Skip to content

Upgrade fast-xml-parser version from 4.2.2 to 5.5.7#7899

Open
acwhite211 wants to merge 4 commits intomainfrom
issue-7896
Open

Upgrade fast-xml-parser version from 4.2.2 to 5.5.7#7899
acwhite211 wants to merge 4 commits intomainfrom
issue-7896

Conversation

@acwhite211
Copy link
Copy Markdown
Member

@acwhite211 acwhite211 commented Apr 2, 2026

Fixes #7896
Fixes https://github.com/specify/specify7/security/dependabot/203
Fixes https://github.com/specify/specify7/security/dependabot/184

Upgrade fast-xml-parser version from 4.2.2 to 5.5.7. This upgrade solves the dependabot issue of numeric entity expansion bypassing all entity expansion limits. This is a major version upgrade, so we need to confirm nothing is broken when testing. Also needed to fix an issue with X2jOptionsOptional and XmlBuilderOptionsOptional in the xml.ts file in order to accommodate the version upgrade.

Checklist

  • Self-review the PR after opening it to make sure the changes look good and
    self-explanatory (or properly documented)
  • Add relevant issue to release milestone
  • Add pr to documentation list

Testing instructions

  • Light general testing. This package upgrade effects code the deals with xml. Try testing out components that user xml, like forms and user preferences for example.

@acwhite211 acwhite211 marked this pull request as ready for review April 2, 2026 18:46
@acwhite211 acwhite211 requested review from a team April 2, 2026 18:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: 📋Back Log

Development

Successfully merging this pull request may close these issues.

Solve dependabot issue of numeric entity expansion bypassing with fast-xml-parser version upgrade

2 participants