         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion       | 5.0.5   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion       | 5.0.5   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-g7r4-m6w7-qqqr | 2.5  | npm       | esbuild (dev)         | 0.27.4  | 0.28.1        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-23c5-xmqv-rm74 | 7.5  | npm       | minimatch (dev)       | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-3ppc-4f35-3m26 | 8.7  | npm       | minimatch (dev)       | 9.0.3   | 9.0.6         | package-lock.json |
| https://osv.dev/GHSA-7r86-cg39-jmmj | 7.5  | npm       | minimatch (dev)       | 9.0.3   | 9.0.7         | package-lock.json |
| https://osv.dev/GHSA-2mjp-6q6p-2qxm | 6.5  | npm       | undici (dev)          | 5.29.0  | 6.24.0        | package-lock.json |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici (dev)          | 5.29.0  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-4992-7rv2-5pvq | 4.6  | npm       | undici (dev)          | 5.29.0  | 6.24.0        | package-lock.json |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici (dev)          | 5.29.0  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-g9mf-h72j-4rw9 | 5.9  | npm       | undici (dev)          | 5.29.0  | 6.23.0        | package-lock.json |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici (dev)          | 5.29.0  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-v9p9-hfj2-hcw8 | 7.5  | npm       | undici (dev)          | 5.29.0  | 6.24.0        | package-lock.json |
| https://osv.dev/GHSA-vrm6-8vpv-qv8q | 7.5  | npm       | undici (dev)          | 5.29.0  | 6.24.0        | package-lock.json |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici (dev)          | 5.29.0  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici                | 6.24.1  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici                | 6.24.1  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici                | 6.24.1  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici                | 6.24.1  | 6.27.0        | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)            | 8.3.2   | 11.1.1        | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
❌ ACTION / zizmor - 1 error 
INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/check-dist.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,JSON_NPM_PACKAGE_JSON_LINT,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,TYPESCRIPT_ES,TYPESCRIPT_PRETTIER,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependabot Dependabot issues and PRs npm Node.js issues and PRs

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants