Commit 56908a7
Fix CVE-2026-25896: Upgrade deep transitive dependency fast-xml-parser from 4.5.0 to 4.5.4 (#56163)
Summary:
Pull Request resolved: #56163
Fix CVE-2026-25896: Upgrade deep transitive dependency fast-xml-parser from 4.5.0 to 4.5.4
## Summary
Upgrading the deep transitive dependency `fast-xml-parser` from 4.5.0 to 4.5.4 in `xplat/js/react-native-github` to fix:
- CVE-2026-25896 (Incorrect Regular Expression)
Dependency chain (3 levels deep):
react-native/tester -> react-native-community/cli-platform-android -> react-native-community/cli-config-android -> fast-xml-parser@^4.4.1
The semver range `^4.4.1` naturally allows 4.5.4, so the version was nudged via temporary resolution and sticks after removal. No permanent resolution needed.
Changelog:
[General][Security] - Bumped fast-xml-parser from 4.5.0 to 4.5.4 to fix CVE-2026-25896
Reviewed By: huntie
Differential Revision: D96997931
fbshipit-source-id: 2ba65763bfb1254c581556559142bfac5450c89d1 parent 65aee6c commit 56908a7
1 file changed
Lines changed: 3 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4588 | 4588 | | |
4589 | 4589 | | |
4590 | 4590 | | |
4591 | | - | |
4592 | | - | |
4593 | | - | |
| 4591 | + | |
| 4592 | + | |
| 4593 | + | |
4594 | 4594 | | |
4595 | 4595 | | |
4596 | 4596 | | |
| |||
0 commit comments