fix(security): update fast-xml-parser to 5.3.5+ for CVE-2026-25896

[abhu85]

Summary

Update the pnpm override for fast-xml-parser from >=5.3.4 to >=5.3.5 to address CVE-2026-25896 (GHSA-m7jm-9gc2-mpf2).

Problem

The fast-xml-parser library versions >= 4.1.3 and < 5.3.5 are affected by a critical vulnerability that allows entity encoding bypass via regex injection in DOCTYPE entity names. An attacker can shadow built-in XML entities (e.g., <, >) with arbitrary values, potentially leading to XSS when parsed output is rendered.

The previous override targeted >=5.3.4, but the CVE was fixed in version 5.3.5.

Fix

• Updated pnpm override: fast-xml-parser@<5.3.5 -> >=5.3.5
• Regenerated lock file: now resolves to version 5.3.7

Changes

• package.json: Updated override constraint
• pnpm-lock.yaml: Updated to fast-xml-parser 5.3.7

Test Plan

• Verified new version (5.3.7) is above patched version (5.3.5)
• Lock file regenerated cleanly with pnpm install
• CI tests pass

Closes #1532

---

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

[kmcginnes]

@abhu85 thank you for the submission. I had a PR that was just merged that should fix this. If it is not fixed by my PR, then I'll look in to merging this one.

• Update some key packages #1531

[abhu85]

@kmcginnes Thank you for the quick response! I checked your merged PR #1531 and the current package.json - the fast-xml-parser override is still at >=5.3.4, but CVE-2026-25896 was fixed in version 5.3.5.

The current override:

"fast-xml-parser@<5.3.4": ">=5.3.4"

Should be:

"fast-xml-parser@<5.3.5": ">=5.3.5"

My PR updates this override to ensure versions below 5.3.5 are upgraded. If you'd prefer to handle this yourself or a different way, happy to close this PR.

Let me know how you'd like to proceed!

[abhu85]

Rebased onto main to resolve the merge conflict with #1537.

Changes in this rebase:

• Merged with upstream's qs override addition from Update eslint, ajv, and qs to fix CVEs #1537
• Kept the fast-xml-parser@<5.3.5 → >=5.3.5 fix (the main purpose of this PR)

The lockfile now inherits from upstream - pnpm will apply the updated fast-xml-parser override at resolve time during CI.

Ready for review. 🙏

[kmcginnes]

You're right. We should take your PR for the updated override. Good call.

The package.json file looks great. However, the pnpm-lock.yaml seems to be a bit mangled from all the rebasing/merging. It might need another pass or a regen.