From 88e520aa59d32c46d55db37b93ed12573594a6c1 Mon Sep 17 00:00:00 2001 From: CI Date: Thu, 13 Aug 2026 17:14:52 +0000 Subject: [PATCH] release v1.1.9 [skip ci] --- CHANGELOG.md | 75 ++++++++++++++++++++++++++++++++++++++ helm/kestrelos/Chart.yaml | 4 +- helm/kestrelos/values.yaml | 2 +- package.json | 2 +- 4 files changed, 79 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7280b0e..25f1529 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,78 @@ +## [1.1.9] - 2026-08-13 +### Changed +- update dependency fast-xml-parser to v5.10.1 [security] (#42) + +This PR contains the following updates: + +| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | +|---|---|---|---| +| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.9.3` → `5.10.1`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.9.3/5.10.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.10.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.9.3/5.10.1?slim=true) | + +--- + +### fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits +[GHSA-8r6m-32jq-jx6q](https://github.com/advisories/GHSA-8r6m-32jq-jx6q) + +
+More information + +#### Details +##### Impact +`fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`. + +`addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation. + +This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. + +##### Workarounds +- Manually check if multiple DOCTYPEs are not present in input contents +- Update to v5.10.1 +- Keep `processEntity` flag off + +#### Severity +- CVSS Score: 8.7 / 10 (High) +- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` + +#### References +- [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q) +- [https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f](https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f) +- [https://github.com/NaturalIntelligence/fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) +- [https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) + +This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8r6m-32jq-jx6q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). +
+ +--- + +### Release Notes + +
+NaturalIntelligence/fast-xml-parser (fast-xml-parser) + +### [`v5.10.1`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) + +[Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1) + +**Full Changelog**: + +### [`v5.10.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.0) + +[Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0) + +#### What's Changed + +- Bump actions/checkout from 6.0.3 to 7.0.0 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​849](https://github.com/NaturalIntelligence/fast-xml-parser/pull/849) +- Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by [@​dependabot](https://github.com/dependabot)\[bot] in [#​848](https://github.com/NaturalIntelligence/fast-xml-parser/pull/848) + +**Full Changelog**: + +
+ +--- + + - [ ] If you want to rebase/retry this PR, check this box + + ## [1.1.8] - 2026-08-13 ### Changed - update https://git.keligrubb.com/actions/setup-node action to v7 (#38) diff --git a/helm/kestrelos/Chart.yaml b/helm/kestrelos/Chart.yaml index 2749862..a840f5d 100644 --- a/helm/kestrelos/Chart.yaml +++ b/helm/kestrelos/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: kestrelos description: KestrelOS TOC for OSINT feeds - map, camera feeds, offline tiles type: application -version: 1.1.8 -appVersion: "1.1.8" +version: 1.1.9 +appVersion: "1.1.9" diff --git a/helm/kestrelos/values.yaml b/helm/kestrelos/values.yaml index c2a2121..d8ca6ec 100644 --- a/helm/kestrelos/values.yaml +++ b/helm/kestrelos/values.yaml @@ -2,7 +2,7 @@ replicaCount: 1 image: repository: git.keligrubb.com/keligrubb/kestrelos - tag: 1.1.8 + tag: 1.1.9 pullPolicy: IfNotPresent service: diff --git a/package.json b/package.json index 76519ca..731e253 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "kestrelos", - "version": "1.1.8", + "version": "1.1.9", "private": true, "type": "module", "scripts": {