[Snyk] Upgrade xml2js from 0.4.23 to 0.6.0

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade xml2js from 0.4.23 to 0.6.0.

:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

- The recommended version is **2 versions** ahead of your current version. - The recommended version was released **a month ago**, on 2023-05-25. The recommended version fixes: Severity | Issue | PriorityScore (*) | Exploit Maturity | :-------------------------:|:-------------------------|-------------------------|:-------------------------

| Prototype Pollution
[SNYK-JS-XML2JS-5414874](https://snyk.io/vuln/SNYK-JS-XML2JS-5414874) | **586/1000**
**Why?** Proof of Concept exploit, Has a fix available, CVSS 5.3 | Proof of Concept (*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: xml2js

0.6.0 - 2023-05-25

Release new version

  </li>
  <li>
    <b>0.5.0</b> - <a href="https://snyk.io/redirect/github/Leonidas-from-XIV/node-xml2js/releases/tag/0.5.0">2023-04-09</a></br><p>Update package.json with latest PR</p>
  </li>
  <li>
    <b>0.4.23</b> - 2019-12-19
  </li>
</ul>
from <a href="https://snyk.io/redirect/github/Leonidas-from-XIV/node-xml2js/releases">xml2js GitHub release notes</a>

Commit messages

Package name: xml2js

0e29f0e Release new version
a25035c Remove old unused files
1de4688 Merge pull request #680 from Leonidas-from-XIV/zap-dependency-fix
3b97ae5 Merge pull request #681 from Leonidas-from-XIV/cve-compat-fix
167a385 Fix zap to be the original dependency
5f6620f Compile changed coffeescript code
044cfe5 Undo API changes from #603
7292aa9 fix: include missed key check
4c8ec89 fix: revert incorrectly adapted code
ad3a297 refactor: extract function for key check
d486007 fix: explicitly ignore vulnerable properties
246252a chore: revert previous CVE fix
b856cb8 Add upper bound for coffeescript (for now)
bd0f780 Bump dependency versions to fix security issues
3a8d46e Update lockfile
9f730bb Update package.json with latest PR
50a492a Merge pull request #603 from autopulated/master
7bc3c5d Merge pull request #598 from fnimick/master
f412a12 Merge pull request #635 from wisesimpson/patch-1
d318ce0 Update README.md
581b19a use Object.create(null) to create all parsed objects (prevent prototype replacement)
a212950 Add documentation for `explicitCharkey` option
1832e0b Merge pull request #512 from economia/master
198063c Merge pull request #556 from Omega-Ariston/fix-issue544

Compare

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs

snoopysecurity / dvws-node

[Snyk] Upgrade xml2js from 0.4.23 to 0.6.0 #50

Snyk has created this PR to upgrade xml2js from 0.4.23 to 0.6.0.