Skip to content

fix(deps): update fast-xml-parser to 5.7.1#1737

Merged
AtofStryker merged 1 commit intocypress-io:masterfrom
MikeMcC399:update/fast-xml-parser
Apr 27, 2026
Merged

fix(deps): update fast-xml-parser to 5.7.1#1737
AtofStryker merged 1 commit intocypress-io:masterfrom
MikeMcC399:update/fast-xml-parser

Conversation

@MikeMcC399
Copy link
Copy Markdown
Collaborator

@MikeMcC399 MikeMcC399 commented Apr 23, 2026

Situation

npm audit and Dependabot report a moderate severity vulnerability GHSA-gh4j-gqv2-49f6 in fast-xml-parser@5.5.7, a transient dependency of @actions/cache@5.0.5.

$ npm audit
# npm audit report

fast-xml-parser  <5.7.0
Severity: moderate
fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters - https://github.com/advisories/GHSA-gh4j-gqv2-49f6
fix available via `npm audit fix`
node_modules/fast-xml-parser

1 moderate severity vulnerability

To address all issues, run:
  npm audit fix

Change

Use npm audit fix to update to fast-xml-parser@5.7.1 and rebuild the action.


Note

Medium Risk
Updates the bundled XML parsing/building implementation and introduces new transitive deps, which could subtly change XML parsing/entity decoding or output escaping behavior at runtime. Scope is limited to dependency upgrades and regenerated dist/index.js.

Overview
Updates lockfile dependencies, bumping fast-xml-parser to 5.7.1 (plus related bumps like fast-xml-builder, path-expression-matcher, strnum) and adding the new transitive @nodable/entities package.

Regenerates dist/index.js to bundle the updated XML parser/builder code, including the upstream security fix around safer XML XMLBuilder comment/CDATA handling and updated entity decoding logic.

Reviewed by Cursor Bugbot for commit 2e3b6ea. Bugbot is set up for automated code reviews on this repo. Configure here.

@MikeMcC399 MikeMcC399 added bug Something isn't working type: dependencies labels Apr 23, 2026
@cypress-app-bot
Copy link
Copy Markdown
Collaborator

@MikeMcC399 MikeMcC399 self-assigned this Apr 23, 2026
@MikeMcC399 MikeMcC399 marked this pull request as ready for review April 23, 2026 08:14
@AtofStryker AtofStryker merged commit c495c3d into cypress-io:master Apr 27, 2026
89 checks passed
@MikeMcC399 MikeMcC399 deleted the update/fast-xml-parser branch April 27, 2026 18:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working type: dependencies

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants