Bump fast-xml-parser from 5.9.3 to 5.10.1 - #7
Merged
Conversation
Fixes GHSA-8r6m-32jq-jx6q (high): repeated DOCTYPE declarations reset entity expansion limits in fast-xml-parser, allowing a crafted XML document to exceed configured limits and exhaust CPU/memory. Pulled in transitively via @astrojs/rss, whose range (^5.5.7) already allows the patched version, so only the lockfile changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
概要
Dependabot アラート #3（High）を解消します。
fast-xml-parserで DOCTYPE 宣言を繰り返すとエンティティ展開の上限がリセットされ、細工した XML で CPU / メモリを枯渇させられる（CWE-776）>= 5.9.3, < 5.10.1/ 修正版:5.10.1変更内容
pnpm-lock.yamlのみ（+19 / -13）。依存経路は
@astrojs/rss@4.0.19→fast-xml-parserの推移依存で、@astrojs/rss側の指定^5.5.7が既に修正版を許容しているためpackage.jsonの変更は不要です。lockfile の差分はfast-xml-parserとその配下（@nodable/entities、is-unsafe、xml-naming）に限られ、astroなど他パッケージには波及していません。実リスク
本テーマでの
@astrojs/rssの用途はsrc/pages/rss.xml.tsでのビルド時 RSS 生成のみで、外部から受け取った XML をパースする箇所はありません。実質的な攻撃面はほぼありませんが、テンプレートリポジトリとして配布する以上、利用者が別用途で使う可能性を考慮して更新します。確認したこと
pnpm audit→ No known vulnerabilities foundpnpm build成功、dist/rss.xmlも正常に生成（フィード内容に問題なし）