security vulnerability in dependency xml2js

[ctbaird]

This package depends on vulnerable versions of xml2js. xml2js should be updated to v0.5.0

From npm audit:

xml2js  <0.5.0
Severity: high
xml2js is vulnerable to prototype pollution  - https://github.com/advisories/GHSA-776f-qx25-q3cc

[lorand-horvath]

@mattdesl Please take a look at this and update xml2js to 0.5.0. Thanks!

[lorand-horvath]

@mattdesl xml2js 0.6.0 is available https://github.com/Leonidas-from-XIV/node-xml2js/tags
Would you take a look at updating the vulnerable version 0.4.5 ? Would very much appreciate any input!

[Willibaur]

Do we know when this update will happen @lorand-horvath @mattdesl ❓
Thanks

[lorand-horvath]

@mattdesl doesn't seem to be responding at all. I've launched several requests in his direction, but haven't received any response yet. He is active on github though... his commits in May: https://github.com/mattdesl?tab=overview&from=2023-05-01&to=2023-05-31
However, since June the commits are only in private repos: https://github.com/mattdesl?tab=overview&from=2023-06-01&to=2023-06-26
Very strange, to say the least!

[pumano]

@mattdesl plz look into it and merge pull request

[lorand-horvath]

Fixed in #4

[mattdesl]

should be sorted now!