chore(deps): bump @xmldom/xmldom to 0.8.12#28424
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix prepared a fix for the issue found in the latest run.
- ✅ Fixed: Lockfile keeps vulnerable xmldom 0.8.11 instead of deduplicating
- Ran yarn dedupe to collapse all @xmldom/xmldom ranges to 0.8.12 and removed 0.8.11 from yarn.lock.
Or push these changes by commenting:
@cursor push 83dae2da37
Preview (83dae2da37)
diff --git a/yarn.lock b/yarn.lock
--- a/yarn.lock
+++ b/yarn.lock
@@ -20699,20 +20699,13 @@
languageName: node
linkType: hard
-"@xmldom/xmldom@npm:^0.8.12":
+"@xmldom/xmldom@npm:^0.8.12, @xmldom/xmldom@npm:^0.8.8, @xmldom/xmldom@npm:^0.x":
version: 0.8.12
resolution: "@xmldom/xmldom@npm:0.8.12"
checksum: 10/0fc20bc72a057a939ed17afc3fb35d6be2eb19e42aa9ba3c78aa8bdf471da0b4b17c2710581ce6a2cd68ce3995c2ee7d689593a70a26df1273c0c9c29dfca257
languageName: node
linkType: hard
-"@xmldom/xmldom@npm:^0.8.8, @xmldom/xmldom@npm:^0.x":
- version: 0.8.11
- resolution: "@xmldom/xmldom@npm:0.8.11"
- checksum: 10/f6d6ffdf71cf19d9b3c10e978fad40d2f85453bf5b2aa05be8aa0c5ad13f84690c3153316729213cc652d06ec12c605ddb0aa03886f1d73d51b974b4105d31e3
- languageName: node
- linkType: hard
-
"@xmldom/xmldom@npm:~0.7.7":
version: 0.7.13
resolution: "@xmldom/xmldom@npm:0.7.13"You can send follow-ups to the cloud agent here.
Reviewed by Cursor Bugbot for commit 46057e8. Configure here.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
🔍 Smart E2E Test Selection
click to see 🤖 AI reasoning detailsE2E Test Selection: The favicon utility is used in the browser/dApp connection flow to display site icons. A patch bump (0.8.11 → 0.8.12) is a minor update that typically contains bug fixes without breaking API changes. The DOMParser API usage in the favicon utility is straightforward and unlikely to be affected by a patch release. SmokeNetworkExpansion is selected as it covers dApp connect/disconnect flows where favicon parsing would be exercised. This provides minimal but targeted coverage for the affected code path. No other test areas are meaningfully impacted by this narrow dependency change. No performance tests are needed as favicon parsing is a lightweight background operation that doesn't impact measurable performance metrics. Performance Test Selection: |
|
Description
Bumps
@xmldom/xmldomfrom^0.8.10to^0.8.12to address the failing production dependency audit (GHSA-wh4c-j3r5-mjhp).Changelog
CHANGELOG entry: null
Related issues
Fixes:
Manual testing steps
Screenshots/Recordings
Before
N/A (dependency-only change)
After
N/A (dependency-only change)
Pre-merge author checklist
Pre-merge reviewer checklist
Note
Low Risk
Low risk dependency-only update; main risk is unexpected behavior changes in XML parsing due to the transitive library patch bump.
Overview
Updates the production dependency
@xmldom/xmldomfrom^0.8.10/0.8.11to^0.8.12and refreshesyarn.lockto lock the new resolved version/checksum, addressing the flagged security advisory.Reviewed by Cursor Bugbot for commit 776772f. Bugbot is set up for automated code reviews on this repo. Configure here.