Skip to content

fix: add fast-xml-parser override#918

Merged
ferhatelmas merged 1 commit intomasterfrom
ferhat/xml-cve
Mar 18, 2026
Merged

fix: add fast-xml-parser override#918
ferhatelmas merged 1 commit intomasterfrom
ferhat/xml-cve

Conversation

@ferhatelmas
Copy link
Member

What kind of change does this PR introduce?

Chore: security

What is the new behavior?

Add an override for the transitive dependency until new SDKs are up.

Additional context

https://github.com/supabase/storage/security/dependabot/115

@ferhatelmas ferhatelmas requested a review from a team as a code owner March 18, 2026 14:48
Copilot AI review requested due to automatic review settings March 18, 2026 14:48
Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR adds an npm override to force fast-xml-parser to a patched version for the @aws-sdk/xml-builder transitive dependency, addressing a security concern until upstream SDK updates are available.

Changes:

  • Add an overrides entry to pin fast-xml-parser to 5.5.6 specifically under @aws-sdk/xml-builder.
  • Update package-lock.json to reflect the resolved dependency graph changes (including updated fast-xml-parser / fast-xml-builder and new path-expression-matcher).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Adds targeted npm override for @aws-sdk/xml-builder -> fast-xml-parser@5.5.6.
package-lock.json Updates lockfile to the new resolved versions and added transitive dependency.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

@ferhatelmas ferhatelmas merged commit 72a8f9b into master Mar 18, 2026
7 checks passed
@ferhatelmas ferhatelmas deleted the ferhat/xml-cve branch March 18, 2026 21:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants