[Snyk] Upgrade xmldom from 0.1.27 to 0.6.0

[snyk-bot]

Snyk has created this PR to upgrade xmldom from 0.1.27 to 0.6.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 9 versions ahead of your current version.
• The recommended version was released 4 months ago, on 2021-04-17.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	XML External Entity (XXE) Injection SNYK-JS-XMLDOM-1084960	484/1000 Why? Has a fix available, CVSS 5.4	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: xmldom

• 0.6.0 - 2021-04-17
  

  0.6.0

  Fixes

  • Stop serializing empty namespace values like xmlns:ds="" #168
    BREAKING CHANGE: If your code expected empty namespaces attributes to be serialized.
    Thank you @ pdecat and @ FranckDepoortere
  • Escape < to < when serializing attribute values #198 / #199
• 0.5.0 - 2021-03-09
  

  Fixes

  • Avoid misinterpretation of malicious XML input - GHSA-h6q6-9hqw-rwfv (CVE-2021-21366)

    • Improve error reporting; throw on duplicate attribute
      BREAKING CHANGE: It is currently not clear how to consistently deal with duplicate attributes, so it's also safer for our users to fail when detecting them.
      It's possible to configure the DOMParser.errorHandler before parsing, to handle those errors differently.

      To accomplish this and also be able to verify it in tests I needed to

      • create a new Error type ParseError and export it
      • Throw ParseError from errorHandler.fatalError and prevent those from being caught in XMLReader.
      • export DOMHandler constructor as __DOMHandler

    • Preserve quotes in DOCTYPE declaration
      Since the only purpose of parsing the DOCTYPE is to be able to restore it when serializing, we decided that it would be best to leave the parsed publicId and systemId as is, including any quotes.
      BREAKING CHANGE: If somebody relies on the actual unquoted values of those ids, they will need to take care of either single or double quotes and the right escaping.
      (Without this change this would not have been possible because the SAX parser already dropped the information about the quotes that have been used in the source.)

      https://www.w3.org/TR/2006/REC-xml11-20060816/#dtd
      https://www.w3.org/TR/2006/REC-xml11-20060816/#IDAX1KS (External Entity Declaration)

  • Fix breaking preprocessors' directives when parsing attributes #171
  • fix(dom): Escape ]]> when serializing CharData #181
  • Switch to (only) MIT license (drop problematic LGPL license option) #178
  • Export DOMException; remove custom assertions; etc. #174

  Docs

  • Update MDN links in readme.md #188
• 0.4.0 - 2020-10-27
  

  Fixes

  • BREAKING Restore   behavior from v0.1.27 #67
  • BREAKING Typecheck source param before parsing #113
  • Include documents in package files list #156
  • Preserve doctype with sysid #144
  • Remove ES6 syntax from getElementsByClassName #91
  • Revert "Add lowercase of åäö in entityMap" due to duplicate entries #84
  • fix: Convert all line separators to LF #66

  Docs

  • Update CHANGELOG.md through version 0.3.0 #63
  • Update badges #78
  • Add .editorconfig file #104
  • Add note about import #79
  • Modernize & improve the example in readme.md #81

  CI

  • Add Stryker Mutator #70
  • Add Stryker action to update dashboard #77
  • Add Node GitHub action workflow #64
  • add & enable eslint #106
  • Use eslint-plugin-es5 to enforce ES5 syntax #107
  • Recover vows tests, drop proof tests #59
  • Add jest tessuite and first tests #114
  • Add jest testsuite with xmltest cases #112
  • Configure Renovate #108
  • Test European HTML entities #86
  • Updated devDependencies

  Other

  • Remove files that are not of any use #131, #65, #33
• 0.3.0 - 2020-03-04
  

  0.3.0

  • BREAKING Node >=10.x is now required.
  • BREAKING Remove component.json (deprecated package manager https://github.com/componentjs/guide)
  • BREAKING Move existing sources into lib subdirectory.
  • POSSIBLY BREAKING Introduce files entry in package.json and remove use of .npmignore.
  • Add Document.getElementsByClassName.
  • Add Node to the list of exports
  • Add lowercase of åäö in entityMap.
  • Move CHANGELOG to markdown file.
  • Move LICENSE to markdown file.
• 0.2.1 - 2019-12-20
  

  xmldom version 0.2.1

• 0.2.0 - 2019-12-20
  

  xmldom version 0.2.0

• 0.1.31 - 2019-12-19
  

  xmldom v0.1.31 - fix homepage url

• 0.1.30 - 2019-12-19
  

  xmldom v0.1.30 - fix git url

• 0.1.29 - 2019-12-19
• 0.1.27 - 2016-11-28

from xmldom GitHub release notes

Commit messages

Package name: xmldom

• c80a161 xmldon version 0.6.0
• bc36efd chore: regenerate package-lock.json
• 8a92704 Update eslint -> ^7.23.0 - devDependencies (Scrutinizer coverage badges/shields#202)
• b12106e Update @ stryker-mutator/core -> ^4.5.1 - devDependencies (GitHub issues badges badges/shields#192)
• af4642e docs: Update Changelog (Server installation issues badges/shields#197)
• 5869d76 test(stryker): Replace line numbers by error index (new repository for php badge poser badges/shields#201)
• a681852 fix: Escape `<` when serializing attribute values (Add support for david-dm.org badges/shields#199)
• bb12247 Update eslint-config-prettier -> 8 - devDependencies (images broken right now? badges/shields#187)
• 48c51b3 Update eslint -> ^7.22.0 - devDependencies (Flatten Badges badges/shields#185)
• 82b0481 refactor!: Avoid empty namespace value like xmlns:ds="" (Badge for coveralls does not work badges/shields#168)
• fa67fcf chore: set version to 0.5.1-dev in package*.json
• f763b00 xmldom version 0.5.0
• d4201b9 Merge pull request from GHSA-h6q6-9hqw-rwfv
• a4d717c Update MDN links in readme.md (Cached badges using shields.io API 404 on GitHub badges/shields#188)
• e984b3f Update @ stryker-mutator/core -> ^4.4.1 - devDependencies ([CocoaPods] Added CocoaPods license and platform badges badges/shields#184)
• c762161 Update stryker monorepo (major) (CocoaPods version integration badges/shields#140)
• fd47c51 Fix breaking preprocessors' directives when parsing attributes (Adds puppet forge (versioning) support. badges/shields#171)
• baa67f5 Update xmltest -> ^1.5.0 - devDependencies (Coveralls apiUrl use badge subdomain badges/shields#182)
• 64c7388 fix(dom): Escape `]]>` when serializing CharData (I am getting tag:invalid badges badges/shields#181)
• b73a965 Update eslint-config-prettier -> ^7.2.0 - devDependencies (Add NuGet download count badges/shields#179)
• 21bc17e Switch to (only) MIT license (Add TeamCity code coverage badges/shields#178)
• ad773c9 test: Use toBe/toStrictEqual instead of toEqual (Packagist version badge outdated badges/shields#175)
• 23608d9 chore: Add karfau as contributor (PNG background is white, not transparent badges/shields#177)
• dbd2171 Export DOMException; remove custom assertions; etc. (Add appveyor support badges/shields#174)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs