Skip to content

fix: refresh yarn.lock to upgrade fast-xml-builder to ^1.2.0 (CVE-2026-44664, CVE-2026-44665)#1184

Merged
brendan-kellam merged 5 commits intomainfrom
cursor/fix-cve-2026-44665-3caf
May 9, 2026
Merged

fix: refresh yarn.lock to upgrade fast-xml-builder to ^1.2.0 (CVE-2026-44664, CVE-2026-44665)#1184
brendan-kellam merged 5 commits intomainfrom
cursor/fix-cve-2026-44665-3caf

Conversation

@brendan-kellam
Copy link
Copy Markdown
Contributor

@brendan-kellam brendan-kellam commented May 9, 2026

Fixes SOU-1073
Fixes SOU-1074

Summary

Addresses two sibling fast-xml-builder CVEs in one upstream release:

  • CVE-2026-44664 (SOU-1073) — regex bypass via triple-dash sequences
  • CVE-2026-44665 (SOU-1074) — attribute injection via unescaped quotes

Approach

The existing fast-xml-builder: ^1.1.5 range (from fast-xml-parser) already admits the patched 1.2.0. The lockfile was just stale, so the fix is a lockfile refresh — no package.json change, no resolutions override (per the CVE flow in CLAUDE.md).

Verification

$ yarn why fast-xml-builder
└─ fast-xml-parser@npm:5.7.1
   └─ fast-xml-builder@npm:1.2.0 (via npm:^1.1.5)

Consolidated from #1185 (CVE-2026-44664), which was the same fix for the sibling CVE.

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes
    • Resolved issues related to XML building functionality. Improvements to XML processing capabilities enhance system reliability and data handling accuracy.

Review Change Stack

Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 9, 2026

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6bdb31e0-6fac-411e-b0c5-ac310b093ef9

📥 Commits

Reviewing files that changed from the base of the PR and between 9dbc3f9 and 51a2f23.

⛔ Files ignored due to path filters (1)
  • yarn.lock is excluded by !**/yarn.lock, !**/*.lock
📒 Files selected for processing (1)
  • CHANGELOG.md

Walkthrough

This PR updates the CHANGELOG.md file with a single entry documenting the upgrade of the fast-xml-builder dependency to version ^1.2.0 under the [Unreleased] Fixed section.

Changes

Changelog Update

Layer / File(s) Summary
Changelog Entry
CHANGELOG.md
Added a "Fixed" entry under [Unreleased] documenting the fast-xml-builder dependency upgrade to ^1.2.0.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately describes the main change: upgrading fast-xml-builder to ^1.2.0 via yarn.lock refresh to address specific CVEs.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch cursor/fix-cve-2026-44665-3caf

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Co-authored-by: Brendan Kellam <brendan@sourcebot.dev>
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented May 9, 2026

License Audit

⚠️ Status: PASS

Metric Count
Total packages 2067
Resolved (non-standard) 20
Unresolved 0
Strong copyleft 0
Weak copyleft 38

Weak Copyleft Packages (informational)

