deps: track two dev-only advisories from pnpm audit (aws-sdk v2, fast-xml-parser) #42

Two advisories reported by pnpm audit are dev-only and do not reach a published
tiny-oss consumer. The package ships exactly one runtime dependency
(js-base64); both vulnerable packages arrive through devDependencies used as
test oracles — the official SDKs whose signatures our signers must match
byte-for-byte. This issue tracks them so the ordinary deps/triage path owns
them instead of a sweep note.

fast-xml-parser — patched version exists, blocked upstream

4.5.7 is resolved from cos-js-sdk-v5@1.10.1, which is already the latest
release of that package and pins the vulnerable line exactly:

// cos-js-sdk-v5@1.10.1 dependencies
"fast-xml-parser": "4.5.0"

So there is no version of cos-js-sdk-v5 to upgrade to that fixes this; the fix
must come from the override already declared in pnpm-workspace.yaml.

Note the override is deliberately version-scoped:

overrides:
  fast-xml-parser@4: ^4.5.4   # <- the vulnerable line resolves here
  fast-xml-parser@5: ^5.7.0   # <- unrelated consumer, already patched

fast-xml-parser@4's newest 4.x is 4.5.7, which is still <5.7.0, so
bumping the override cannot clear the advisory — the @4 lane would have to be
pointed at the patched 5.x line (fast-xml-parser@4: ^5.7.0), forcing
cos-js-sdk-v5 onto a new major version. That is a real compatibility risk in a
signing oracle, so it should be a deliberate change with the oracle re-run, not a
silent one.

Worth noting: the vulnerable 4.5.7 copy is reachable only through
cos-js-sdk-v5; the other fast-xml-parser in the tree is 5.11.1 (via
@azure/storage-blob → @azure/core-xml), i.e. already patched.

Options

1. Widen the override to fast-xml-parser@4: ^5.7.0 and re-run
   test/cos-signature.spec.ts to confirm the oracle still matches. Fastest;
   accepts a major-version jump inside a test-only path.
2. Leave as-is and record the accepted risk — the code path is test-only and
   no user-controlled XML reaches it.

aws-sdk (v2) — end-of-support, no fix coming

2.1693.0 is the newest v2 release, and npm marks the package:

The AWS SDK for JavaScript (v2) has reached end-of-support, and no longer
receives updates. Please migrate your code to use AWS SDK for JavaScript (v3).

That is why patched_versions is null: there is no upstream fix, only a
migration. The advisory itself asks callers to validate the region parameter,
which we control entirely — test/aws-signature.spec.ts passes a fixed literal
region, so an attacker-influenced region is not a shape this code has.

Options

1. Accept and close as wontfix, citing test-only usage plus EOL upstream.
2. Migrate the oracle to @aws-sdk/client-s3 (v3) — the real fix, but it is a
   test-infrastructure change and the byte-identical assertions would need
   revalidating.

Suggested disposition

Both are dev-only, and neither is reachable by a consumer. Option 2 in each case
is the thorough fix and Option 1 the cheap one; either way this should be settled
by a human decision on scope, not silently patched by the loop — which is exactly
why it is an issue and not a deps PR.

Relevant context: AGENTS.md requires signers to stay byte-identical to their
official SDKs, and these oracles are what enforce that. Any change here must keep
test/aws-signature.spec.ts, test/cos-signature.spec.ts and
npm run test:azure-oracle passing.