From e43afb5eda2f5f9e88927c9bc6796d6336df89a0 Mon Sep 17 00:00:00 2001 From: tongcizhang Date: Tue, 9 Jun 2026 15:34:48 +0900 Subject: [PATCH 1/5] chore(web): upgrade axios fast-xml-parser lodash-es to security version --- web/package.json | 6 +- web/src/classic/core/mantle/data/georss.ts | 4 +- web/src/classic/core/mantle/data/gml.ts | 4 +- web/yarn.lock | 99 ++++++++++++++++++---- 4 files changed, 90 insertions(+), 23 deletions(-) diff --git a/web/package.json b/web/package.json index d4f9fb8c0..ddd169e1c 100644 --- a/web/package.json +++ b/web/package.json @@ -140,7 +140,7 @@ "apollo-upload-client": "17.0.0", "array-move": "4.0.0", "aws-amplify": "6.15.8", - "axios": "1.12.0", + "axios": "1.15.2", "cesium": "1.116.0", "cesium-dnd": "1.1.0", "cesium-mvt-imagery-provider": "1.4.0", @@ -152,7 +152,7 @@ "dayjs": "1.11.10", "detect-browser": "5.3.0", "escape-string-regexp": "5.0.0", - "fast-xml-parser": "4.3.2", + "fast-xml-parser": "5", "formik": "2.4.5", "framer-motion": "10.18.0", "github-markdown-css": "5.4.0", @@ -170,7 +170,7 @@ "leaflet": "1.9.4", "lexical": "0.12.2", "localforage": "1.10.0", - "lodash-es": "4.17.21", + "lodash-es": "4.18.1", "lru-cache": "8.0.4", "mini-svg-data-uri": "1.4.4", "moment-timezone": "0.5.43", diff --git a/web/src/classic/core/mantle/data/georss.ts b/web/src/classic/core/mantle/data/georss.ts index 131ecd63c..a4c107684 100644 --- a/web/src/classic/core/mantle/data/georss.ts +++ b/web/src/classic/core/mantle/data/georss.ts @@ -1,4 +1,4 @@ -import { XMLParser, X2jOptionsOptional } from "fast-xml-parser"; +import { XMLParser, X2jOptions } from "fast-xml-parser"; import type { Data, DataRange, Feature, Geometry } from "../types"; @@ -28,7 +28,7 @@ function handler(xmlDataStr: string) { } function parseBuffer(xmlDataStr: string) { - const options: X2jOptionsOptional = { + const options: Partial = { ignoreAttributes: false, attributeNamePrefix: "", }; diff --git a/web/src/classic/core/mantle/data/gml.ts b/web/src/classic/core/mantle/data/gml.ts index aa9569281..3f017e111 100644 --- a/web/src/classic/core/mantle/data/gml.ts +++ b/web/src/classic/core/mantle/data/gml.ts @@ -1,4 +1,4 @@ -import { XMLParser, X2jOptionsOptional } from "fast-xml-parser"; +import { XMLParser, X2jOptions } from "fast-xml-parser"; import type { Data, DataRange, Feature, Geometry } from "../types"; @@ -21,7 +21,7 @@ function handler(xmlDataStr: string) { } function parseBuffer(xmlDataStr: string) { - const options: X2jOptionsOptional = { + const options: Partial = { ignoreAttributes: false, attributeNamePrefix: "", }; diff --git a/web/yarn.lock b/web/yarn.lock index dd3f8aff0..dbf4162ad 100644 --- a/web/yarn.lock +++ b/web/yarn.lock @@ -4999,6 +4999,13 @@ __metadata: languageName: node linkType: hard +"@nodable/entities@npm:^2.1.0": + version: 2.1.1 + resolution: "@nodable/entities@npm:2.1.1" + checksum: 10c0/d295c148a3a4a30dbcbb453d464ff93b28301d72c8f6f3a2f138f8a2bc1ad9f8c5210a70d857e7133f44468c3d8e90d3026e1aecee5a632d6c3f74898c14e5b9 + languageName: node + linkType: hard + "@nodelib/fs.scandir@npm:2.1.5": version: 2.1.5 resolution: "@nodelib/fs.scandir@npm:2.1.5" @@ -6588,7 +6595,7 @@ __metadata: apollo-upload-client: "npm:17.0.0" array-move: "npm:4.0.0" aws-amplify: "npm:6.15.8" - axios: "npm:1.12.0" + axios: "npm:1.15.2" cesium: "npm:1.116.0" cesium-dnd: "npm:1.1.0" cesium-mvt-imagery-provider: "npm:1.4.0" @@ -6606,7 +6613,7 @@ __metadata: eslint-config-reearth: "npm:0.2.2" eslint-plugin-playwright: "npm:0.12.0" eslint-plugin-storybook: "npm:0.6.15" - fast-xml-parser: "npm:4.3.2" + fast-xml-parser: "npm:5" formik: "npm:2.4.5" framer-motion: "npm:10.18.0" github-markdown-css: "npm:5.4.0" @@ -6628,7 +6635,7 @@ __metadata: lexical: "npm:0.12.2" lint-staged: "npm:13.2.2" localforage: "npm:1.10.0" - lodash-es: "npm:4.17.21" + lodash-es: "npm:4.18.1" lru-cache: "npm:8.0.4" mini-svg-data-uri: "npm:1.4.4" moment-timezone: "npm:0.5.43" @@ -12739,14 +12746,14 @@ __metadata: languageName: node linkType: hard -"axios@npm:1.12.0": - version: 1.12.0 - resolution: "axios@npm:1.12.0" +"axios@npm:1.15.2": + version: 1.15.2 + resolution: "axios@npm:1.15.2" dependencies: - follow-redirects: "npm:^1.15.6" - form-data: "npm:^4.0.4" - proxy-from-env: "npm:^1.1.0" - checksum: 10c0/44a1e4cfb69a2d59aa12bbc441a336e5c18e87c02b904c509fd33607d94e8cb8cc221c17e9d53f67841a4efe13abf1aa1497c85df390cdb8681ee723998d11b0 + follow-redirects: "npm:^1.15.11" + form-data: "npm:^4.0.5" + proxy-from-env: "npm:^2.1.0" + checksum: 10c0/4eeae0feeaa7fdc1ef24f81f8b378fdadedf4aebdd6bf224484675160f8744cf17b9b0d1c215279979940f7e8ce463beffa2f713099612e428eac238515c81d5 languageName: node linkType: hard @@ -16449,6 +16456,16 @@ __metadata: languageName: node linkType: hard +"fast-xml-builder@npm:^1.2.0": + version: 1.2.0 + resolution: "fast-xml-builder@npm:1.2.0" + dependencies: + path-expression-matcher: "npm:^1.5.0" + xml-naming: "npm:^0.1.0" + checksum: 10c0/84bb105cd04e91d6dcb746c4dbaeb12903b510e7ab9a06ffde55b5a582e005559a87d84467f18a655c6c4baf098f696fd74cee3cbe1aea9d01385907768ba32d + languageName: node + linkType: hard + "fast-xml-parser@npm:4.3.2": version: 4.3.2 resolution: "fast-xml-parser@npm:4.3.2" @@ -16471,6 +16488,21 @@ __metadata: languageName: node linkType: hard +"fast-xml-parser@npm:5": + version: 5.8.0 + resolution: "fast-xml-parser@npm:5.8.0" + dependencies: + "@nodable/entities": "npm:^2.1.0" + fast-xml-builder: "npm:^1.2.0" + path-expression-matcher: "npm:^1.5.0" + strnum: "npm:^2.3.0" + xml-naming: "npm:^0.1.0" + bin: + fxparser: src/cli/cli.js + checksum: 10c0/cd0828b7daf3f683c64d0d6a0c719f1476d4f02f1089cf345a9bc0b886e7d5fa18c11da025d480ea67a41765be63135cbd952051942c9d0b422a5d4dde11814e + languageName: node + linkType: hard + "fast-xml-parser@npm:^4.4.1": version: 4.5.3 resolution: "fast-xml-parser@npm:4.5.3" @@ -16734,13 +16766,13 @@ __metadata: languageName: node linkType: hard -"follow-redirects@npm:^1.15.6": - version: 1.15.11 - resolution: "follow-redirects@npm:1.15.11" +"follow-redirects@npm:^1.15.11": + version: 1.16.0 + resolution: "follow-redirects@npm:1.16.0" peerDependenciesMeta: debug: optional: true - checksum: 10c0/d301f430542520a54058d4aeeb453233c564aaccac835d29d15e050beb33f339ad67d9bddbce01739c5dc46a6716dbe3d9d0d5134b1ca203effa11a7ef092343 + checksum: 10c0/a1e2900163e6f1b4d1ed5c221b607f41decbab65534c63fe7e287e40a5d552a6496e7d9d7d976fa4ba77b4c51c11e5e9f683f10b43011ea11e442ff128d0e181 languageName: node linkType: hard @@ -16763,7 +16795,7 @@ __metadata: languageName: node linkType: hard -"form-data@npm:^4.0.0, form-data@npm:^4.0.4": +"form-data@npm:^4.0.0, form-data@npm:^4.0.4, form-data@npm:^4.0.5": version: 4.0.5 resolution: "form-data@npm:4.0.5" dependencies: @@ -19375,6 +19407,13 @@ __metadata: languageName: node linkType: hard +"lodash-es@npm:4.18.1": + version: 4.18.1 + resolution: "lodash-es@npm:4.18.1" + checksum: 10c0/35d4dcf87ef07f8d090f409447575800108057e360b445f590d0d25d09e3d1e33a163d2fc100d4d072b0f901d5e2fc533cd7c4bfd8eeb38a06abec693823c8b8 + languageName: node + linkType: hard + "lodash.debounce@npm:^4.0.8": version: 4.0.8 resolution: "lodash.debounce@npm:4.0.8" @@ -21442,6 +21481,13 @@ __metadata: languageName: node linkType: hard +"path-expression-matcher@npm:^1.5.0": + version: 1.5.0 + resolution: "path-expression-matcher@npm:1.5.0" + checksum: 10c0/646cb5bc66cd7d809a52288336f3ac1e6223f156fd8e912936e490e590f7f93e8056d4fd25fcbcc7da61bb698fa520112cb050372a3f65e7b79bd4afa0f77610 + languageName: node + linkType: hard + "path-key@npm:^2.0.1": version: 2.0.1 resolution: "path-key@npm:2.0.1" @@ -22046,13 +22092,20 @@ __metadata: languageName: node linkType: hard -"proxy-from-env@npm:^1.0.0, proxy-from-env@npm:^1.1.0": +"proxy-from-env@npm:^1.0.0": version: 1.1.0 resolution: "proxy-from-env@npm:1.1.0" checksum: 10c0/fe7dd8b1bdbbbea18d1459107729c3e4a2243ca870d26d34c2c1bcd3e4425b7bcc5112362df2d93cc7fb9746f6142b5e272fd1cc5c86ddf8580175186f6ad42b languageName: node linkType: hard +"proxy-from-env@npm:^2.1.0": + version: 2.1.0 + resolution: "proxy-from-env@npm:2.1.0" + checksum: 10c0/ed01729fd4d094eab619cd7e17ce3698b3413b31eb102c4904f9875e677cd207392795d5b4adee9cec359dfd31c44d5ad7595a3a3ad51c40250e141512281c58 + languageName: node + linkType: hard + "psl@npm:^1.1.33": version: 1.15.0 resolution: "psl@npm:1.15.0" @@ -24793,6 +24846,13 @@ __metadata: languageName: node linkType: hard +"strnum@npm:^2.3.0": + version: 2.3.0 + resolution: "strnum@npm:2.3.0" + checksum: 10c0/8d29ea0789df22dfa6101153573c76ce12fb065ed0807eb99cc64624cd7f3d67a5aa0db507e75ab985ca23908cc4f02c65f3359ad762cb3659e3d6456e76e143 + languageName: node + linkType: hard + "style-loader@npm:^3.3.2": version: 3.3.4 resolution: "style-loader@npm:3.3.4" @@ -26970,6 +27030,13 @@ __metadata: languageName: node linkType: hard +"xml-naming@npm:^0.1.0": + version: 0.1.0 + resolution: "xml-naming@npm:0.1.0" + checksum: 10c0/8c7614865361bcb7e53e3e091dac21c567e2b92d447919b2f072775aa9dcfc94a5255bd52fbaa0fd53c93513e53a23a6a835218ad2af512451dbc678392f85fe + languageName: node + linkType: hard + "xmlchars@npm:^2.2.0": version: 2.2.0 resolution: "xmlchars@npm:2.2.0" From 5489d627d5ca6d84c3cd2a37e6ca0f9dc5989339 Mon Sep 17 00:00:00 2001 From: "Tongci.Z" <116621270+ZTongci@users.noreply.github.com> Date: Thu, 11 Jun 2026 12:51:45 +0900 Subject: [PATCH 2/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- web/src/classic/core/mantle/data/gml.