Update dependency fast-xml-parser to v5.10.1 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
fast-xml-parser	5.9.3 → 5.10.1

---

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

GHSA-8r6m-32jq-jx6q

More information

Details

Impact

fast-xml-parser processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to @nodable/entities through addInputEntities().

addInputEntities() resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

Workarounds

• Manually check if multiple DOCTYPEs are not present in input contents
• Update to v5.10.1
• Keep processEntity flag off

Severity

• CVSS Score: 8.7 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q
• https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
• https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1
• https://github.com/advisories/GHSA-8r6m-32jq-jx6q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

NaturalIntelligence/fast-xml-parser (fast-xml-parser)

v5.10.1

Compare Source

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

Compare Source

What's Changed

• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​849
• Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in #​848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.