Skip to content

chore(deps): partial upgraded for fast-xml-parser#4421

Closed
alizard0 wants to merge 1 commit intoredhat-developer:mainfrom
alizard0:CVE-2026-33036
Closed

chore(deps): partial upgraded for fast-xml-parser#4421
alizard0 wants to merge 1 commit intoredhat-developer:mainfrom
alizard0:CVE-2026-33036

Conversation

@alizard0
Copy link
Copy Markdown
Member

Description

Partial upgrades the dependency.

On root, this needs to be upgraded:

├─┬ @internal/plugin-dynamic-plugins-info-backend@0.1.0 -> ./plugins/dynamic-plugins-info-backend
│ └─┬ @backstage/backend-defaults@0.15.2
│   ├─┬ @aws-sdk/client-codecommit@3.1011.0
│   │ └─┬ @aws-sdk/core@3.973.20
│   │   └─┬ @aws-sdk/xml-builder@3.972.11
│   │     └── fast-xml-parser@5.4.1

On dynamic-plugins,

└─┬ backstage-plugin-kubernetes-backend@0.21.1 -> ./wrappers/backstage-plugin-kubernetes-backend-dynamic
  └─┬ @backstage/plugin-kubernetes-backend@0.21.1
    └─┬ @aws-sdk/credential-providers@3.1011.0
      └─┬ @aws-sdk/core@3.973.20
        └─┬ @aws-sdk/xml-builder@3.972.11
          └── fast-xml-parser@5.4.1

Which issue(s) does this PR fix

PR acceptance criteria

Please make sure that the following steps are complete:

  • GitHub Actions are completed and successful
  • Unit Tests are updated and passing
  • E2E Tests are updated and passing
  • Documentation is updated if necessary (requirement for new features)
  • Add a screenshot if the change is UX/UI related

How to test changes / Special notes to the reviewer

@sonarqubecloud
Copy link
Copy Markdown

@github-actions
Copy link
Copy Markdown
Contributor

Image was built and published successfully. It is available at:

@alizard0
Copy link
Copy Markdown
Member Author

/retest

Copy link
Copy Markdown
Member

@kim-tsao kim-tsao left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure why the @aws packages were bumped. Can you re-do this PR and run yarn up -R fast-xml-parser to pick up the latest version? Should be v5.5.9 now

@alizard0
Copy link
Copy Markdown
Member Author

alizard0 commented Apr 6, 2026

I'm not sure why the @aws packages were bumped. Can you re-do this PR and run yarn up -R fast-xml-parser to pick up the latest version? Should be v5.5.9 now

I think I started upgrading the parents to get the fast-xml-parser in the right version.

@alizard0
Copy link
Copy Markdown
Member Author

alizard0 commented Apr 6, 2026

@kim-tsao if I upgrade only the fast-xml-parser on root, it gets partially fixed (5.5.6<)
Apart from this:

│   │   └─┬ @aws-sdk/xml-builder@3.972.8
│   │     └── fast-xml-parser@5.3.6

─❯ npm ls fast-xml-parser                                                                                                                                                                                ─╯
root@1.10.0 /Users/alizardo/Documents/engineering/github/rhdh
├─┬ @backstage/cli@0.35.4
│ └─┬ @backstage/integration@1.20.0
│   └─┬ @azure/storage-blob@12.31.0
│     └─┬ @azure/core-xml@1.5.0
│       └── fast-xml-parser@5.5.10 deduped
├─┬ @internal/plugin-dynamic-plugins-info-backend@0.1.0 -> ./plugins/dynamic-plugins-info-backend
│ └─┬ @backstage/backend-defaults@0.15.2
│   ├─┬ @aws-sdk/client-codecommit@3.999.0
│   │ └─┬ @aws-sdk/core@3.973.15
│   │   └─┬ @aws-sdk/xml-builder@3.972.8
│   │     └── fast-xml-parser@5.3.6
│   └─┬ @google-cloud/storage@7.19.0
│     └── fast-xml-parser@5.5.10
└─┬ app@1.0.1 -> ./packages/app
  └─┬ @backstage/plugin-api-docs@0.13.4
    └─┬ @asyncapi/react-component@2.6.5
      └─┬ openapi-sampler@1.7.0
        └── fast-xml-parser@5.5.10 deduped

@alizard0 alizard0 closed this Apr 13, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants