Skip to content

fix: update fast-xml-parser to 5.5.6#1688

Merged
jennifer-shehane merged 1 commit intocypress-io:masterfrom
MikeMcC399:update/fast-xml-parser
Mar 18, 2026
Merged

fix: update fast-xml-parser to 5.5.6#1688
jennifer-shehane merged 1 commit intocypress-io:masterfrom
MikeMcC399:update/fast-xml-parser

Conversation

@MikeMcC399
Copy link
Collaborator

@MikeMcC399 MikeMcC399 commented Mar 18, 2026

Situation

npm audit shows a vulnerability GHSA-8gc5-j5rx-235r in dependencies

$ npm audit
# npm audit report

fast-xml-parser  4.0.0-beta.3 - 5.5.5
Severity: high
fast-xml-parser affected by numeric entity expansion bypassing all entity expansion limits (incomplete fix for CVE-2026-26278) - https://github.com/advisories/GHSA-8gc5-j5rx-235r
fix available via `npm audit fix`
node_modules/fast-xml-parser

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Change

Use npm audit fix to update fast-xml-parser to 5.5.6


Note

Medium Risk
Dependency bump pulls in a large regenerated dist/index.js bundle, which can subtly change XML parsing/serialization behavior and edge-case handling despite being primarily a security fix.

Overview
Updates bundled XML tooling to address the fast-xml-parser security advisory by upgrading fast-xml-parser to 5.5.6 (and fast-xml-builder to 1.1.4) and regenerating dist/index.js.

The new versions introduce additional parsing safeguards and features (e.g., stricter reserved-name handling/prototype-pollution defenses, enhanced entity-expansion limits, and new path-expression-matcher support), reflected via the updated lockfile and bundled output.

Written by Cursor Bugbot for commit a057546. This will update automatically on new commits. Configure here.

@cypress-app-bot
Copy link

@MikeMcC399 MikeMcC399 added bug Something isn't working type: dependencies labels Mar 18, 2026
@MikeMcC399 MikeMcC399 self-assigned this Mar 18, 2026
@MikeMcC399 MikeMcC399 marked this pull request as ready for review March 18, 2026 05:31
@jennifer-shehane jennifer-shehane merged commit ed2d88c into cypress-io:master Mar 18, 2026
89 checks passed
@github-actions
Copy link

🎉 This PR is included in version 7.1.7 🎉

The release is available on:

Your semantic-release bot 📦🚀

@MikeMcC399 MikeMcC399 deleted the update/fast-xml-parser branch March 18, 2026 13:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants