chore(web): upgrade axios fast-xml-parser lodash-es to security version

[ZTongci]

Overview

Security Issues Resolved
axios: 1.12.0 → 1.15.2

• CVE-2025-58754 — DoS via unbounded data: URL decode. When Axios encountered a data: scheme URL, it decoded the entire Base64 payload into memory while ignoring maxContentLength/maxBodyLength limits, allowing a malicious endpoint to exhaust server memory and crash Node.js processes. Fixed in 1.12.0 (already patched), but this upgrade also pulls in:
  • follow-redirects bumped to 1.16.0
  • proxy-from-env bumped to 2.1.0
  • form-data bumped to 4.0.5

---

fast-xml-parser: 4.3.2 → 5 (5.8.0)

• CVE-2026-25896 (CVSS: High) — XSS via entity encoding bypass. A dot (.) in a DOCTYPE entity name was treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (<, >, &, ", ') with arbitrary values. Affected versions 4.1.3 – 5.3.4; fixed in 5.3.5+.
• CVE-2026-26278 — DoS via unlimited entity expansion. Maliciously crafted XML with deeply nested/recursive entity references could freeze the application with minimal input. Affected versions 4.1.3 – 5.3.5; fixed in 5.3.6+.

Note: The major version bump (4 → 5) required updating the X2jOptionsOptional import to Partial in georss.ts and
gml.ts to match the new API.

---

lodash-es: 4.17.21 → 4.18.1

• CVE-2025-13465 — Prototype pollution via _.unset / _.omit. Crafted paths could cause Lodash to delete methods from global prototypes. Fixed in 4.17.23+.
• CVE-2026-2950 — Follow-on prototype pollution in _.unset / _.omit affecting 4.17.23 and earlier. Fixed in 4.18.0+.

What I've done

upgrade axios fast-xml-parser lodash-es to security version

What I haven't done

How I tested

Which point I want you to review particularly

Memo

[Copilot]

Pull request overview

This PR upgrades frontend (web/) dependencies to address security-related updates, notably bumping axios, fast-xml-parser (major version), and lodash-es, along with corresponding lockfile updates.

Changes:

• Bump axios to 1.15.2 and refresh transitive deps in yarn.lock.
• Upgrade fast-xml-parser from 4.3.2 to 5.x and update TypeScript usage accordingly.
• Bump lodash-es to 4.18.1 and update lockfile entries.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
web/yarn.lock	Updates resolved dependency graph for axios/fast-xml-parser/lodash-es and new transitives.
web/src/classic/core/mantle/data/gml.ts	Updates fast-xml-parser type usage for v5.
web/src/classic/core/mantle/data/georss.ts	Updates fast-xml-parser type usage for v5.
web/package.json	Pins upgraded dependency versions for axios/fast-xml-parser/lodash-es.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.