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/src/classic/core/mantle/data/gml.ts b/web/src/classic/core/mantle/data/gml.ts index 3f017e111..ec425f23e 100644 --- a/web/src/classic/core/mantle/data/gml.ts +++ b/web/src/classic/core/mantle/data/gml.ts @@ -1,4 +1,4 @@ -import { XMLParser, X2jOptions } from "fast-xml-parser"; +import { XMLParser, type X2jOptions } from "fast-xml-parser"; import type { Data, DataRange, Feature, Geometry } from "../types"; From 6990d37f6e74d048fef3dd8ccf787dda4ceb8b19 Mon Sep 17 00:00:00 2001 From: "Tongci.Z" <116621270+ZTongci@users.noreply.github.com> Date: Thu, 11 Jun 2026 12:51:52 +0900 Subject: [PATCH 3/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- web/src/classic/core/mantle/data/georss.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/src/classic/core/mantle/data/georss.ts b/web/src/classic/core/mantle/data/georss.ts index a4c107684..c4dd8c357 100644 --- a/web/src/classic/core/mantle/data/georss.ts +++ b/web/src/classic/core/mantle/data/georss.ts @@ -1,4 +1,4 @@ -import { XMLParser, X2jOptions } from "fast-xml-parser"; +import { XMLParser, type X2jOptions } from "fast-xml-parser"; import type { Data, DataRange, Feature, Geometry } from "../types"; From eba0e4f93b9e4153306513dc5f8926eb818fea5d Mon Sep 17 00:00:00 2001 From: "Tongci.Z" <116621270+ZTongci@users.noreply.github.com> Date: Tue, 23 Jun 2026 11:49:15 +0900 Subject: [PATCH 4/5] Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --- web/package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/web/package.json b/web/package.json index 79a34fb29..fe75abda6 100644 --- a/web/package.json +++ b/web/package.json @@ -153,7 +153,7 @@ "dayjs": "1.11.10", "detect-browser": "5.3.0", "escape-string-regexp": "5.0.0", - "fast-xml-parser": "5", + "fast-xml-parser": "5.8.0", "formik": "2.4.5", "framer-motion": "10.18.0", "github-markdown-css": "5.4.0", From 6bfc147c490484e03de0b0211ed516df37d5acd5 Mon Sep 17 00:00:00 2001 From: tongcizhang Date: Tue, 23 Jun 2026 11:49:59 +0900 Subject: [PATCH 5/5] chore: update yarn lock --- web/yarn.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/web/yarn.lock b/web/yarn.lock index d1ad08842..400adc773 100644 --- a/web/yarn.lock +++ b/web/yarn.lock @@ -6613,7 +6613,7 @@ __metadata: eslint-config-reearth: "npm:0.2.2" eslint-plugin-playwright: "npm:0.12.0" eslint-plugin-storybook: "npm:0.6.15" - fast-xml-parser: "npm:5" + fast-xml-parser: "npm:5.8.0" formik: "npm:2.4.5" framer-motion: "npm:10.18.0" github-markdown-css: "npm:5.4.0" @@ -16488,7 +16488,7 @@ __metadata: languageName: node linkType: hard -"fast-xml-parser@npm:5": +"fast-xml-parser@npm:5.8.0": version: 5.8.0 resolution: "fast-xml-parser@npm:5.8.0" dependencies: