From db52e6bf3c7fe8454e63ad6b910ca9a8f2feaa06 Mon Sep 17 00:00:00 2001 From: "w.kashiwagi" Date: Tue, 28 Jul 2026 16:48:10 +0900 Subject: [PATCH] Bump fast-xml-parser from 5.9.3 to 5.10.1 Fixes GHSA-8r6m-32jq-jx6q (high): repeated DOCTYPE declarations reset entity expansion limits in fast-xml-parser, allowing a crafted XML document to exceed configured limits and exhaust CPU/memory. Pulled in transitively via @astrojs/rss, whose range (^5.5.7) already allows the patched version, so only the lockfile changes. --- pnpm-lock.yaml | 32 +++++++++++++++++++------------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 65ee810..719fb20 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -540,8 +540,8 @@ packages: '@emnapi/core': ^1.7.1 '@emnapi/runtime': ^1.7.1 - '@nodable/entities@2.2.0': - resolution: {integrity: sha512-9uGyhaQavEUMC8AIddIjau4NsnsXhou+j5sBAGojCM1oxmQpVKTWR/9JxABD6UAv12vpIms55fPZKFQEhG6uBg==} + '@nodable/entities@3.0.0': + resolution: {integrity: sha512-8L9xFeTYKhm49xfIypoe2W5wV1m/3Z58kT+7kR9A8OyFxcPduI4VmxaUMQyKYrRjUoLLSXv6EKKID5Tvj9cUVw==} '@oslojs/encoding@1.1.0': resolution: {integrity: sha512-70wQhgYmndg4GCPxPPxPGevRKqTIJ2Nh4OkiMWmDAVYsTQ+Ta7Sq+rPevXyXGdzr30/qZBnyOalCszoMxlyldQ==} @@ -1101,8 +1101,8 @@ packages: fast-xml-builder@1.2.1: resolution: {integrity: sha512-tPb5TTWfgfVx5BNSi2xV0eLr89POeXXn0dXIsCJ9m1narrWxeIyx6je9d7Rce/3NyXLbvuQmLkxq+RuxMWejvw==} - fast-xml-parser@5.9.3: - resolution: {integrity: sha512-brCNCeScma/kqa54J4PIDriSSSLssRkuYaUCpvHJulGc3HGI/xxKUCTDcYkAdqJsyb//ydpbxecjC3hB9+tb/g==} + fast-xml-parser@5.10.1: + resolution: {integrity: sha512-IEMIf7298kXuZSRFoGfMYrl7is8LpavODgbNz1cwIudv7KwVFnuU+UsMporfq6PD6aXSlawZlARiA3UywCTfMw==} hasBin: true fdir@6.5.0: @@ -1215,8 +1215,8 @@ packages: resolution: {integrity: sha512-+Pgi+vMuUNkJyExiMBt5IlFoMyKnr5zhJ4Uspz58WOhBF5QoIZkFyNHIbBAtHwzVAgk5RtndVNsDRN61/mmDqg==} engines: {node: '>=12'} - is-unsafe@1.0.1: - resolution: {integrity: sha512-CLK2+VdgERgD96EYm5lUQssZYlRg2tkZnbsxZoacmSiRxiFJ4Nk4SzjCl+Ur+v3kXIY9dTIdb3IH22y1mZ56LA==} + is-unsafe@2.0.0: + resolution: {integrity: sha512-2LdV822R+wmI86unXA93WCFpL6g+av8ynWk0nrHyJqGop5VoocYsSLFgN8jrfalT6iGeLNM4KXuVSsULP53kEA==} jiti@2.7.0: resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==} @@ -2018,6 +2018,10 @@ packages: resolution: {integrity: sha512-k8KO9hrMyNk6tUWqUfkTEZbezRRpONVOzUTnc97VnCvyj6Tf9lyUR9EDAIeiVLv56jsMcoXEwjW8Kv5yPY52lw==} engines: {node: '>=16.0.0'} + xml-naming@0.3.0: + resolution: {integrity: sha512-ghig2TBE/H11aOVgmahA3MhimvkBr6JIYknH/Dhdk10nXwdbIqBJsbfMxpvFPG8bAw77gN29aQWvKpmVoPlvPQ==} + engines: {node: '>=16.0.0'} + xxhash-wasm@1.1.0: resolution: {integrity: sha512-147y/6YNh+tlp6nd/2pWq38i9h6mz/EuQ6njIrmW8D1BS5nCqs0P6DG+m6zTGnNz5I+uhZ0SHxBs9BsPrwcKDA==} @@ -2160,7 +2164,7 @@ snapshots: '@astrojs/rss@4.0.19': dependencies: - fast-xml-parser: 5.9.3 + fast-xml-parser: 5.10.1 piccolore: 0.1.3 zod: 4.4.3 @@ -2499,7 +2503,7 @@ snapshots: '@tybys/wasm-util': 0.10.3 optional: true - '@nodable/entities@2.2.0': {} + '@nodable/entities@3.0.0': {} '@oslojs/encoding@1.1.0': {} @@ -3074,14 +3078,14 @@ snapshots: path-expression-matcher: 1.6.2 xml-naming: 0.1.0 - fast-xml-parser@5.9.3: + fast-xml-parser@5.10.1: dependencies: - '@nodable/entities': 2.2.0 + '@nodable/entities': 3.0.0 fast-xml-builder: 1.2.1 - is-unsafe: 1.0.1 + is-unsafe: 2.0.0 path-expression-matcher: 1.6.2 strnum: 2.4.1 - xml-naming: 0.1.0 + xml-naming: 0.3.0 fdir@6.5.0(picomatch@4.0.5): optionalDependencies: @@ -3273,7 +3277,7 @@ snapshots: is-plain-obj@4.1.0: {} - is-unsafe@1.0.1: {} + is-unsafe@2.0.0: {} jiti@2.7.0: {} @@ -4356,6 +4360,8 @@ snapshots: xml-naming@0.1.0: {} + xml-naming@0.3.0: {} + xxhash-wasm@1.1.0: {} yargs-parser@22.0.0: {}