fix(security): pin fast-xml-parser to 5.5.8 to unblock S3 release publish (#2096)

* fix(security): pin fast-xml-parser to 5.5.8 to unblock release

5.7.0/5.7.1 introduced a breaking EntityReplacer that rejects '#' in entity names, which breaks @aws-sdk/xml-builder's parser.addEntity('#xD', '\r') call path and fails every S3 response parse done by @electron-forge/publisher-s3.

Upstream tracking: NaturalIntelligence/fast-xml-parser#823 and aws/aws-sdk-js-v3#7949. No patched 5.7.x is available yet, so roll the override back to the last known-good 5.5.8 (the version @aws-sdk/xml-builder itself pins).

Revisit once upstream ships >=5.7.2 with addEntity('#xD', ...) support restored.

* chore(security): ignore GHSA-gh4j-gqv2-49f6 on pinned fast-xml-parser

Pair with the 5.5.8 pin. The advisory only affects XMLBuilder.buildComment / buildCdata when callers pass unescaped user input; this repo does not use those APIs — the AWS SDK only parses responses. Ignore both the GHSA and its CVE alias (CVE-2026-41650) with a reason string so future reviewers see the rollback rationale inline.

Author: samuv

.grype.yaml

@@ -23,3 +23,26 @@ exclude:
   - '**/test-videos/**'
   - '**/.vite/**'
   - '**/.cache/**'
+
+ignore:
+  # Scoped to version 5.5.8 so the ignore stops applying automatically as soon
+  # as the pin in pnpm.overrides is bumped to a non-regressing upstream release.
+  - vulnerability: GHSA-gh4j-gqv2-49f6
+    package:
+      name: fast-xml-parser
+      version: 5.5.8
+      type: npm
+    reason: >-
+      Pinned to 5.5.8 because 5.7.0/5.7.1 break @aws-sdk/xml-builder
+      (see https://github.com/NaturalIntelligence/fast-xml-parser/issues/823),
+      which in turn breaks @electron-forge/publisher-s3 during release.
+      The advisory only affects XMLBuilder.buildComment / buildCdata with
+      unescaped user input; this repo does not use those APIs. Revisit once
+      upstream ships a non-regressing patch (>=5.7.2).
+  - vulnerability: CVE-2026-41650
+    package:
+      name: fast-xml-parser
+      version: 5.5.8
+      type: npm
+    reason: >-
+      Same advisory as GHSA-gh4j-gqv2-49f6. See note above.

package.json

@@ -174,7 +174,7 @@
     "overrides": {
       "@hono/node-server": ">=1.19.13",
       "@xmldom/xmldom": ">=0.9.10",
-      "fast-xml-parser": ">=5.7.0",
+      "fast-xml-parser": "5.5.8",
       "dompurify": ">=3.4.0",
       "hono": ">=4.12.14",
       "lodash": ">=4.18.0",