Skip to content

chore(deps): update fast-xml-builder to 1.2.0#1756

Merged
mschile merged 1 commit into
cypress-io:masterfrom
MikeMcC399:update/fast-xml-builder
May 11, 2026
Merged

chore(deps): update fast-xml-builder to 1.2.0#1756
mschile merged 1 commit into
cypress-io:masterfrom
MikeMcC399:update/fast-xml-builder

Conversation

@MikeMcC399
Copy link
Copy Markdown
Collaborator

@MikeMcC399 MikeMcC399 commented May 9, 2026

Situation

npm audit and Dependabot report a moderate severity vulnerability GHSA-gh4j-gqv2-49f6 in fast-xml-builder@1.1.5, a transient dependency of @actions/cache@5.0.5.

$ npm audit
# npm audit report

fast-xml-builder  <=1.1.6
Severity: high
fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes - https://github.com/advisories/GHSA-5wm8-gmm8-39j9
fast-xml-builder Comment Value regex can be bypassed - https://github.com/advisories/GHSA-45c6-75p6-83cc
fix available via `npm audit fix`
node_modules/fast-xml-builder

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Change

Use npm audit fix to update to fast-xml-builder@1.2.0.


Note

Low Risk
Low risk lockfile-only dependency update to pick up security fixes; main risk is unexpected behavior changes in the transitive XML builder dependency.

Overview
Updates package-lock.json to upgrade transitive dependency fast-xml-builder from 1.1.5 to 1.2.0 to address reported vulnerabilities.

This also updates fast-xml-builder’s dependency constraints (path-expression-matcher to ^1.5.0) and adds the new transitive package xml-naming@0.1.0.

Reviewed by Cursor Bugbot for commit 1ea030e. Bugbot is set up for automated code reviews on this repo. Configure here.

@MikeMcC399 MikeMcC399 added the bug Something isn't working label May 9, 2026
@MikeMcC399 MikeMcC399 self-assigned this May 9, 2026
@cypress-app-bot
Copy link
Copy Markdown
Collaborator

@MikeMcC399 MikeMcC399 marked this pull request as ready for review May 9, 2026 06:37
@MikeMcC399 MikeMcC399 requested a review from mschile May 11, 2026 10:16
@mschile mschile merged commit 3edcc8d into cypress-io:master May 11, 2026
90 checks passed
@MikeMcC399 MikeMcC399 deleted the update/fast-xml-builder branch May 11, 2026 14:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants