Skip to content

Commit 23f789e

Browse files
committed
fix(security): resolve fast-xml-parser DoS vulnerability (CVE-2026-26278) (#326)
Add pnpm override to force fast-xml-parser >=5.3.6, fixing Dependabot alert #114 (GHSA-jmr7-xgp7-cmfj, CVSS 7.5). Resolves two vulnerable transitive instances: 4.5.3 via @loaders.gl/xml and 5.3.4 via @aws-sdk/xml-builder.
1 parent 100306c commit 23f789e

2 files changed

Lines changed: 16 additions & 23 deletions

File tree

client/package.json

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,9 @@
178178
"sharp",
179179
"unrs-resolver",
180180
"es5-ext"
181-
]
181+
],
182+
"overrides": {
183+
"fast-xml-parser": ">=5.3.6"
184+
}
182185
}
183186
}

client/pnpm-lock.yaml

Lines changed: 12 additions & 22 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)