Package Version License
@img/sharp-libvips-darwin-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-darwin-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm 1.0.5 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-ppc64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-riscv64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-s390x 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linux-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-arm64 1.2.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64 1.0.4 LGPL-3.0-or-later
@img/sharp-libvips-linuxmusl-x64 1.2.4 LGPL-3.0-or-later
@img/sharp-wasm32 0.33.5 Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-wasm32 0.34.5 Apache-2.0 AND LGPL-3.0-or-later AND MIT
@img/sharp-win32-arm64 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32 0.33.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-ia32 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64 0.33.5 Apache-2.0 AND LGPL-3.0-or-later
@img/sharp-win32-x64 0.34.5 Apache-2.0 AND LGPL-3.0-or-later
axe-core 4.10.3 MPL-2.0
lightningcss 1.32.0 MPL-2.0
lightningcss-android-arm64 1.32.0 MPL-2.0
lightningcss-darwin-arm64 1.32.0 MPL-2.0
lightningcss-darwin-x64 1.32.0 MPL-2.0
lightningcss-freebsd-x64 1.32.0 MPL-2.0
lightningcss-linux-arm-gnueabihf 1.32.0 MPL-2.0
lightningcss-linux-arm64-gnu 1.32.0 MPL-2.0
lightningcss-linux-arm64-musl 1.32.0 MPL-2.0
lightningcss-linux-x64-gnu 1.32.0 MPL-2.0
lightningcss-linux-x64-musl 1.32.0 MPL-2.0
lightningcss-win32-arm64-msvc 1.32.0 MPL-2.0
lightningcss-win32-x64-msvc 1.32.0 MPL-2.0
Resolved Packages (20)
Package Version Original Resolved Source
@react-grab/cli 0.1.23 UNKNOWN MIT extracted from LICENSE file in npm tarball
@react-grab/cli 0.1.29 UNKNOWN MIT extracted from LICENSE file in npm tarball
@react-grab/mcp 0.1.29 UNKNOWN MIT extracted from LICENSE file in npm tarball
@sentry/cli 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-darwin 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-linux-arm 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-linux-arm64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-linux-i686 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-linux-x64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-win32-arm64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-win32-i686 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
@sentry/cli-win32-x64 2.58.5 FSL-1.1-MIT FSL-1.1-MIT verified via getsentry/sentry-cli GitHub LICENSE file (Functional Source License 1.1 with MIT future grant; source-available, not OSI-approved, not copyleft)
codemirror-lang-elixir 4.0.0 UNKNOWN Apache-2.0 GitHub repo livebook-dev/codemirror-lang-elixir LICENSE file
element-source 0.0.3 UNKNOWN MIT extracted from LICENSE file in npm tarball
lezer-elixir 1.1.2 UNKNOWN Apache-2.0 GitHub repo livebook-dev/lezer-elixir LICENSE file
map-stream 0.1.0 UNKNOWN MIT GitHub repo dominictarr/map-stream LICENCE file
memorystream 0.3.1 UNKNOWN MIT GitHub repo JSBizon/node-memorystream LICENSE file
pause-stream 0.0.11 MIT,Apache2 MIT OR Apache-2.0 license field is array ["MIT","Apache2"]; LICENSE file confirms dual MIT/Apache-2.0 license
posthog-js 1.369.0 SEE LICENSE IN LICENSE Apache-2.0 GitHub repo PostHog/posthog-js LICENSE file (text confirms Apache 2.0)
valid-url 1.0.9 UNKNOWN MIT GitHub repo ogt/valid-url LICENSE file (text confirms MIT)

…6-44664, CVE-2026-44665)

Replaces the prior resolution-override approach with a lockfile refresh.
The existing fast-xml-builder@^1.1.5 range already admits the patched
1.2.0; the lockfile was just stale.

Also consolidates SOU-1073 / CVE-2026-44664 (previously #1185) into this
PR — same package release fixes both sibling CVEs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@brendan-kellam brendan-kellam changed the title fix: upgrade fast-xml-builder to ^1.1.7 to address CVE-2026-44665 fix: refresh yarn.lock to upgrade fast-xml-builder to ^1.2.0 (CVE-2026-44664, CVE-2026-44665) May 9, 2026
@brendan-kellam brendan-kellam marked this pull request as ready for review May 9, 2026 22:40
@brendan-kellam brendan-kellam enabled auto-merge (squash) May 9, 2026 22:47
@brendan-kellam brendan-kellam disabled auto-merge May 9, 2026 22:47
@brendan-kellam brendan-kellam merged commit ad7f9f6 into main May 9, 2026
10 checks passed
@brendan-kellam brendan-kellam deleted the cursor/fix-cve-2026-44665-3caf branch May 9, 2026 22:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants