chore(deps): bump fast-xml-parser and @aws-sdk/xml-builder in /sdk-test-node by dependabot[bot] · Pull Request #7 · ProjectOpenSea/floci-compatibility-tests

dependabot · 2026-04-09T02:03:53Z

Bumps fast-xml-parser and @aws-sdk/xml-builder. These dependencies needed to be updated together.
Updates fast-xml-parser from 5.4.1 to 5.5.8

Release notes

Sourced from fast-xml-parser's releases.

fix bugs of entity parsing and value parsing

fix: entity expansion limits update strnum package to 2.2.0

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

support path-expression-matcher

fix: stopNode should not be parsed

performance improvement for stopNode checking

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.10 / 2026-04-03

increase default entity explansion limit as many projects demand for that

performance improvement

reduce calls to toString

early return when entities are not present

prepare rawAttrsForMatcher only if user sets jPath: false

5.5.9 / 2026-03-23

combine typing files

4.5.5 / 2026-03-22

apply fixes from v5 (legacy maintenance branch v4-maintenance)

support maxEntityCount

support onDangerousProperty

support maxNestedTags

handle prototype pollution

fix incorrect entity name replacement

fix incorrect condition for entity expansion

5.5.8 / 2026-03-20

pass read only matcher in callback

5.5.7 / 2026-03-19

fix: entity expansion limits

update strnum package to 2.2.0

5.5.6 / 2026-03-16

update builder dependency

fix incorrect regex to replace . in entity name

fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

sanitize dangerous tag or attribute name

error on critical property name

support onDangerousProperty option

5.5.4 / 2026-03-13

declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

... (truncated)

Commits

a92a665 pass read only matcher in call back
a21c441 update package detail
239b64a check for min value for entity exapantion options
61cb666 restrict more properties to be unsafe
41abd66 performance improvement of reading DOCTYPE
3dfcd20 refactor: performance improvement
870043e update release info
6df401e update builder dependency
bd26122 check for entitiy expansion for lastEntities and html entities too
7e70dd8 fix incorrect regex to replace . in entity name
Additional commits viewable in compare view

Updates @aws-sdk/xml-builder from 3.972.10 to 3.972.17

Changelog

Sourced from @aws-sdk/xml-builder's changelog.

3.972.17 (2026-04-07)

Chores

codegen: update for sparse types and retry 2.1 updates (#7916) (b19357a)

3.972.16 (2026-03-25)

Docs

packages-internal: readme updates for internal packages (#7885) (2da8b4c)

3.972.15 (2026-03-20)

Chores

xml-builder: bump fast-xml-parser to 5.5.8 (#7876) (80ef601)

3.972.14 (2026-03-18)

Bug Fixes

xml-builder: configure maxTotalExpansions on fast-xml-parser (#7868) (2ad1477)

Chores

xml-builder: single-pass XML escape for escapeElement and escapeAttribute (#7833) (97de564)

3.972.12 (2026-03-18)

Chores

bump fast-xml-parser to 5.5.6 (#7862) (5e8d73b)

3.972.11 (2026-03-13)

Chores

codegen: sync for retry strategy lifecycle fix (#7842) (7bf8888)

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together. Updates `fast-xml-parser` from 5.4.1 to 5.5.8 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.4.1...v5.5.8) Updates `@aws-sdk/xml-builder` from 3.972.10 to 3.972.17 - [Release notes](https://github.com/aws/aws-sdk-js-v3/releases) - [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md) - [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.5.8 dependency-type: indirect - dependency-name: "@aws-sdk/xml-builder" dependency-version: 3.972.17 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-04-09T02:04:26Z

Caution

Review the following alerts detected in dependencies.

According to your organization's Security Policy, you must resolve all "Block" alerts before proceeding. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Block		Recently published: npm `@aws-sdk/xml-builder` published yesterday Location: Package overview From: sdk-test-node/package-lock.json → `npm/@aws-sdk/client-cognito-identity-provider@3.1003.0` → `npm/@aws-sdk/client-cloudwatch@3.1003.0` → `npm/@aws-sdk/client-dynamodb@3.1003.0` → `npm/@aws-sdk/client-iam@3.1003.0` → `npm/@aws-sdk/client-sns@3.1003.0` → `npm/@aws-sdk/client-kinesis@3.1003.0` → `npm/@aws-sdk/client-kms@3.1003.0` → `npm/@aws-sdk/client-lambda@3.1003.0` → `npm/@aws-sdk/client-sts@3.1003.0` → `npm/@aws-sdk/client-secrets-manager@3.1003.0` → `npm/@aws-sdk/client-ssm@3.1003.0` → `npm/@aws-sdk/client-sqs@3.1003.0` → `npm/@aws-sdk/client-s3@3.1003.0` → `npm/@aws-sdk/xml-builder@3.972.17` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@aws-sdk/xml-builder@3.972.17`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm `@smithy/types` published 2 days ago Location: Package overview From: sdk-test-node/package-lock.json → `npm/@aws-sdk/client-cognito-identity-provider@3.1003.0` → `npm/@aws-sdk/client-cloudwatch@3.1003.0` → `npm/@aws-sdk/client-dynamodb@3.1003.0` → `npm/@aws-sdk/client-iam@3.1003.0` → `npm/@aws-sdk/client-sns@3.1003.0` → `npm/@aws-sdk/client-kinesis@3.1003.0` → `npm/@aws-sdk/client-kms@3.1003.0` → `npm/@aws-sdk/client-lambda@3.1003.0` → `npm/@aws-sdk/client-sts@3.1003.0` → `npm/@aws-sdk/client-secrets-manager@3.1003.0` → `npm/@aws-sdk/client-ssm@3.1003.0` → `npm/@aws-sdk/client-sqs@3.1003.0` → `npm/@aws-sdk/client-s3@3.1003.0` → `npm/@smithy/types@4.14.0` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@smithy/types@4.14.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm `path-expression-matcher` published 2 days ago Location: Package overview From: sdk-test-node/package-lock.json → `npm/@aws-sdk/client-cognito-identity-provider@3.1003.0` → `npm/@aws-sdk/client-cloudwatch@3.1003.0` → `npm/@aws-sdk/client-dynamodb@3.1003.0` → `npm/@aws-sdk/client-iam@3.1003.0` → `npm/@aws-sdk/client-sns@3.1003.0` → `npm/@aws-sdk/client-kinesis@3.1003.0` → `npm/@aws-sdk/client-kms@3.1003.0` → `npm/@aws-sdk/client-lambda@3.1003.0` → `npm/@aws-sdk/client-sts@3.1003.0` → `npm/@aws-sdk/client-secrets-manager@3.1003.0` → `npm/@aws-sdk/client-ssm@3.1003.0` → `npm/@aws-sdk/client-sqs@3.1003.0` → `npm/@aws-sdk/client-s3@3.1003.0` → `npm/path-expression-matcher@1.4.0` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/path-expression-matcher@1.4.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Block		Recently published: npm `strnum` published 2 days ago Location: Package overview From: sdk-test-node/package-lock.json → `npm/@aws-sdk/client-cognito-identity-provider@3.1003.0` → `npm/@aws-sdk/client-cloudwatch@3.1003.0` → `npm/@aws-sdk/client-dynamodb@3.1003.0` → `npm/@aws-sdk/client-iam@3.1003.0` → `npm/@aws-sdk/client-sns@3.1003.0` → `npm/@aws-sdk/client-kinesis@3.1003.0` → `npm/@aws-sdk/client-kms@3.1003.0` → `npm/@aws-sdk/client-lambda@3.1003.0` → `npm/@aws-sdk/client-sts@3.1003.0` → `npm/@aws-sdk/client-secrets-manager@3.1003.0` → `npm/@aws-sdk/client-ssm@3.1003.0` → `npm/@aws-sdk/client-sqs@3.1003.0` → `npm/@aws-sdk/client-s3@3.1003.0` → `npm/strnum@2.2.3` ℹ Read more on: This package \| This alert \| What are recently published artifacts? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should either be allowlisted to allow recently-published versions, or an older version should be used instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/strnum@2.2.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 9, 2026

dependabot bot mentioned this pull request Apr 9, 2026

chore(deps): bump fast-xml-parser and @aws-sdk/xml-builder in /sdk-test-node #1

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump fast-xml-parser and @aws-sdk/xml-builder in /sdk-test-node#7

chore(deps): bump fast-xml-parser and @aws-sdk/xml-builder in /sdk-test-node#7
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/sdk-test-node/multi-d854bddb60

dependabot bot commented on behalf of github Apr 9, 2026

Uh oh!

socket-security bot commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Apr 9, 2026

fix bugs of entity parsing and value parsing

fix entity expansion and incorrect replacement and performance

support onDangerousProperty

update dependecies to fix typings

integrate path-expression-matcher

3.972.17 (2026-04-07)

Chores

3.972.16 (2026-03-25)

Docs

3.972.15 (2026-03-20)

Chores

3.972.14 (2026-03-18)

Bug Fixes

Chores

3.972.12 (2026-03-18)

Chores

3.972.11 (2026-03-13)

Chores

Uh oh!

socket-security bot commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants