dependabot[bot] opened a new pull request, #171: URL: https://github.com/apache/cordova-browser/pull/171
Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.9.10 to 0.9.12. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/releases";>@xmldom/xmldom's releases</a>.</em></p> <blockquote> <h2>0.9.12</h2> <p><a href="https://github.com/xmldom/xmldom/compare/0.9.11...0.9.12";>Commits</a></p> <h3>Fixed</h3> <ul> <li>Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from <code>DOMParser.parseFromString</code> with default options. Serialized output is byte-identical. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g";><code>GHSA-965w-775f-mr7g</code></a></li> <li>Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the <code>NamedNodeMap</code> parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML <a href="https://www.w3.org/TR/xml/#uniqattspec";>no-duplicate-attributes well-formedness constraint</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6";><code>GHSA-8344-3jmq-59r6</code></a></li> <li>Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML <a href="https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state";>RAWTEXT end-tag rule</a> and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw";><code>GHSA-6mj3-qw4j-hgrw</code></a></li> <li>Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <code><</code>, and <code>Node.prototype.normalize()</code> merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per <a href="https://dom.spec.whatwg.org/#dom-node-normalize";><code>normalize()</code></a> in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9";><code>GHSA-93r5-fhx6-vmg9</code></a></li> <li>Security: <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> now rejects a DocType <code>name</code> that is not a valid XML <a href="https://www.w3.org/TR/xml/#NT-Name";><code>Name</code></a>, throwing <code>InvalidStateError</code> — matching the sibling <code>publicId</code>/<code>systemId</code>/<code>internalSubset</code> checks and preventing XML injection via <code>DocumentType.name</code>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv";><code>GHSA-27p8-2357-5qqv</code></a></li> <li>Security: <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> now validates a processing-instruction target as an XML <a href="https://www.w3.org/TR/xml-names/#NT-NCName";><code>NCName</code></a> and rejects a case-insensitive <code>xml</code>, throwing <code>InvalidStateError</code> — preventing PI-target injection via <code>></code>, <code>?</code>, or whitespace. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv";><code>GHSA-c7q8-3ch8-vqpv</code></a></li> <li>Security: <code>Document.createEntityReference()</code> now rejects an invalid XML <a href="https://www.w3.org/TR/xml/#NT-Name";><code>Name</code></a> at creation, and <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> validates an <code>EntityReference</code> <code>nodeName</code> as an XML <code>Name</code>, throwing <code>InvalidStateError</code> — preventing XML injection via an entity-reference name. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6";><code>GHSA-6gmq-8vp8-gcm6</code></a></li> <li>Security: the <code>requireWellFormed</code> serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with <code>InvalidStateError</code> — closing a bypass of the XML <a href="https://www.w3.org/TR/xml-names/#NT-QName";><code>QName</code></a> check. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944";><code>GHSA-jxjr-3g7g-3944</code></a></li> <li>Security: the <code>requireWellFormed</code> serializer's DocType <code>publicId</code>/<code>systemId</code> validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with <code>InvalidStateError</code> — closing a bypass of the XML <a href="https://www.w3.org/TR/xml/#NT-PubidLiteral";><code>PubidLiteral</code></a>/<code>SystemLiteral</code> check. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp";><code>GHSA-vr34-hp96-76pp</code></a></li> <li>Security: <code>createElementNS()</code>, <code>createAttributeNS()</code>, <code>createDocumentType()</code>, and <code>createAttribute()</code> now reject a name containing a line terminator with <code>InvalidCharacterError</code>, because name validation applies to the whole string — closing a creation-time bypass of the XML <a href="https://www.w3.org/TR/xml-names/#NT-QName";><code>Name</code>/<code>QName</code></a> production on the default serialization path. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-3px3-54cx-rmw9";><code>GHSA-3px3-54cx-rmw9</code></a></li> <li>Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content (a recoverable <code>error</code> in XML, a <code>warning</code> in HTML) instead of accepting it silently, per the XML <a href="https://www.w3.org/TR/xml/#NT-ETag";><code>ETag</code></a> production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported <code>error</code> to fatal via the parser's <code>onError</code> handler. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59";><code>GHSA-6h8r-xr42-gp59</code></a></li> <li><code>DOMException</code>s raised during parsing are now reported as a <code>fatalError</code>, and the originating error is preserved as the <code>cause</code> on the resulting <code>ParseError</code>.</li> </ul> <h3>Chore</h3> <ul> <li>updated dependencies</li> </ul> <p>Thank you, <a href="https://github.com/ericchiang";><code>@ericchiang</code></a>, <a href="https://github.com/KarimTantawey";><code>@KarimTantawey</code></a>, <a href="https://github.com/bhaswanthc";><code>@bhaswanthc</code></a>, <a href="https://github.com/arpitjain099";><code>@arpitjain099</code></a>, <a href="https://github.com/Paranoidgrinch";><code>@Paranoidgrinch</code></a>, for your contributions</p> <h2>0.9.11</h2> <p><a href="https://github.com/xmldom/xmldom/compare/0.9.10...0.9.11";>Commits</a></p> <h3>Fixed</h3> <ul> <li>Security: <code>XMLSerializer.serializeToString()</code> now also rejects invalid element and attribute names when <code>{ requireWellFormed: true }</code> is passed, throwing <code>InvalidStateError</code> for a name that is not a valid XML <a href="https://www.w3.org/TR/xml-names/#NT-QName";><code>QName</code></a> (this covers the namespace prefix, which surfaces in the element qualified name or in a synthesized <code>xmlns:</code> declaration). This prevents XML injection via <code>createElement()</code> / <code>setAttribute()</code>, extending the existing <code>requireWellFormed</code> checks to the serialized name set. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj";><code>GHSA-w2rr-34g9-rvrj</code></a> <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm";><code>GHSA-4w3w-2rp5-g8jm</code></a></li> <li>Security: the processing-instruction grammar regex no longer backtracks quadratically on an unterminated processing instruction (<code><?…</code> with no closing <code>?></code>), preventing a denial-of-service (ReDoS) reachable from <code>DOMParser.parseFromString</code> with default options. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7";><code>GHSA-g53g-w8rj-fmg7</code></a></li> <li><code>CharacterData</code> <code>nodeValue</code> and <code>data</code> are now kept in sync <a href="https://redirect.github.com/xmldom/xmldom/pull/990";><code>[#990](https://github.com/xmldom/xmldom/issues/990)</code></a></li> </ul> <h3>Chore</h3> <ul> <li>updated dependencies</li> </ul> <p>Thank you, <a href="https://github.com/bhaswanthc";><code>@bhaswanthc</code></a>, <a href="https://github.com/jmestwa-coder";><code>@jmestwa-coder</code></a>, <a href="https://github.com/stevenobiajulu";><code>@stevenobiajulu</code></a>, for your contributions</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md";>@xmldom/xmldom's changelog</a>.</em></p> <blockquote> <h2><a href="https://github.com/xmldom/xmldom/compare/0.9.11...0.9.12";>0.9.12</a></h2> <h3>Fixed</h3> <ul> <li>Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from <code>DOMParser.parseFromString</code> with default options. Serialized output is byte-identical. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g";><code>GHSA-965w-775f-mr7g</code></a></li> <li>Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the <code>NamedNodeMap</code> parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML <a href="https://www.w3.org/TR/xml/#uniqattspec";>no-duplicate-attributes well-formedness constraint</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6";><code>GHSA-8344-3jmq-59r6</code></a></li> <li>Security: HTML raw-text parsing no longer amplifies output on a missing or case-mismatched closing tag; the closing tag is matched case-insensitively per the WHATWG HTML <a href="https://html.spec.whatwg.org/multipage/parsing.html#rawtext-end-tag-name-state";>RAWTEXT end-tag rule</a> and a missing closing tag is handled explicitly, preventing a denial-of-service. Output for well-formed input is unchanged. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw";><code>GHSA-6mj3-qw4j-hgrw</code></a></li> <li>Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <code><</code>, and <code>Node.prototype.normalize()</code> merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per <a href="https://dom.spec.whatwg.org/#dom-node-normalize";><code>normalize()</code></a> in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9";><code>GHSA-93r5-fhx6-vmg9</code></a></li> <li>Security: <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> now rejects a DocType <code>name</code> that is not a valid XML <a href="https://www.w3.org/TR/xml/#NT-Name";><code>Name</code></a>, throwing <code>InvalidStateError</code> — matching the sibling <code>publicId</code>/<code>systemId</code>/<code>internalSubset</code> checks and preventing XML injection via <code>DocumentType.name</code>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv";><code>GHSA-27p8-2357-5qqv</code></a></li> <li>Security: <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> now validates a processing-instruction target as an XML <a href="https://www.w3.org/TR/xml-names/#NT-NCName";><code>NCName</code></a> and rejects a case-insensitive <code>xml</code>, throwing <code>InvalidStateError</code> — preventing PI-target injection via <code>></code>, <code>?</code>, or whitespace. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv";><code>GHSA-c7q8-3ch8-vqpv</code></a></li> <li>Security: <code>Document.createEntityReference()</code> now rejects an invalid XML <a href="https://www.w3.org/TR/xml/#NT-Name";><code>Name</code></a> at creation, and <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> validates an <code>EntityReference</code> <code>nodeName</code> as an XML <code>Name</code>, throwing <code>InvalidStateError</code> — preventing XML injection via an entity-reference name. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6";><code>GHSA-6gmq-8vp8-gcm6</code></a></li> <li>Security: the <code>requireWellFormed</code> serializer's element- and attribute-name validators no longer treat an interior line terminator as satisfying the name anchors, so a name containing a line terminator is rejected with <code>InvalidStateError</code> — closing a bypass of the XML <a href="https://www.w3.org/TR/xml-names/#NT-QName";><code>QName</code></a> check. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944";><code>GHSA-jxjr-3g7g-3944</code></a></li> <li>Security: the <code>requireWellFormed</code> serializer's DocType <code>publicId</code>/<code>systemId</code> validators no longer treat an interior line terminator as satisfying the anchor, so an identifier containing an ECMAScript line terminator is rejected with <code>InvalidStateError</code> — closing a bypass of the XML <a href="https://www.w3.org/TR/xml/#NT-PubidLiteral";><code>PubidLiteral</code></a>/<code>SystemLiteral</code> check. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp";><code>GHSA-vr34-hp96-76pp</code></a></li> <li>Security: <code>createElementNS()</code>, <code>createAttributeNS()</code>, <code>createDocumentType()</code>, and <code>createAttribute()</code> now reject a name containing a line terminator with <code>InvalidCharacterError</code>, because name validation applies to the whole string — closing a creation-time bypass of the XML <a href="https://www.w3.org/TR/xml-names/#NT-QName";><code>Name</code>/<code>QName</code></a> production on the default serialization path. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-3px3-54cx-rmw9";><code>GHSA-3px3-54cx-rmw9</code></a></li> <li>Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content (a recoverable <code>error</code> in XML, a <code>warning</code> in HTML) instead of accepting it silently, per the XML <a href="https://www.w3.org/TR/xml/#NT-ETag";><code>ETag</code></a> production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported <code>error</code> to fatal via the parser's <code>onError</code> handler. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59";><code>GHSA-6h8r-xr42-gp59</code></a></li> <li><code>DOMException</code>s raised during parsing are now reported as a <code>fatalError</code>, and the originating error is preserved as the <code>cause</code> on the resulting <code>ParseError</code>.</li> </ul> <h3>Chore</h3> <ul> <li>updated dependencies</li> </ul> <p>Thank you, <a href="https://github.com/ericchiang";><code>@ericchiang</code></a>, <a href="https://github.com/KarimTantawey";><code>@KarimTantawey</code></a>, <a href="https://github.com/bhaswanthc";><code>@bhaswanthc</code></a>, <a href="https://github.com/arpitjain099";><code>@arpitjain099</code></a>, <a href="https://github.com/Paranoidgrinch";><code>@Paranoidgrinch</code></a>, for your contributions</p> <h2><a href="https://github.com/xmldom/xmldom/compare/0.8.14...0.8.15";>0.8.15</a></h2> <h3>Fixed</h3> <ul> <li>Security: parsing a deeply or repeatedly namespaced document no longer consumes quadratic memory; the in-scope namespace map is inherited through the prototype chain instead of being copied for every prefix-declaring element (O(N) instead of O(N²)), preventing a denial-of-service reachable from <code>DOMParser.parseFromString</code> with default options. Serialized output is byte-identical. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g";><code>GHSA-965w-775f-mr7g</code></a></li> <li>Security: attribute de-duplication during parsing is now O(M) instead of O(M²); the <code>NamedNodeMap</code> parse-time dedup path uses a null-prototype membership index, so a well-formed document with a hostile number of duplicate attributes can no longer wedge the parse. Attribute order and duplicate resolution (last value wins, first position kept) are byte-identical, preserving the XML <a href="https://www.w3.org/TR/xml/#uniqattspec";>no-duplicate-attributes well-formedness constraint</a>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6";><code>GHSA-8344-3jmq-59r6</code></a></li> <li>Security: trimming trailing whitespace from an XML end tag (<a href="https://www.w3.org/TR/xml/#NT-ETag";><code>ETag</code></a>) is now anchored so it runs in linear time instead of backtracking quadratically on a long whitespace run, preventing a ReDoS reachable from <code>DOMParser.parseFromString</code>. Trimmed output is byte-identical. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4";><code>GHSA-x4fp-j954-r2f4</code></a></li> <li>Security: malformed-input recovery is now linear instead of quadratic — the malformed tag-name scan terminates at an embedded <code><</code>, and <code>Node.prototype.normalize()</code> merges adjacent text nodes in O(K) instead of O(K²) (also reachable programmatically), per <a href="https://dom.spec.whatwg.org/#dom-node-normalize";><code>normalize()</code></a> in the WHATWG DOM spec. DOM output is unchanged; only the reported error text differs. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9";><code>GHSA-93r5-fhx6-vmg9</code></a></li> <li>Security: <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> now rejects a DocType <code>name</code> that is not a valid XML <a href="https://www.w3.org/TR/xml/#NT-Name";><code>Name</code></a>, throwing <code>InvalidStateError</code> — matching the sibling <code>publicId</code>/<code>systemId</code>/<code>internalSubset</code> checks and preventing XML injection via <code>DocumentType.name</code>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv";><code>GHSA-27p8-2357-5qqv</code></a></li> <li>Security: <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> now validates a processing-instruction target as an XML <a href="https://www.w3.org/TR/xml-names/#NT-NCName";><code>NCName</code></a> and rejects a case-insensitive <code>xml</code>, throwing <code>InvalidStateError</code> — a check <code>0.8.x</code> did not previously perform, preventing PI-target injection via <code>></code>, <code>?</code>, or whitespace. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv";><code>GHSA-c7q8-3ch8-vqpv</code></a></li> <li>Security: <code>Document.createEntityReference()</code> now rejects an invalid XML <a href="https://www.w3.org/TR/xml/#NT-Name";><code>Name</code></a> at creation, and <code>XMLSerializer.serializeToString()</code> under <code>{ requireWellFormed: true }</code> validates an <code>EntityReference</code> <code>nodeName</code> as an XML <code>Name</code>, throwing <code>InvalidStateError</code> — preventing XML injection via an entity-reference name. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6";><code>GHSA-6gmq-8vp8-gcm6</code></a></li> <li>Security: the parser now reports a not-well-formed end tag whose valid name is followed by trailing content as a recoverable <code>error</code> instead of accepting it silently, per the XML <a href="https://www.w3.org/TR/xml/#NT-ETag";><code>ETag</code></a> production; parsing recovers to the byte-identical DOM. Consumers that want strict rejection can escalate the reported <code>error</code> to fatal via the parser's <code>errorHandler</code>. <a href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59";><code>GHSA-6h8r-xr42-gp59</code></a></li> </ul> <p>Thank you, <a href="https://github.com/ericchiang";><code>@ericchiang</code></a>, <a href="https://github.com/bhaswanthc";><code>@bhaswanthc</code></a>, <a href="https://github.com/arpitjain099";><code>@arpitjain099</code></a>, <a href="https://github.com/Paranoidgrinch";><code>@Paranoidgrinch</code></a>, for your contributions</p> <h2><a href="https://github.com/xmldom/xmldom/compare/0.9.10...0.9.11";>0.9.11</a></h2> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/xmldom/xmldom/commit/0af8cf829d8a92bbac612903422c6947f5458f06";><code>0af8cf8</code></a> 0.9.12</li> <li><a href="https://github.com/xmldom/xmldom/commit/69d257bd677aed2dde833a6dd67ddf244c370e41";><code>69d257b</code></a> docs: add 0.9.12 CHANGELOG entry</li> <li><a href="https://github.com/xmldom/xmldom/commit/e53e9b125de830559747b09d9f152c255600ddb9";><code>e53e9b1</code></a> docs: add 0.8.15 CHANGELOG entry</li> <li><a href="https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4";><code>0748720</code></a> fix: prevent quadratic malformed-tag recovery and normalize() adjacent-text m...</li> <li><a href="https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707";><code>7ced40c</code></a> fix: prevent HTML raw-text output amplification via case-insensitive close-ta...</li> <li><a href="https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3";><code>cfb09b5</code></a> fix: prevent quadratic attribute de-duplication via null-prototype membership...</li> <li><a href="https://github.com/xmldom/xmldom/commit/e9dbc6b54c4a9fa83e678647bc1544a505522040";><code>e9dbc6b</code></a> test: characterize NamedNodeMap attribute de-duplication before the index ref...</li> <li><a href="https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1";><code>dabffe8</code></a> fix: prevent quadratic namespace-map memory consumption via prototype-chain i...</li> <li><a href="https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362";><code>7b2ec67</code></a> fix: prevent multiline-anchor bypass of name/id validation by dropping the re...</li> <li><a href="https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b";><code>4664386</code></a> fix: prevent XML injection via unsafe EntityReference name (GHSA-6gmq-8vp8-gcm6)</li> <li>Additional commits viewable in <a href="https://github.com/xmldom/xmldom/compare/0.9.10...0.9.12";>compare view</a></li> </ul> </details> <details> <summary>Maintainer changes</summary> <p>This version was pushed to npm by <a href="https://www.npmjs.com/~karfau";>karfau</a>, a new releaser for <code>@xmldom/xmldom</code> since your current version.</p> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/cordova-browser/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
