Build(deps): Bump fast-xml-parser from 5.5.7 to 5.11.0 by dependabot[bot] · Pull Request #304 · github/local-action

dependabot · 2026-08-20T00:50:38Z

Bumps fast-xml-parser from 5.5.7 to 5.11.0.

Release notes

Sourced from fast-xml-parser's releases.

v5.11.0

What's Changed

add support for endIndex in node metadata (5.x edition) by @Wain-PC in NaturalIntelligence/fast-xml-parser#850

fix: don't crash on a closing tag with no matching opening tag by @hdimer in NaturalIntelligence/fast-xml-parser#861

New Contributors

@Wain-PC made their first contribution in NaturalIntelligence/fast-xml-parser#850

@hdimer made their first contribution in NaturalIntelligence/fast-xml-parser#861

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.1...v5.11.0

v5.10.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#849

Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @dependabot[bot] in NaturalIntelligence/fast-xml-parser#848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

What's Changed

Harden GitHub Actions workflows by @martincostello in NaturalIntelligence/fast-xml-parser#841

GitHub Actions workflow fixes by @martincostello in NaturalIntelligence/fast-xml-parser#844

New Contributors

@martincostello made their first contribution in NaturalIntelligence/fast-xml-parser#841

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

update strnum, use is-unsafe

update strnum to 2.3.0

you can set hex, binary, enotation, infinity, unicode

validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

update strnum, FXB. Use xml-naming for DOCTYPE

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)

This will consider xml-version as well. '1.0' is default

update strnum to 2.3.0

You can set octal and binary parsing which is by deault off

update fast-xml-builder to 1.2.0

can sanitize tag names if found invalid

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.11.0 / 2026-08-16

feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]

fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]

fix: DOCTYPE to read SYSTEM/PUBLIC

deps: strnum v2.4.2

5.10.1 / 2026-07-17

fix: multiple DOCTYPE declarations.

deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

upgrade:

xml-naming v0.3.0: cache support

PEM v1.6.2: sibling bug fix

is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

update strnum

*5.9.2 / 2026-06-17

dummy release to test changes in github action

*5.9.1 / 2026-06-17

dummy release to test release from github action

*5.9.0 / 2026-06-15

update strnum to 2.3.0

you can set hex, binary, enotation, infinity, unicode

validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)

This will consider xml-version as well. '1.0' is default

update strnum to 2.3.0

You can set octal and binary parsing which is bydeault off

update fast-xml-builder to 1.2.0

can sanitize tag names if found invalid

fix format output

5.7.3 / 2006-05-05

fix: alwaysCreateTextNode should create text node when attributes are present for self closing node

fix stop node expression when ns prefix is removed (found by iruizsalinas)

... (truncated)

Commits

f3c69ae 5.11.0
fdbd072 update for release
c5fcb5b update lock files
549452a update gitignore
3ed7b03 deps
fee9b15 update README
57ad0d3 fix DOCTYPE to read SYSTEM/PUBLIC
c8e2f28 fix: don't crash on a closing tag with no matching opening tag (#861)
4652011 add support for endIndex in node metadata (#850)
2ce7191 5.10.1
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-xml-parser since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.5.7 to 5.11.0. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.5.7...v5.11.0) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.11.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2026-08-20T00:54:28Z

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	5	0	0	0.42s
❌ ACTION	zizmor	5	1	0	0.53s
❌ JAVASCRIPT	eslint	19	19	0	11.7s
✅ JAVASCRIPT	prettier	19	0	0	0.76s
✅ JSON	npm-package-json-lint	yes	no	no	0.72s
✅ JSON	prettier	29	0	0	1.14s
✅ MARKDOWN	markdownlint	10	0	0	0.6s
✅ REPOSITORY	betterleaks	yes	no	no	0.88s
✅ REPOSITORY	checkov	yes	no	no	31.28s
✅ REPOSITORY	gitleaks	yes	no	no	1.01s
✅ REPOSITORY	git_diff	yes	no	no	0.03s
❌ REPOSITORY	grype	yes	24	no	89.97s
❌ REPOSITORY	osv-scanner	yes	48	no	1.8s
✅ REPOSITORY	secretlint	yes	no	no	1.2s
✅ REPOSITORY	syft	yes	no	no	3.99s
❌ REPOSITORY	trivy	yes	1	no	22.24s
✅ REPOSITORY	trivy-sbom	yes	no	no	3.87s
✅ REPOSITORY	trufflehog	yes	no	no	38.44s
❌ TYPESCRIPT	eslint	108	26	0	9.84s
✅ TYPESCRIPT	prettier	108	0	0	3.31s
✅ YAML	prettier	25	0	0	0.77s
✅ YAML	yamllint	25	0	0	0.85s

Detailed Issues

❌ JAVASCRIPT / eslint - 19 errors

__fixtures__/javascript-esm/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/index.js

__fixtures__/javascript-esm/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/no-import/src/main.js

__fixtures__/javascript-esm/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/index.js

__fixtures__/javascript-esm/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/post/main.js

__fixtures__/javascript-esm/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/index.js

__fixtures__/javascript-esm/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/pre/main.js

__fixtures__/javascript-esm/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/index.js

__fixtures__/javascript-esm/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript-esm/success/src/main.js

__fixtures__/javascript/no-export/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/index.js

__fixtures__/javascript/no-export/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-export/src/main.js

__fixtures__/javascript/no-import/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/index.js

__fixtures__/javascript/no-import/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/no-import/src/main.js

__fixtures__/javascript/success/post/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/index.js

__fixtures__/javascript/success/post/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/post/main.js

__fixtures__/javascript/success/pre/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/index.js

__fixtures__/javascript/success/pre/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/pre/main.js

__fixtures__/javascript/success/src/index.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/index.js

__fixtures__/javascript/success/src/main.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/javascript/success/src/main.js

bin/local-action.js
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): bin/local-action.js

✖ 19 problems (19 errors, 0 warnings)

❌ TYPESCRIPT / eslint - 26 errors

has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/index.ts

__fixtures__/typescript-esm/no-export/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-export/src/main.ts

__fixtures__/typescript-esm/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/index.ts

__fixtures__/typescript-esm/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/no-import/src/main.ts

__fixtures__/typescript-esm/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/index.ts

__fixtures__/typescript-esm/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/post/main.ts

__fixtures__/typescript-esm/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/index.ts

__fixtures__/typescript-esm/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/pre/main.ts

__fixtures__/typescript-esm/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/index.ts

__fixtures__/typescript-esm/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/success/src/main.ts

__fixtures__/typescript-esm/tsconfig-comments/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/index.ts

__fixtures__/typescript-esm/tsconfig-comments/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript-esm/tsconfig-comments/src/main.ts

__fixtures__/typescript/no-import/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/index.ts

__fixtures__/typescript/no-import/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/no-import/src/main.ts

__fixtures__/typescript/success-yaml/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/index.ts

__fixtures__/typescript/success-yaml/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/post/main.ts

__fixtures__/typescript/success-yaml/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/index.ts

__fixtures__/typescript/success-yaml/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/pre/main.ts

__fixtures__/typescript/success-yaml/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/index.ts

__fixtures__/typescript/success-yaml/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success-yaml/src/main.ts

__fixtures__/typescript/success/post/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/index.ts

__fixtures__/typescript/success/post/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/post/main.ts

__fixtures__/typescript/success/pre/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/index.ts

__fixtures__/typescript/success/pre/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/pre/main.ts

__fixtures__/typescript/success/src/index.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/index.ts

__fixtures__/typescript/success/src/main.ts
  0:0  error  Parsing error: "parserOptions.project" has been provided for @typescript-eslint/parser.
The file was not found in any of the provided project(s): __fixtures__/typescript/success/src/main.ts

✖ 26 problems (26 errors, 0 warnings)

(Truncated to last 6666 characters out of 6769)

❌ REPOSITORY / grype - 24 errors

[0000]  WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal) from=syft
NAME             INSTALLED  FIXED IN  TYPE  VULNERABILITY        SEVERITY  EPSS         RISK   
lodash           4.17.23    4.18.0    npm   GHSA-r5fr-rjxr-66jc  High      2.6% (83rd)  2.0    
undici           7.24.4     7.28.0    npm   GHSA-vxpw-j846-p89q  High      0.8% (53rd)  0.6    
undici           7.24.4     7.28.0    npm   GHSA-vmh5-mc38-953g  High      0.5% (37th)  0.3    
brace-expansion  1.1.12     1.1.18    npm   GHSA-rgw5-rvv9-x895  High      0.4% (34th)  0.3    
brace-expansion  2.0.2      2.1.4     npm   GHSA-rgw5-rvv9-x895  High      0.4% (34th)  0.3    
undici           7.24.4     7.28.0    npm   GHSA-hm92-r4w5-c3mj  High      0.3% (27th)  0.3    
brace-expansion  1.1.12     1.1.17    npm   GHSA-mh99-v99m-4gvg  High      0.3% (26th)  0.3    
brace-expansion  2.0.2      2.1.3     npm   GHSA-mh99-v99m-4gvg  High      0.3% (26th)  0.3    
brace-expansion  1.1.12     1.1.13    npm   GHSA-f886-m6hf-6m8v  Medium    0.4% (35th)  0.2    
brace-expansion  2.0.2      2.0.3     npm   GHSA-f886-m6hf-6m8v  Medium    0.4% (35th)  0.2    
brace-expansion  1.1.12     1.1.16    npm   GHSA-3jxr-9vmj-r5cp  High      0.3% (27th)  0.2    
brace-expansion  2.0.2      2.1.2     npm   GHSA-3jxr-9vmj-r5cp  High      0.3% (27th)  0.2    
undici           7.24.4     7.29.0    npm   GHSA-4cwx-7wf7-3272  High      0.3% (25th)  0.2    
yaml             2.8.2      2.8.3     npm   GHSA-48c2-rrv3-qjmp  Medium    0.5% (38th)  0.2    
undici           7.24.4     7.28.0    npm   GHSA-pr7r-676h-xcf6  Medium    0.4% (29th)  0.2    
lodash           4.17.23    4.18.0    npm   GHSA-f23m-r3pf-42rh  Medium    0.3% (24th)  0.2    
undici           7.24.4     7.28.0    npm   GHSA-p88m-4jfj-68fv  Medium    0.3% (17th)  0.1    
undici           7.24.4     7.29.0    npm   GHSA-jr45-8vmc-qm54  Medium    0.2% (14th)  0.1    
undici           7.24.4     7.29.0    npm   GHSA-8xcm-r25x-g524  Medium    0.2% (7th)   < 0.1  
undici           7.24.4     7.29.0    npm   GHSA-v3r7-h72x-cjcm  Medium    0.2% (6th)   < 0.1  
undici           7.24.4     7.28.0    npm   GHSA-g8m3-5g58-fq7m  Low       0.2% (15th)  < 0.1  
undici           7.24.4     7.28.0    npm   GHSA-35p6-xmwp-9g52  Low       0.2% (12th)  < 0.1  
undici           7.24.4     7.29.0    npm   GHSA-m8rv-5g2x-5cg5  Medium    0.2% (5th)   < 0.1  
esbuild          0.27.3     0.28.1    npm   GHSA-g7r4-m6w7-qqqr  Low       N/A          N/A
[0089] ERROR discovered vulnerabilities at or above the severity threshold

❌ REPOSITORY / osv-scanner - 48 errors

----+-----------+-----------------------+---------+---------------+-------------------+
| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE               | VERSION | FIXED VERSION | SOURCE            |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+
| https://osv.dev/GHSA-4x5r-pxfx-6jf8 | 3.2  | npm       | @babel/core (dev)     | 7.29.0  | 7.29.6        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion       | 1.1.12  | 1.1.16        | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion       | 1.1.12  | 1.1.13        | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion       | 1.1.12  | 1.1.17        | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion       | 1.1.12  | 1.1.18        | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion       | 2.0.2   | 2.1.2         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion       | 2.0.2   | 2.0.3         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion       | 2.0.2   | 2.1.3         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion       | 2.0.2   | 2.1.4         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev) | 5.0.2   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-3jxr-9vmj-r5cp | 7.7  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.7         | package-lock.json |
| https://osv.dev/GHSA-f886-m6hf-6m8v | 6.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.5         | package-lock.json |
| https://osv.dev/GHSA-jxxr-4gwj-5jf2 | 6.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.6         | package-lock.json |
| https://osv.dev/GHSA-mh99-v99m-4gvg | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.8         | package-lock.json |
| https://osv.dev/GHSA-rgw5-rvv9-x895 | 7.5  | npm       | brace-expansion (dev) | 5.0.4   | 5.0.9         | package-lock.json |
| https://osv.dev/GHSA-g7r4-m6w7-qqqr | 2.5  | npm       | esbuild               | 0.27.3  | 0.28.1        | package-lock.json |
| https://osv.dev/GHSA-25h7-pfq9-p65f | 7.5  | npm       | flatted (dev)         | 3.3.3   | 3.4.0         | package-lock.json |
| https://osv.dev/GHSA-rf6f-7fwh-wjgh | 8.9  | npm       | flatted (dev)         | 3.3.3   | 3.4.2         | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.1        | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 3.14.2  | 3.15.0        | package-lock.json |
| https://osv.dev/GHSA-52cp-r559-cp3m | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.0         | package-lock.json |
| https://osv.dev/GHSA-5p4m-2wfm-xmqj | 7.5  | npm       | js-yaml (dev)         | 4.1.1   | 4.3.1         | package-lock.json |
| https://osv.dev/GHSA-h67p-54hq-rp68 | 5.3  | npm       | js-yaml (dev)         | 4.1.1   | 4.2.0         | package-lock.json |
| https://osv.dev/GHSA-f23m-r3pf-42rh | 6.5  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-r5fr-rjxr-66jc | 8.1  | npm       | lodash                | 4.17.23 | 4.18.0        | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 2.3.1   | 2.3.2         | package-lock.json |
| https://osv.dev/GHSA-3v7f-55p6-f55p | 5.3  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-c2c7-rcm5-vvqj | 7.5  | npm       | picomatch (dev)       | 4.0.3   | 4.0.4         | package-lock.json |
| https://osv.dev/GHSA-35p6-xmwp-9g52 | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-4cwx-7wf7-3272 | 7.4  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-8xcm-r25x-g524 | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-g8m3-5g58-fq7m | 3.7  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-hm92-r4w5-c3mj | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-jr45-8vmc-qm54 | 5.9  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-m8rv-5g2x-5cg5 | 4.2  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-p88m-4jfj-68fv | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-pr7r-676h-xcf6 | 5.9  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-v3r7-h72x-cjcm | 4.8  | npm       | undici                | 7.24.4  | 7.29.0        | package-lock.json |
| https://osv.dev/GHSA-vmh5-mc38-953g | 7.4  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-vxpw-j846-p89q | 7.5  | npm       | undici                | 7.24.4  | 7.28.0        | package-lock.json |
| https://osv.dev/GHSA-w5hq-g745-h8pq | 7.5  | npm       | uuid (dev)            | 8.3.2   | 11.1.1        | package-lock.json |
| https://osv.dev/GHSA-48c2-rrv3-qjmp | 4.3  | npm       | yaml                  | 2.8.2   | 2.8.3         | package-lock.json |
+-------------------------------------+------+-----------+-----------------------+---------+---------------+-------------------+

(Truncated to last 6666 characters out of 7082)

❌ REPOSITORY / trivy - 1 error

6-9697                    │
│                 ├─────────────────────┼──────────┤        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-14643      │ MEDIUM   │        │                   │ 7.29.0, 8.9.0               │ undici: undici: Cross-user information disclosure due to     │
│                 │                     │          │        │                   │                             │ improper Cache-Control directive parsing                     │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-14643                   │
│                 ├─────────────────────┤          │        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-15157      │          │        │                   │ 6.28.0, 7.29.0, 8.9.0       │ undici: undici: HTTP header injection via unvalidated        │
│                 │                     │          │        │                   │                             │ blob-like body type property                                 │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-15157                   │
│                 ├─────────────────────┤          │        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-16728      │          │        │                   │                             │ undici: undici: Response desynchronization via retry         │
│                 │                     │          │        │                   │                             │ interceptor with mismatched Content-Length                   │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-16728                   │
│                 ├─────────────────────┤          │        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-16729      │          │        │                   │                             │ undici: Undici: Cookie attribute injection allows bypassing  │
│                 │                     │          │        │                   │                             │ security protections                                         │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-16729                   │
│                 ├─────────────────────┤          │        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-9678       │          │        │                   │ 7.28.0, 8.5.0               │ undici: Undici: Information disclosure due to improper       │
│                 │                     │          │        │                   │                             │ cache-control header parsing                                 │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-9678                    │
│                 ├─────────────────────┤          │        │                   ├─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-9679       │          │        │                   │ 6.27.0, 7.28.0, 8.5.0       │ undici: undici vulnerable to HTTP header injection via       │
│                 │                     │          │        │                   │                             │ Set-Cookie percent-decoding                                  │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-9679                    │
│                 ├─────────────────────┼──────────┤        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-11525      │ LOW      │        │                   │                             │ undici: undici: Weakening of cookie SameSite policy due to   │
│                 │                     │          │        │                   │                             │ incorrect parsing of...                                      │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-11525                   │
│                 ├─────────────────────┤          │        │                   │                             ├──────────────────────────────────────────────────────────────┤
│                 │ CVE-2026-6733       │          │        │                   │                             │ undici: Undici: Response queue poisoning on reused           │
│                 │                     │          │        │                   │                             │ keep-alive sockets can lead to...                            │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-6733                    │
├─────────────────┼─────────────────────┼──────────┤        ├───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ yaml            │ CVE-2026-33532      │ MEDIUM   │        │ 2.8.2             │ 2.8.3, 1.10.3               │ yaml: yaml: Denial of Service via deeply nested YAML         │
│                 │                     │          │        │                   │                             │ document parsing                                             │
│                 │                     │          │        │                   │                             │ https://avd.aquasec.com/nvd/cve-2026-33532                   │
└─────────────────┴─────────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.74.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

(Truncated to last 6666 characters out of 22687)

❌ ACTION / zizmor - 1 error

INFO zizmor: 🌈 zizmor v1.25.0
fatal: no audit was performed
'ref-confusion' audit failed on file://.github/workflows/codeql-analysis.yml

Caused by:
    0: error in 'ref-confusion' audit
    1: couldn't list branches for actions/checkout
    2: request error while accessing GitHub API
    3: HTTP status client error (401 Unauthorized) for url (https://github.com/actions/checkout.git/git-upload-pack)


[ACTION_ZIZMOR_ERROR_GITHUB_API_UNREACHABLE] Zizmor could not access a repository referenced by a `uses:` clause via the GitHub API (missing token, insufficient scope, or cross-repo private access).
To allow zizmor to authenticate with GITHUB_TOKEN (or a PAT with `Contents: read-only`), whitelist the variable in your .mega-linter.yml:
ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
  - GITHUB_TOKEN
If the referenced workflow is in a private repo outside the current one, provide a PAT with cross-repo access instead of the default GITHUB_TOKEN, or run zizmor in offline mode.

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Show us your support by starring ⭐ the repository

dependabot Bot added dependabot Dependabot issues and PRs npm Node.js issues and PRs labels Aug 20, 2026

dependabot Bot requested a review from ncalteen as a code owner August 20, 2026 00:50

dependabot Bot added dependabot Dependabot issues and PRs npm Node.js issues and PRs labels Aug 20, 2026

dependabot Bot mentioned this pull request Aug 20, 2026

Build(deps): Bump fast-xml-parser from 5.5.7 to 5.10.1 #299

Closed

Navigation Menu

Uh oh!

Build(deps): Bump fast-xml-parser from 5.5.7 to 5.11.0 - #304

Build(deps): Bump fast-xml-parser from 5.5.7 to 5.11.0#304
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/fast-xml-parser-5.11.0

dependabot Bot commented on behalf of github Aug 20, 2026

Uh oh!

github-actions Bot commented Aug 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 20, 2026

v5.11.0

What's Changed

New Contributors

v5.10.1

v5.10.0

What's Changed

v5.9.3

What's Changed

New Contributors

v5.9.2

v5.9.1

update strnum, use is-unsafe

update strnum, FXB. Use xml-naming for DOCTYPE

Uh oh!

github-actions Bot commented Aug 20, 2026

❌MegaLinter analysis: Error

Detailed Issues

Notices

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants