From 9df0569c5e8027ba6e5f6d848d2601610be4e48a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 23 Apr 2026 10:01:35 -0700
Subject: [PATCH] Bump @xmldom/xmldom from 0.8.12 to 0.8.13 in the npm_and_yarn
 group across 1 directory (#3742)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the npm_and_yarn group with 1 update in the / directory:
[@xmldom/xmldom](https://github.com/xmldom/xmldom).

Updates `@xmldom/xmldom` from 0.8.12 to 0.8.13
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/xmldom/xmldom/releases"><code>@​xmldom/xmldom</code>'s
releases</a>.</em></p>
<blockquote>
<h2>0.8.13</h2>
<p><a
href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">Commits</a></p>
<h3>Fixed</h3>
<ul>
<li>Security: <code>XMLSerializer.serializeToString()</code> (and
<code>Node.toString()</code>, <code>NodeList.toString()</code>) now
accept a <code>requireWellFormed</code> option (fourth argument, after
<code>isHtml</code> and <code>nodeFilter</code>). When <code>{
requireWellFormed: true }</code> is passed, the serializer throws
<code>InvalidStateError</code> for injection-prone node content,
preventing XML injection via attacker-controlled node data. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8"><code>GHSA-j759-j44w-7fr8</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx"><code>GHSA-x6wf-f3px-wcqx</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h"><code>GHSA-f6ww-3ggp-fr8h</code></a>
<ul>
<li>Comment: throws when <code>data</code> contains
<code>--&gt;</code></li>
<li>ProcessingInstruction: throws when <code>data</code> contains
<code>?&gt;</code></li>
<li>DocumentType: throws when <code>publicId</code> fails
<code>PubidLiteral</code>, <code>systemId</code> fails
<code>SystemLiteral</code>, or <code>internalSubset</code> contains
<code>]&gt;</code></li>
</ul>
</li>
<li>Security: DOM traversal operations
(<code>XMLSerializer.serializeToString()</code>,
<code>Node.prototype.normalize()</code>,
<code>Node.prototype.cloneNode(true)</code>,
<code>Document.prototype.importNode(node, true)</code>,
<code>node.textContent</code> getter,
<code>getElementsByTagName()</code> /
<code>getElementsByTagNameNS()</code> /
<code>getElementsByClassName()</code> / <code>getElementById()</code>)
are now iterative. Previously, deeply nested DOM trees would exhaust the
JavaScript call stack and throw an unrecoverable
<code>RangeError</code>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw"><code>GHSA-2v35-w6hq-6mfw</code></a></li>
</ul>
<p>Thank you,
<a href="https://github.com/Jvr2022"><code>@​Jvr2022</code></a>,
<a href="https://github.com/praveen-kv"><code>@​praveen-kv</code></a>,
<a href="https://github.com/TharVid"><code>@​TharVid</code></a>,
<a href="https://github.com/decsecre583"><code>@​decsecre583</code></a>,
<a href="https://github.com/tlsbollei"><code>@​tlsbollei</code></a>,
<a
href="https://github.com/KarimTantawey"><code>@​KarimTantawey</code></a>,
for your contributions</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md"><code>@​xmldom/xmldom</code>'s
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">0.8.13</a></h2>
<h3>Fixed</h3>
<ul>
<li>Security: <code>XMLSerializer.serializeToString()</code> (and
<code>Node.toString()</code>, <code>NodeList.toString()</code>) now
accept a <code>requireWellFormed</code> option (fourth argument, after
<code>isHtml</code> and <code>nodeFilter</code>). When <code>{
requireWellFormed: true }</code> is passed, the serializer throws
<code>InvalidStateError</code> for injection-prone node content,
preventing XML injection via attacker-controlled node data. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8"><code>GHSA-j759-j44w-7fr8</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx"><code>GHSA-x6wf-f3px-wcqx</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h"><code>GHSA-f6ww-3ggp-fr8h</code></a>
<ul>
<li>Comment: throws when <code>data</code> contains
<code>--&gt;</code></li>
<li>ProcessingInstruction: throws when <code>data</code> contains
<code>?&gt;</code></li>
<li>DocumentType: throws when <code>publicId</code> fails
<code>PubidLiteral</code>, <code>systemId</code> fails
<code>SystemLiteral</code>, or <code>internalSubset</code> contains
<code>]&gt;</code></li>
</ul>
</li>
<li>Security: DOM traversal operations
(<code>XMLSerializer.serializeToString()</code>,
<code>Node.prototype.normalize()</code>,
<code>Node.prototype.cloneNode(true)</code>,
<code>Document.prototype.importNode(node, true)</code>,
<code>node.textContent</code> getter,
<code>getElementsByTagName()</code> /
<code>getElementsByTagNameNS()</code> /
<code>getElementsByClassName()</code> / <code>getElementById()</code>)
are now iterative. Previously, deeply nested DOM trees would exhaust the
JavaScript call stack and throw an unrecoverable
<code>RangeError</code>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw"><code>GHSA-2v35-w6hq-6mfw</code></a></li>
</ul>
<p>Thank you,
<a href="https://github.com/Jvr2022"><code>@​Jvr2022</code></a>,
<a href="https://github.com/praveen-kv"><code>@​praveen-kv</code></a>,
<a href="https://github.com/TharVid"><code>@​TharVid</code></a>,
<a href="https://github.com/decsecre583"><code>@​decsecre583</code></a>,
<a href="https://github.com/tlsbollei"><code>@​tlsbollei</code></a>,
<a
href="https://github.com/KarimTantawey"><code>@​KarimTantawey</code></a>,
for your contributions</p>
<h2><a
href="https://github.com/xmldom/xmldom/compare/0.9.8...0.9.9">0.9.9</a></h2>
<h3>Added</h3>
<ul>
<li>implement <code>ParentNode.children</code> getter <a
href="https://redirect.github.com/xmldom/xmldom/pull/960"><code>[#960](https://github.com/xmldom/xmldom/issues/960)</code></a>
/ <a
href="https://redirect.github.com/xmldom/xmldom/issues/410"><code>[#410](https://github.com/xmldom/xmldom/issues/410)</code></a></li>
</ul>
<h3>Fixed</h3>
<ul>
<li>Security: <code>createCDATASection</code> now throws
<code>InvalidCharacterError</code> when <code>data</code> contains
<code>&quot;]]&gt;&quot;</code>, as required by the <a
href="https://dom.spec.whatwg.org/#dom-document-createcdatasection">WHATWG
DOM spec</a>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li>
<li>Security: <code>XMLSerializer</code> now splits CDATASection nodes
whose data contains <code>&quot;]]&gt;&quot;</code> into adjacent CDATA
sections at serialization time, preventing XML injection via mutation
methods (<code>appendData</code>, <code>replaceData</code>, <code>.data
=</code>, <code>.textContent =</code>). <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-wh4c-j3r5-mjhp"><code>GHSA-wh4c-j3r5-mjhp</code></a></li>
<li>correctly traverse ancestor chain in <code>Node.contains</code> <a
href="https://redirect.github.com/xmldom/xmldom/pull/931"><code>[#931](https://github.com/xmldom/xmldom/issues/931)</code></a></li>
</ul>
<p>Code that passes a string containing <code>&quot;]]&gt;&quot;</code>
to <code>createCDATASection</code> and relied on the previously unsafe
behavior will now receive <code>InvalidCharacterError</code>. Use a
mutation method such as <code>appendData</code> if you intentionally
need <code>&quot;]]&gt;&quot;</code> in a CDATASection node's data.</p>
<h3>Chore</h3>
<ul>
<li>updated dependencies</li>
</ul>
<p>Thank you,
<a
href="https://github.com/stevenobiajulu"><code>@​stevenobiajulu</code></a>,
<a href="https://github.com/yoshi389111"><code>@​yoshi389111</code></a>,
<a
href="https://github.com/thesmartshadow"><code>@​thesmartshadow</code></a>,
for your contributions</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/xmldom/xmldom/commit/e5c14802592685bb872c042c54c3f73758875c85"><code>e5c1480</code></a>
0.8.13</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/9611e20d75f059dc377f806a8f7ee7d1eaeaeb7c"><code>9611e20</code></a>
style: drop unused import in test file</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/dc4dff3d1d0b5a6b97c52fcc1823a735b8821e62"><code>dc4dff3</code></a>
docs: add 0.8.13 changelog entry</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/842fa38deedd2d9a9c90d0ad54aa1be75d2a41bc"><code>842fa38</code></a>
fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/aeff69f5a32e8c1bd540683da9e10718f84f595c"><code>aeff69f</code></a>
test: add normalize behavioral coverage to node.test.js</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/cbdb0d7db8ae70760bd4cc181cb8f30bb0cd9d88"><code>cbdb0d7</code></a>
fix: make walkDOM iterative to prevent stack overflow
(GHSA-2v35-w6hq-6mfw)</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/0b543d31794dc198c86a0358574cb5dec29674c5"><code>0b543d3</code></a>
test: assert namespace declarations are isolated between siblings in
serializ...</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/c007c51909587990c962cf3d5c2acadf4c897b87"><code>c007c51</code></a>
refactor: migrate serializeToString to walkDOM</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/2bb3899074820089d9e76ce28a5edfdacf425025"><code>2bb3899</code></a>
test: add serializeToString coverage for uncovered branches</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/e69f38d0a58731152d300e8c8eb29506f5f488fe"><code>e69f38d</code></a>
refactor: migrate importNode to walkDOM</li>
<li>Additional commits viewable in <a
href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~karfau">karfau</a>, a new releaser for
<code>@​xmldom/xmldom</code> since your current version.</p>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@xmldom/xmldom&package-manager=npm_and_yarn&previous-version=0.8.12&new-version=0.8.13)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/openfrontio/OpenFrontIO/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 19c6730e0..99989634a 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5210,9 +5210,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.8.12",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz",
-      "integrity": "sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==",
+      "version": "0.8.13",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz",
+      "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==",
       "dev": true,
       "license": "MIT",
       "engines": {