-
Notifications
You must be signed in to change notification settings - Fork 395
deps: update fast-xml-parser to 5.3.4 due to security vulnerability #2710
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Conversation
Fixes GHSA-37qj-frw5-hhjh which affects versions 4.3.6 through 5.3.3. The vulnerability causes a RangeError when parsing numeric XML entities with out-of-range code points. Fixes googleapis#2709
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
|
What needs to happen to get this merged? |
Currently the samples test and system test are failing. Once these are fixed, you'll be able to merge the PR. We're working on fixing the tests, I'll let you know once the tests are fixed. Thanks! |
Fixes GHSA-37qj-frw5-hhjh CVE, which affects versions 4.3.6 through 5.3.3. The vulnerability causes a RangeError when parsing numeric XML entities with out-of-range code points, which affects audit checks.
Fixes #2709
Description
Update fast-xml-parser version to ^5.3.4 because of the CVE above
Impact
Testing
Additional Information
Checklist
Fixes #2709 🦕