Skip to content

Bump @xmldom/xmldom and xml-crypto in /ui#3270

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/ui/multi-92d06108ae
Closed

Bump @xmldom/xmldom and xml-crypto in /ui#3270
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/ui/multi-92d06108ae

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 1, 2026 •
edited
Loading

Bumps @xmldom/xmldom to 0.8.12 and updates ancestor dependency xml-crypto. These dependencies need to be updated together.

Updates @xmldom/xmldom from 0.7.13 to 0.8.12

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.12

Commits

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

0.8.10

Commits

Fixed

Thank you, @​qtow, for your contributions

0.8.9

Commits

Fixed

Thank you, @​cjbarth, for your contributions

0.8.8

Commits

Fixed

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.12

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

0.9.8

Fixed

Chore

Thank you, @​kboshold, @​Ponynjaa, for your contributions.

0.9.7

Added

Fixed

... (truncated)

Commits
  • 189cb78 0.8.12
  • ed08df7 fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (#968)
  • a5b929b chore: clean up generated test artefacts before running ci-local
  • 4e37a20 ci: run format:check in lint job
  • ac0ac77 chore: ignore generated files when checking formatting
  • 968c893 chore: add local CI script and format:check script
  • ac40424 fix: preserve trailing whitespace in ProcessingInstruction data (#962)
  • cece752 chore: add .nvmrc pointing to node version 18
  • cbf44d9 docs: improve links to changes in most recent release
  • c0f1401 0.8.11
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates xml-crypto from 2.1.6 to 6.1.2

Release notes

Sourced from xml-crypto's releases.

v6.1.2

  • Remove all reference XML data if any are corrupted (#502) (cac1c8d)

v6.1.1

  • Adjust deprecation to better reflect real-world usage (#499) (ab1c69e)

v6.1.0

  • Introduce new .getSignedReferences() function of signature to help prevent signature wrapping attacks (#489) (badaf20)

v6.0.1

  • Merge commit from fork (8ac6118)

This addresses two critical CVE:

v6.0.0

  • Bump github/codeql-action from 2 to 3 (#434) (627d83f)
  • Set getCertFromKeyInfo to noop (#445) (2120172)
  • Chore: Update README.md (#432) (f8cbbb7)

v5.1.1

  • fix: template literal (#443) (1ceedc8)

v5.1.0

  • Bump @​typescript-eslint/parser from 6.13.0 to 6.18.1 (#442) (ecbedd9)
  • Bump @​typescript-eslint/eslint-plugin from 6.13.0 to 6.18.1 (#441) (9eb9002)
  • Bump follow-redirects from 1.15.3 to 1.15.4 (#440) (6f363ab)
  • Bump eslint from 8.54.0 to 8.56.0 (#436) (bf163dd)
  • Bump @​types/node from 16.18.65 to 16.18.69 (#435) (4f98697)
  • Bump release-it from 16.2.1 to 16.3.0 (#428) (4d3711a)
  • Enhance derToPem to support XML pretty-print (#439) (6e95c60)

v5.0.0

  • Bump @​typescript-eslint/eslint-plugin from 5.62.0 to 6.13.0 (#422) (66d887b)
  • Bump @​prettier/plugin-xml from 3.2.1 to 3.2.2 (#423) (7410d2e)
  • Bump @​types/mocha from 10.0.2 to 10.0.6 (#421) (36bcf0e)
  • Bump @​types/chai from 4.3.6 to 4.3.11 (#419) (ef513da)
  • Bump prettier from 3.0.3 to 3.1.0 (#418) (09176a5)
  • Bump typescript from 5.2.2 to 5.3.2 (#415) (f3da589)
  • Bump eslint from 8.51.0 to 8.54.0 (#414) (b7c90f5)
  • Bump actions/setup-node from 3 to 4 (#413) (9602607)
  • Bump @​babel/traverse from 7.22.4 to 7.23.2 (#407) (552a6d6)
  • Bump actions/checkout from 3 to 4 (#392) (7ad9a5f)
  • Bump eslint-plugin-deprecation from 1.4.1 to 2.0.0 (#390) (0f11269)
  • Bump typescript from 5.1.6 to 5.2.2 (#383) (8cf4966)
  • Bump eslint-config-prettier from 8.8.0 to 9.0.0 (#381) (9584e48)
  • Mark getKeyInfo() private as it has no public consumers (#412) (1099f59)
  • Remove the default for getKeyInfoContent forcing a consumer to choose (#411) (468d674)

... (truncated)

Changelog

Sourced from xml-crypto's changelog.

6.1.2 (2025-04-24)

🐛 Bug Fixes

  • [bug] [security] Remove all reference XML data if any are corrupted #502

v6.1.1 (2025-04-21)

🚀 Minor Changes

  • [enhancement] Adjust deprecation to better reflect real-world usage #499

v6.1.0 (2025-04-09)

🚀 Minor Changes

  • [enhancement] Introduce new .getSignedReferences() function of signature to help prevent signature wrapping attacks #489

v6.0.1 (2025-03-14)

v6.0.0 (2024-01-26)

💣 Major Changes

  • [breaking-change] Set getCertFromKeyInfo to noop #445

🔗 Dependencies

  • [dependencies] [github_actions] Bump github/codeql-action from 2 to 3 #434

📚 Documentation

  • [documentation] Chore: Update README.md #432

v5.1.1 (2024-01-17)

🐛 Bug Fixes

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 1, 2026
@dependabot
Bump @xmldom/xmldom and xml-crypto in /ui
988db08 
Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) to 0.8.12 and updates ancestor dependency [xml-crypto](https://github.com/node-saml/xml-crypto). These dependencies need to be updated together.


Updates `@xmldom/xmldom` from 0.7.13 to 0.8.12
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.7.13...0.8.12)

Updates `xml-crypto` from 2.1.6 to 6.1.2
- [Release notes](https://github.com/node-saml/xml-crypto/releases)
- [Changelog](https://github.com/node-saml/xml-crypto/blob/v6.1.2/CHANGELOG.md)
- [Commits](node-saml/xml-crypto@v2.1.6...v6.1.2)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.12
  dependency-type: indirect
- dependency-name: xml-crypto
  dependency-version: 6.1.2
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/ui/multi-92d06108ae branch from 78c3d35 to 988db08 Compare April 11, 2026 00:40
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 23, 2026

Superseded by #3323.

@dependabot dependabot Bot closed this Apr 23, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/ui/multi-92d06108ae branch April 23, 2026 01:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants