Skip to content

build(deps): bump fast-xml-parser and @aws-sdk/xml-builder in /src/applications/lambda/petfood-cleanup-processor-node#522

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/src/applications/lambda/petfood-cleanup-processor-node/multi-88c8261ef1
Open

build(deps): bump fast-xml-parser and @aws-sdk/xml-builder in /src/applications/lambda/petfood-cleanup-processor-node#522
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/src/applications/lambda/petfood-cleanup-processor-node/multi-88c8261ef1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Mar 25, 2026

Bumps fast-xml-parser and @aws-sdk/xml-builder. These dependencies needed to be updated together.
Updates fast-xml-parser from 5.3.6 to 5.5.8

Release notes

Sourced from fast-xml-parser's releases.

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

  • support path-expression-matcher
  • fix: stopNode should not be parsed
  • performance improvement for stopNode checking

Separate Builder

XML Builder was the part of fast-xml-parser for years. But considering that any bug in builder may false-alarm the users who are only using parser and vice-versa, we have decided to split it into a separate package.

Migration

To migrate to fast-xml-builder;

From

import { XMLBuilder } from "fast-xml-parser";

To

import  XMLBuilder  from "fast-xml-builder";

XMLBuilder will be removed from current package in any next major version of this library. So better to migrate.

support strictReservedNames

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.3.9...v5.3.9

handle non-array input for XML builder && support maxNestedTags

CJS typing fix

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

4.5.5 / 2026-03-22

apply fixes from v5 (legacy maintenance branch v4-maintenance)

  • support maxEntityCount
  • support onDangerousProperty
  • support maxNestedTags
  • handle prototype pollution
  • fix incorrect entity name replacement
  • fix incorrect condition for entity expansion

5.5.8 / 2026-03-20

  • pass read only matcher in callback

5.5.7 / 2026-03-19

  • fix: entity expansion limits
  • update strnum package to 2.2.0

5.5.6 / 2026-03-16

  • update builder dependency
  • fix incorrect regex to replace . in entity name
  • fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

  • sanitize dangerous tag or attribute name
  • error on critical property name
  • support onDangerousProperty option

5.5.4 / 2026-03-13

  • declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

  • upgrade builder

5.5.2 / 2026-03-11

  • update dependency to fix typings

5.5.1 / 2026-03-10

  • fix dependency

5.5.0 / 2026-03-10

  • support path-expression-matcher
  • fix: stopNode should not be parsed
  • performance improvement for stopNode checking

... (truncated)

Commits
  • a92a665 pass read only matcher in call back
  • a21c441 update package detail
  • 239b64a check for min value for entity exapantion options
  • 61cb666 restrict more properties to be unsafe
  • 41abd66 performance improvement of reading DOCTYPE
  • 3dfcd20 refactor: performance improvement
  • 870043e update release info
  • 6df401e update builder dependency
  • bd26122 check for entitiy expansion for lastEntities and html entities too
  • 7e70dd8 fix incorrect regex to replace . in entity name
  • Additional commits viewable in compare view

Updates @aws-sdk/xml-builder from 3.972.8 to 3.972.15

Changelog

Sourced from @​aws-sdk/xml-builder's changelog.

3.972.15 (2026-03-20)

Chores

  • xml-builder: bump fast-xml-parser to 5.5.8 (#7876) (80ef601)

3.972.14 (2026-03-18)

Bug Fixes

  • xml-builder: configure maxTotalExpansions on fast-xml-parser (#7868) (2ad1477)

Chores

  • xml-builder: single-pass XML escape for escapeElement and escapeAttribute (#7833) (97de564)

3.972.12 (2026-03-18)

Chores

3.972.11 (2026-03-13)

Chores

  • codegen: sync for retry strategy lifecycle fix (#7842) (7bf8888)

3.972.10 (2026-03-04)

Chores

  • set downlevel types to be used in typescript@'<4.5' (#7817) (03dad66)

3.972.9 (2026-02-28)

Chores

  • deps: bump fast-xml-parser from 5.3.6 to 5.4.1 (#7796) (c0dac29)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
build(deps): bump fast-xml-parser and @aws-sdk/xml-builder
18fbb7a 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.3.6 to 5.5.8
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.3.6...v5.5.8)

Updates `@aws-sdk/xml-builder` from 3.972.8 to 3.972.15
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.5.8
  dependency-type: indirect
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.15
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Mar 25, 2026
@dependabot dependabot bot mentioned this pull request Mar 25, 2026
Closed
@github-actions
Copy link
Copy Markdown
Contributor

github-actions bot commented Mar 25, 2026

ASH Security Scan Report

  • Report generated: 2026-03-25T15:25:35+00:00
  • Time since scan: 1 minute

Scan Metadata

  • Project: ASH
  • Scan executed: 2026-03-25T15:24:03+00:00
  • ASH version: 3.2.4

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

  • Severity levels:
    • Suppressed (S): Findings that have been explicitly suppressed and don't affect scanner status
    • Critical (C): Highest severity findings that require immediate attention
    • High (H): Serious findings that should be addressed soon
    • Medium (M): Moderate risk findings
    • Low (L): Lower risk findings
    • Info (I): Informational findings with minimal risk
  • Duration (Time): Time taken by the scanner to complete its execution
  • Actionable: Number of findings at or above the threshold severity level that require attention
  • Result:
    • PASSED = No findings at or above threshold
    • FAILED = Findings at or above threshold
    • MISSING = Required dependencies not available
    • SKIPPED = Scanner explicitly disabled
    • ERROR = Scanner execution error
  • Threshold: The minimum severity level that will cause a scanner to fail
    • Thresholds: ALL, LOW, MEDIUM, HIGH, CRITICAL
    • Source: Values in parentheses indicate where the threshold is set:
      • global (global_settings section in the ASH_CONFIG used)
      • config (scanner config section in the ASH_CONFIG used)
      • scanner (default configuration in the plugin, if explicitly set)
  • Statistics calculation:
    • All statistics are calculated from the final aggregated SARIF report
    • Suppressed findings are counted separately and do not contribute to actionable findings
    • Scanner status is determined by comparing actionable findings to the threshold
Scanner Suppressed Critical High Medium Low Info Actionable Result Threshold
bandit 0 0 0 0 25 0 0 PASSED MEDIUM (global)
cdk-nag 0 0 0 0 0 0 0 SKIPPED MEDIUM (global)
cfn-nag 0 0 0 0 0 0 0 MISSING MEDIUM (global)
checkov 30 0 0 0 0 0 0 PASSED MEDIUM (global)
detect-secrets 24 0 0 0 0 0 0 PASSED MEDIUM (global)
grype 0 9 0 6 2 0 15 FAILED MEDIUM (global)
npm-audit 0 0 0 0 0 0 0 PASSED MEDIUM (global)
opengrep 0 0 0 0 0 0 0 MISSING MEDIUM (global)
semgrep 14 1 0 0 0 0 1 FAILED MEDIUM (global)
syft 0 0 0 0 0 0 0 PASSED MEDIUM (global)
trivy-repo 0 0 0 0 0 0 0 MISSING MEDIUM (global)

Top 8 Hotspots

Files with the highest number of security findings:

Finding Count File Location
4 src/applications/microservices/petfood-rs/Cargo.lock
2 src/applications/lambda/petstatusupdater-node/package-lock.json
2 src/cdk/package-lock.json
2 src/applications/lambda/traffic-generator-node/package-lock.json
2 src/applications/lambda/petfood-stock-processor-node/package-lock.json
2 package-lock.json
1 src/cdk/scripts/keycloak/keycloak-setup.sh
1 src/applications/microservices/payforadoption-go/go.mod

Detailed Findings

Show 16 actionable findings

Finding 1: bash.curl.security.curl-pipe-bash.curl-pipe-bash

  • Severity: HIGH
  • Scanner: semgrep
  • Rule ID: bash.curl.security.curl-pipe-bash.curl-pipe-bash
  • Location: src/cdk/scripts/keycloak/keycloak-setup.sh:213

Description:
Data is being piped into bash from a curl command. An attacker with control of the server in the curl command could inject malicious code into the pipe, resulting in a system compromise. Avoid piping untrusted data into bash or any other shell if you can. If you must do this, consider checking the SHA sum of the content returned by the server to verify its integrity.

Code Snippet:

curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash

Finding 2: GHSA-8gc5-j5rx-235r-fast-xml-parser

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-8gc5-j5rx-235r-fast-xml-parser
  • Location: src/applications/lambda/petstatusupdater-node/package-lock.json:1

Description:
A high vulnerability in npm package: fast-xml-parser, version 5.3.6 was found at: /src/applications/lambda/petstatusupdater-node/package-lock.json

Finding 3: GHSA-8gc5-j5rx-235r-fast-xml-parser

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-8gc5-j5rx-235r-fast-xml-parser
  • Location: src/cdk/package-lock.json:1

Description:
A high vulnerability in npm package: fast-xml-parser, version 5.3.6 was found at: /src/cdk/package-lock.json

Finding 4: GHSA-8gc5-j5rx-235r-fast-xml-parser

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-8gc5-j5rx-235r-fast-xml-parser
  • Location: src/applications/lambda/traffic-generator-node/package-lock.json:1

Description:
A high vulnerability in npm package: fast-xml-parser, version 5.4.1 was found at: /src/applications/lambda/traffic-generator-node/package-lock.json

Finding 5: GHSA-8gc5-j5rx-235r-fast-xml-parser

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-8gc5-j5rx-235r-fast-xml-parser
  • Location: src/applications/lambda/petfood-stock-processor-node/package-lock.json:1

Description:
A high vulnerability in npm package: fast-xml-parser, version 5.4.1 was found at: /src/applications/lambda/petfood-stock-processor-node/package-lock.json

Finding 6: GHSA-rf6f-7fwh-wjgh-flatted

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-rf6f-7fwh-wjgh-flatted
  • Location: package-lock.json:1

Description:
A high vulnerability in npm package: flatted, version 3.3.3 was found at: /package-lock.json

Finding 7: GHSA-25h7-pfq9-p65f-flatted

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-25h7-pfq9-p65f-flatted
  • Location: package-lock.json:1

Description:
A high vulnerability in npm package: flatted, version 3.3.3 was found at: /package-lock.json

Finding 8: GHSA-p77j-4mvh-x3m3-google.golang.org/grpc

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-p77j-4mvh-x3m3-google.golang.org/grpc
  • Location: src/applications/microservices/payforadoption-go/go.mod:1

Description:
A critical vulnerability in go-module package: google.golang.org/grpc, version v1.76.0 was found at: /src/applications/microservices/payforadoption-go/go.mod

Finding 9: GHSA-394x-vwmw-crm3-aws-lc-sys

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-394x-vwmw-crm3-aws-lc-sys
  • Location: src/applications/microservices/petfood-rs/Cargo.lock:1

Description:
A high vulnerability in rust-crate package: aws-lc-sys, version 0.38.0 was found at: /src/applications/microservices/petfood-rs/Cargo.lock

Finding 10: GHSA-9f94-5g5w-gf6r-aws-lc-sys

  • Severity: HIGH
  • Scanner: grype
  • Rule ID: GHSA-9f94-5g5w-gf6r-aws-lc-sys
  • Location: src/applications/microservices/petfood-rs/Cargo.lock:1

Description:
A high vulnerability in rust-crate package: aws-lc-sys, version 0.38.0 was found at: /src/applications/microservices/petfood-rs/Cargo.lock

Finding 11: GHSA-jp2q-39xq-3w4g-fast-xml-parser

  • Severity: MEDIUM
  • Scanner: grype
  • Rule ID: GHSA-jp2q-39xq-3w4g-fast-xml-parser
  • Location: src/applications/lambda/petstatusupdater-node/package-lock.json:1

Description:
A medium vulnerability in npm package: fast-xml-parser, version 5.3.6 was found at: /src/applications/lambda/petstatusupdater-node/package-lock.json

Finding 12: GHSA-jp2q-39xq-3w4g-fast-xml-parser

  • Severity: MEDIUM
  • Scanner: grype
  • Rule ID: GHSA-jp2q-39xq-3w4g-fast-xml-parser
  • Location: src/cdk/package-lock.json:1

Description:
A medium vulnerability in npm package: fast-xml-parser, version 5.3.6 was found at: /src/cdk/package-lock.json

Finding 13: GHSA-jp2q-39xq-3w4g-fast-xml-parser

  • Severity: MEDIUM
  • Scanner: grype
  • Rule ID: GHSA-jp2q-39xq-3w4g-fast-xml-parser
  • Location: src/applications/lambda/petfood-stock-processor-node/package-lock.json:1

Description:
A medium vulnerability in npm package: fast-xml-parser, version 5.4.1 was found at: /src/applications/lambda/petfood-stock-processor-node/package-lock.json

Finding 14: GHSA-jp2q-39xq-3w4g-fast-xml-parser

  • Severity: MEDIUM
  • Scanner: grype
  • Rule ID: GHSA-jp2q-39xq-3w4g-fast-xml-parser
  • Location: src/applications/lambda/traffic-generator-node/package-lock.json:1

Description:
A medium vulnerability in npm package: fast-xml-parser, version 5.4.1 was found at: /src/applications/lambda/traffic-generator-node/package-lock.json

Finding 15: GHSA-pwjx-qhcg-rvj4-rustls-webpki

  • Severity: MEDIUM
  • Scanner: grype
  • Rule ID: GHSA-pwjx-qhcg-rvj4-rustls-webpki
  • Location: src/applications/microservices/petfood-rs/Cargo.lock:1

Description:
A medium vulnerability in rust-crate package: rustls-webpki, version 0.101.7 was found at: /src/applications/microservices/petfood-rs/Cargo.lock

Finding 16: GHSA-pwjx-qhcg-rvj4-rustls-webpki

  • Severity: MEDIUM
  • Scanner: grype
  • Rule ID: GHSA-pwjx-qhcg-rvj4-rustls-webpki
  • Location: src/applications/microservices/petfood-rs/Cargo.lock:1

Description:
A medium vulnerability in rust-crate package: rustls-webpki, version 0.103.9 was found at: /src/applications/microservices/petfood-rs/Cargo.lock

Report generated by Automated Security Helper (ASH) at 2026-03-25T15:25:35+00:00

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants