chore(ci): cherry-pick xmldom 0.8.12 bump (#28424) into release/7.72.0#28458
Conversation
|
CLA Signature Action: All authors have signed the CLA. You may need to manually re-run the blocking PR check if it doesn't pass in a few minutes. |
🔍 Smart E2E Test Selection
click to see 🤖 AI reasoning detailsE2E Test Selection: This is a very narrow, low-risk change:
Since the change touches browser/dApp functionality (favicon parsing when connecting to dApps), SmokeNetworkExpansion covers dApp connection flows which would exercise the favicon utility. However, given the extremely narrow scope of this change (just favicon display), even this may be conservative. No performance tests are needed as this is a utility library patch with no performance implications. Performance Test Selection: |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
|
✅ E2E Fixture Validation — Schema is up to date |



Summary
Cherry-picks PR #28424 (
chore(deps): bump @xmldom/xmldom to 0.8.12+ lockfile dedupe) ontorelease/7.72.0for inclusion in the release train tracked by PR #27990.Motivation
Addresses production dependency audit (
GHSA-wh4c-j3r5-mjhp) by bumping@xmldom/xmldomto0.8.12and dedupingyarn.lockso resolved versions align.Commits (cherry-picked)
46057e87e4— chore(deps): bump @xmldom/xmldom to 0.8.12776772ffcd— chore(deps): dedupe lockfile after xmldom bumpCHANGELOG entry: null
Testing
yarn audit:ci/ audit expectations as appropriate for release branchMade with Cursor
Note
Low Risk
Low risk dependency-only change: bumps
@xmldom/xmldomand updates the lockfile resolution/checksum, with no application code changes.Overview
Updates the
@xmldom/xmldomdependency from^0.8.10to^0.8.12inpackage.json.Refreshes
yarn.lockto resolve@xmldom/xmldomto0.8.12(updated resolution key/checksum), aligning the lockfile with the bumped version.Reviewed by Cursor Bugbot for commit 307083e. Bugbot is set up for automated code reviews on this repo. Configure here.