AI-1392 Security and Vulnerability Round Up - June 2026

[dbarkowsky]

Summary

AI-1392

Changes

• Upgraded vitest from 4.0.18 to 4.1.8 and jsdom from 26.1.0 to 29.1.1 in the frontend app; hoisted jsdom to the root package.json to satisfy vitest 4.1.x's requirement that environment packages be resolvable from the same location as vitest itself in an npm workspace.
• Replaced fast-xml-parser's bundled XMLValidator and XMLBuilder with dedicated fast-xml-validator and fast-xml-builder packages in the temporal app, adapting call sites to handle the new APIs: SyntaxValidator.validate() now throws on invalid XML instead of returning an error object, and Builder is now a default export.
• Fixed a bug in executeTransformNode where render failures (XmlRenderError, CSV errors) in Step 4 were not caught and re-thrown as non-retryable ApplicationFailure, causing Temporal to treat them as retryable errors rather than halting the workflow.
• Fixed a bug where the system-injected groupId parameter (used for tenant scoping) was not in KNOWN_PARAM_KEYS, causing it to be passed to parseInput() as a port-binding input — producing an InputParseError ("char 'c' is not expected") for any workflow node using XML input format.
• Fixed a flaky timeout in graph-workflow.test.ts by adding a 15-second timeout to the first test that invokes Worker.create(), which triggers initial webpack bundling of the workflow code.
• Fixed a crash in DatasetService.uploadFiles where files.length was accessed before the Array.isArray(files) guard, causing an unhandled error when a non-array payload was received.
• Updated axios to 1.17.0, concurrently to 10.0.3, fast-xml-parser to 5.8.0, and protobufjs to 7.5.6; added fast-uri 3.1.1 as a root override.

Testing

• Run npm i from root.
• Run tests for each service.
• Test out a workflow or two.

One thing I noticed with this is that workflows without the OCR activities never progress the documents to "Complete" status. We might need something that guarantees workflows end with "terminal" activities that will set the status to either Complete or Failed when done.

Checklist

By submitting this pull request, I acknowledge that I have attempted to meet the following:

• a self-review of my code
• commented code particularly in hard-to-understand areas
• corresponding changes to the documentation where required
• changes tested to the best of my ability
• no new errors or non-functional code

[kmandryk]

npm audit shows several high risk vulnerabilities as well - should we add those upgrades in this PR?

[kmandryk]

we can put the vite upgrades in another ticket.