fix(deps): bump xmldom to 0.8.0 #1270
Conversation
Switching from package `xmldom` to `@xmldom/xmldom`, which resolves the security issue present in latest xmldom version 0.6.0: GHSA-5fg8-2547-mr8q The reason is that the maintainers were forced to switch to a scoped package since 0.7.0: xmldom/xmldom#271 - I used node 12 to run `npm install`. - I executed `npm run test` on my machine but some tests complained about missing titanium config in my home directory. Since I don't know what that means we will have to see what CI checks complain about. I'm one of the xmldom maintainers. Don't hesitate to ask me questions.
|
The link in the README to sign the CLA doesn't work for me: |
@xmldom/xmldomAuthor: Unknown Description: A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Homepage: https://github.com/xmldom/xmldom
New dependencies added: |
|
@karfau thanks for the PR. I'm sure they'll find a way to get this merged 👍 |
|
Cool, just to make this clear: I don't care about the attribution, feel free to take the patch and create an own PR from an existing contributor and land it. All I care about is that less people depend on the outdated verison 😃 |
|
@karfau Apologies for that incorrect link, the correct link is https://cla.axway.com/ |
|
I signed it and all checks are green, happy merging |
|
Thanks for that @karfau, I'll look to merge this when I return from vacation next week. |
ewanharris
changed the title
|
Happy about it being merged ❤️ Whats your plan/timeline to publish this to npm? |
|
@karfau It should be automatically published within the next 20 minutes or so. We did have automatic PR comments on release but it got spammy so I'll drop a comment when it's released 🙂 |
|
No need in that case, if it's an automated one/happens the same day I'm fine :) |
## [1.17.2](1.17.1...1.17.2) (2022-01-04) ### Bug Fixes * **deps:** bump xmldom to 0.8.0 ([#1270](#1270)) ([d0a4299](d0a4299))
|
PS: Since all existing xmldom versions have security issues you might want to evaluate if it's reasonable to deprecate version using that dependency. |
Switching from package
xmldomto@xmldom/xmldom, which resolves the security issue present in latest xmldom version 0.6.0:GHSA-5fg8-2547-mr8q
The reason is that the maintainers were forced to switch to a scoped package since 0.7.0:
xmldom/xmldom#271
npm install.npm run teston my machine but some tests complained about missing titanium config in my home directory.Since I don't know what that means we will have to see what CI checks complain about.
I'm one of the xmldom maintainers. Don't hesitate to ask me questions.