Open
Conversation
kuhe
force-pushed
the
kuhe/chore/xml
branch
2 times, most recently
from
dc70fa0 to
b73fa31
Compare
kuhe
changed the title
kuhe
force-pushed
the
kuhe/chore/xml
branch
3 times, most recently
from
8c2acf7 to
43baba0
Compare
kuhe
force-pushed
the
kuhe/chore/xml
branch
4 times, most recently
from
b408de8 to
4fbf50c
Compare
kuhe
commented
Mar 20, 2026
kuhe
force-pushed
the
kuhe/chore/xml
branch
2 times, most recently
from
8e8ce96 to
99f5fab
Compare
kuhe
commented
Mar 31, 2026
kuhe
commented
Mar 31, 2026
chore(xml-builder): avoid object key collisions Co-authored-by: George Fu <kuhe@users.noreply.github.com>
seven332
added a commit
to vm0-ai/vm0
that referenced
this pull request
Apr 23, 2026
fast-xml-parser 5.7.0 made parser.addEntity("#...") a hard error (CHANGELOG:
"you cant add numeric external entity"). @aws-sdk/xml-builder@3.972.18 still
calls parser.addEntity("#xD", "\r") and addEntity("#10", "\n") as a legacy
fallback for S3/STS XML responses containing 
 / character refs.
Our fast-xml-parser override to >=5.7.0 (for GHSA-gh4j-gqv2-49f6) therefore
caused every S3 ListObjectsV2 / STS GetCallerIdentity call to throw
"Invalid character '#' in entity name: '#xD'" during XML deserialization,
surfacing as 500s from agent delete in e2e ser-t05-zero-agent.bats.
Patch drops both addEntity lines. fast-xml-parser 5.7.x decodes 
 and
internally (CHANGELOG 5.6.0: "fix: entity replacement for numeric
entities"), so the fallback is functionally redundant.
Refs:
- aws/aws-sdk-js-v3#7949
- aws-amplify/amplify-backend#3172
- Upstream replacement PR aws/aws-sdk-js-v3#7863 (still open)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
5 tasks
seven332
added a commit
to vm0-ai/vm0
that referenced
this pull request
Apr 23, 2026
fast-xml-parser 5.7.0 made parser.addEntity("#...") a hard error (CHANGELOG:
"you cant add numeric external entity"). @aws-sdk/xml-builder@3.972.18 still
calls parser.addEntity("#xD", "\r") and addEntity("#10", "\n") as a legacy
fallback for S3/STS XML responses containing 
 / character refs.
Our fast-xml-parser override to >=5.7.0 (for GHSA-gh4j-gqv2-49f6) therefore
caused every S3 ListObjectsV2 / STS GetCallerIdentity call to throw
"Invalid character '#' in entity name: '#xD'" during XML deserialization,
surfacing as 500s from agent delete in e2e ser-t05-zero-agent.bats.
Patch drops both addEntity lines. fast-xml-parser 5.7.x decodes 
 and
internally (CHANGELOG 5.6.0: "fix: entity replacement for numeric
entities"), so the fallback is functionally redundant.
Refs:
- aws/aws-sdk-js-v3#7949
- aws-amplify/amplify-backend#3172
- Upstream replacement PR aws/aws-sdk-js-v3#7863 (still open)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Issue
#7366
Description
Switch from fast-xml-parser to internal implementation.
Benchmarks: trivikr/benchmark-xml-parser#6
The main diff is that the XML parsing error will be communicated with a differently worded message.
Testing
snapshot tests, CI
Checklist
*.integ.spec.ts) or E2E tests.@public,@internaltags and enabled doc generation on the package. Remember that access level annotations go below the description, not above.By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.