kestrelos

keligrubb/kestrelos

Fork 0

...

Author	SHA1	Message	Date
Renovate Bot	2fb6e51f24	chore(deps): update all non-major dependencies PR / lint (pull_request) Failing after 18s Details PR / e2e (pull_request) Failing after 19s Details PR / test (pull_request) Failing after 19s Details PR / docker-build (pull_request) Failing after 29s Details	2026-08-13 17:14:47 +00:00
Renovate Bot	5aa3bd8977	chore(deps): update dependency fast-xml-parser to v5.10.1 [security] (#42 ) Push / release (push) Successful in 12s Details Push / publish (push) Successful in 46s Details This PR contains the following updates: \| Package \| Change \| [Age](https://docs.renovatebot.com/merge-confidence/) \| [Confidence](https://docs.renovatebot.com/merge-confidence/) \| \|---\|---\|---\|---\| \| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) \| [`5.9.3` → `5.10.1`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.9.3/5.10.1) \| ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.10.1?slim=true) \| ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.9.3/5.10.1?slim=true) \| --- ### fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits [GHSA-8r6m-32jq-jx6q](https://github.com/advisories/GHSA-8r6m-32jq-jx6q) <details> <summary>More information</summary> #### Details ##### Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`. `addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation. This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. ##### Workarounds - Manually check if multiple DOCTYPEs are not present in input contents - Update to v5.10.1 - Keep `processEntity` flag off #### Severity - CVSS Score: 8.7 / 10 (High) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N` #### References - [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q) - [https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f](https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f) - [https://github.com/NaturalIntelligence/fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) - [https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8r6m-32jq-jx6q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary> ### [`v5.10.1`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1) [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1) Full Changelog: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1> ### [`v5.10.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.0) [Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0) #### What's Changed - Bump actions/checkout from 6.0.3 to 7.0.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#849](https://github.com/NaturalIntelligence/fast-xml-parser/pull/849) - Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#848](https://github.com/NaturalIntelligence/fast-xml-parser/pull/848) Full Changelog: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0> </details> --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yOC4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjguMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwic2VjdXJpdHkiXX0=--> Reviewed-on: #42 Co-authored-by: Renovate Bot <renovate@keligrubb.com>	2026-08-13 17:14:36 +00:00

Author

SHA1

Message

Date

Renovate Bot

2fb6e51f24

chore(deps): update all non-major dependencies

PR / lint (pull_request) Failing after 18s

Details

PR / e2e (pull_request) Failing after 19s

Details

PR / test (pull_request) Failing after 19s

Details

PR / docker-build (pull_request) Failing after 29s

Details

2026-08-13 17:14:47 +00:00

Renovate Bot

5aa3bd8977

chore(deps): update dependency fast-xml-parser to v5.10.1 [security] (#42 )

Push / release (push) Successful in 12s

Details

Push / publish (push) Successful in 46s

Details

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | [`5.9.3` → `5.10.1`](https://renovatebot.com/diffs/npm/fast-xml-parser/5.9.3/5.10.1) | ![age](https://developer.mend.io/api/mc/badges/age/npm/fast-xml-parser/5.10.1?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/fast-xml-parser/5.9.3/5.10.1?slim=true) |

---

### fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
[GHSA-8r6m-32jq-jx6q](https://github.com/advisories/GHSA-8r6m-32jq-jx6q)

<details>
<summary>More information</summary>

#### Details
##### Impact
`fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration passes its entities to `@nodable/entities` through `addInputEntities()`.

`addInputEntities()` resets the entity expansion counters every time it is called. An attacker can therefore insert additional DOCTYPE declarations to repeatedly reset maxTotalExpansions and maxExpandedLength during one parse operation.

This allows a crafted XML document to exceed the configured entity-expansion limits and can cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination.

##### Workarounds
- Manually check if multiple DOCTYPEs are not present in input contents
- Update to v5.10.1
- Keep `processEntity` flag off

#### Severity
- CVSS Score: 8.7 / 10 (High)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N`

#### References
- [https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q](https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q)
- [https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f](https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f)
- [https://github.com/NaturalIntelligence/fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser)
- [https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-8r6m-32jq-jx6q) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>NaturalIntelligence/fast-xml-parser (fast-xml-parser)</summary>

### [`v5.10.1`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.1)

[Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1)

**Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.10.0...v5.10.1>

### [`v5.10.0`](https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.10.0)

[Compare Source](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0)

#### What's Changed

- Bump actions/checkout from 6.0.3 to 7.0.0 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;849](https://github.com/NaturalIntelligence/fast-xml-parser/pull/849)
- Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by [@&#8203;dependabot](https://github.com/dependabot)\[bot] in [#&#8203;848](https://github.com/NaturalIntelligence/fast-xml-parser/pull/848)

**Full Changelog**: <https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.0>

</details>

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yOC4wIiwidXBkYXRlZEluVmVyIjoiNDQuMjguMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiZGVwZW5kZW5jaWVzIiwic2VjdXJpdHkiXX0=-->

Reviewed-on: #42
Co-authored-by: Renovate Bot <renovate@keligrubb.com>

2026-08-13 17:14:36 +00:00

1 changed files with 1053 additions and 1074 deletions

package-lock.json

Generated

+1053 -1074

View File

File diff suppressed because it is too large Load Diff

Compare commits