search

sverweij / state-machine-cat

write beautiful state charts :scream_cat:
https://state-machine-cat.js.org
MIT License
793 stars 45 forks source link

[Snyk] Security upgrade fast-xml-parser from 3.21.1 to 4.1.2 #176

Closed snyk-bot closed 1 year ago

snyk-bot commented 1 year ago

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
high severity 768/1000
Why? Proof of Concept exploit, Recently disclosed, Has a fix available, CVSS 7.5		 Prototype Pollution
SNYK-JS-FASTXMLPARSER-3325616		 Yes Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Commit messages
Package name: fast-xml-parser The new version differs by 187 commits.
  • 2b032a4 Update package detail
  • 7a7dbac update package for release
  • b6ee2a5 update tests for #540
  • 62f9e4b common logic to build text and obj node
  • 83069d8 update package for release
  • ed962e0 Merge branch 'dev'
  • c959d13 update package detail
  • 6ebcb14 make eNotation optional
  • 30624d7 Fix '<' or '>' in DTD comment throwing an error. (#533)
  • 40a2176 update package detail
  • 45b01db add missed typing "eNotation"
  • 25f5e8a Fix docs for unpairdTags example in XMLBuilder
  • 007d638 update package for release
  • 7ca95a2 comment unimplemented methods
  • 59eb905 520 preserveorder formatting (#527)
  • 08c59e2 remove space
  • 6689ed2 docs: fix node project example (#522)
  • 0d9d60d Fixed wrong usage in example (#518)
  • a619c48 Add transformAttributeName to transform the attribute name upon parsing. Same logic as transformTagName (#519)
  • f900ef8 Update README.md
  • 9a8d0a7 Update README.md
  • 1ff4e9a update package detail
  • f719751 Update README
  • f962cb5 fix: Builder tag/attributeValueProcessor types (#492)
See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution

codeclimate[bot] commented 1 year ago

Code Climate has analyzed commit 448eb73c and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (100% is the threshold).

This pull request will bring the total coverage in the repository to 100.0% (0.0% change).

View more on Code Climate.

sverweij commented 1 year ago

fast-xml-parser completely changed its interface from 3 => 4, so yeah - this won't work.