chore(deps): bump stale fast-xml-parser resolution to 4.5.7 (GHSA-m7jm-9gc2-mpf2)

[AtsutoNakayama]

Issue # (if applicable)

Closes #38415.

Reason for this change

packages/@aws-cdk/custom-resource-handlers depends on @aws-sdk/client-lambda@3.632.0 (pinned since August 2024), which transitively pins fast-xml-parser to the exact version 4.4.1, vulnerable to GHSA-m7jm-9gc2-mpf2 (fixed in 4.5.4).

Note: as clarified in #38415, this does not reach deployed Lambda assets - packages/@aws-cdk/custom-resource-handlers/scripts/generate.js marks @aws-sdk/* as external in the esbuild config, so the AWS SDK (and therefore fast-xml-parser) is never bundled into the shipped handler code; at runtime these handlers use whatever AWS SDK the Lambda Node.js runtime provides, patched independently by AWS. This is purely a stale, noisy yarn.lock resolution that causes a clean yarn audit on this repo to report a critical finding, and a two-year-old dependency pin - worth fixing on hygiene grounds, not because deployed user resources are affected.

Description of changes

Added a resolutions entry in the root package.json to force fast-xml-parser to ^4.5.4 across the whole dependency tree (the existing dependent declares an exact pin 4.4.1 with no caret, so a plain yarn.lock version bump is not sufficient here — resolutions is required to override it). Ran yarn install to regenerate yarn.lock; the two previously separate fast-xml-parser@4.4.1 / fast-xml-parser@^4.5.4 lockfile entries were merged into a single resolved entry at 4.5.7.

Describe any new or updated permissions being added

None.

Description of how you validated changes

• find . -path "*/node_modules/fast-xml-parser/package.json" confirms only one copy is installed, at 4.5.7.
• npx lerna run build --scope=@aws-cdk/custom-resource-handlers --stream builds successfully.
• npx jest triggers aws-synthetics (in packages/@aws-cdk/custom-resource-handlers) — the existing unit tests for both affected handlers pass (24/24).
• Note: yarn audit (Yarn Classic v1) does not evaluate resolutions overrides when reporting, so it will keep listing this advisory for the fast-xml-parser@4.4.1 dependent even after the fix; the resolved/installed version in yarn.lock and node_modules is what actually matters, and that is confirmed patched.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[aws-cdk-automation]

(This review is outdated)

[AtsutoNakayama]

Exemption Request

This PR doesn't add a unit test or an integration test because it doesn't change any CDK feature or behavior - it's a yarn.lock/resolutions change that bumps a transitive dependency version to a patched release. No test can meaningfully exercise a lockfile version bump. Existing unit tests for the two affected handlers (triggers/lambda, aws-synthetics/auto-delete-underlying-resources-handler) were run and pass (24/24) to confirm no regression.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.