Skip to content

fix(security): override xmldom >=0.9.10, fast-xml-parser >=5.7.0, uuid >=14.0.0#2082

Merged
samuv merged 1 commit intomainfrom
security/auto-remediate-vulns
Apr 23, 2026
Merged

fix(security): override xmldom >=0.9.10, fast-xml-parser >=5.7.0, uuid >=14.0.0#2082
samuv merged 1 commit intomainfrom
security/auto-remediate-vulns

Conversation

@toolhive-studio-ci
Copy link
Copy Markdown
Contributor

Summary

Remediate six security advisories by bumping three pnpm.overrides entries: @xmldom/xmldom to >=0.9.10 (four High advisories), fast-xml-parser to >=5.7.0 (one Medium), and adding uuid: ">=14.0.0" (one Medium in the production mermaid dependency tree).

Changes

CVE / GHSA Package Severity Production Action Verified
GHSA-2v35-w6hq-6mfw @xmldom/xmldom High No Override >=0.9.10 Pass
GHSA-f6ww-3ggp-fr8h @xmldom/xmldom High No Override >=0.9.10 Pass
GHSA-j759-j44w-7fr8 @xmldom/xmldom High No Override >=0.9.10 Pass
GHSA-x6wf-f3px-wcqx @xmldom/xmldom High No Override >=0.9.10 Pass
GHSA-gh4j-gqv2-49f6 fast-xml-parser Medium No Override >=5.7.0 Pass
GHSA-w5hq-g745-h8pq uuid Medium Yes Override >=14.0.0 Pass

Files Modified

  • package.json: bumped @xmldom/xmldom override to >=0.9.10, fast-xml-parser to >=5.7.0, added uuid: ">=14.0.0"

Verification

  • pnpm audit --prod: Pass
  • grype . --config .grype.yaml: Pass

@samuv samuv merged commit 1d5b269 into main Apr 23, 2026
17 checks passed
@samuv samuv deleted the security/auto-remediate-vulns branch April 23, 2026 08:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant