chore(deps): bump @xmldom/xmldom from 0.9.9 to 0.9.10 (#1407)
Bumps @xmldom/xmldom from 0.9.9 to
0.9.10.

Release notes
Sourced from @​xmldom/xmldom's
releases.

0.9.10
Commits
Fixed

Security: XMLSerializer.serializeToString() (and
Node.toString(), NodeList.toString()) now
accept a requireWellFormed option. When {
requireWellFormed: true } is passed, the serializer throws
InvalidStateError for injection-prone node content,
preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8
GHSA-x6wf-f3px-wcqx
GHSA-f6ww-3ggp-fr8h

Comment: throws when data contains --
anywhere, ends with -, or contains characters outside the
XML Char production
ProcessingInstruction: throws when target contains : or
matches xml (case-insensitive), or data
contains characters outside the XML Char production or
contains ?>
DocumentType: throws when publicId fails
PubidLiteral, systemId fails
SystemLiteral, or internalSubset contains
]>


Security: DOM traversal operations
(XMLSerializer.serializeToString(),
Node.prototype.normalize(),
Node.prototype.cloneNode(true),
Document.prototype.importNode(node, true),
node.textContent getter,
getElementsByTagName() /
getElementsByTagNameNS() /
getElementsByClassName() / getElementById(),
Node.prototype.isEqualNode()) are now iterative.
Previously, deeply nested DOM trees would exhaust the JavaScript call
stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
isEqualNode now correctly returns false
for CDATASection nodes with different data

Deprecated

The splitCDATASections serializer option is deprecated
and will be removed in the next breaking release. The automatic
splitting of "]]>" in
CDATASection data was introduced as a workaround; use
requireWellFormed: true or ensure CDATASection
data does not contain "]]>" before
serialization.

Chore

updated dependencies

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions



Changelog
Sourced from @​xmldom/xmldom's
changelog.

0.9.10
Fixed

Security: XMLSerializer.serializeToString() (and
Node.toString(), NodeList.toString()) now
accept a requireWellFormed option. When {
requireWellFormed: true } is passed, the serializer throws
InvalidStateError for injection-prone node content,
preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8
GHSA-x6wf-f3px-wcqx
GHSA-f6ww-3ggp-fr8h

Comment: throws when data contains --
anywhere, ends with -, or contains characters outside the
XML Char production
ProcessingInstruction: throws when target contains : or
matches xml (case-insensitive), or data
contains characters outside the XML Char production or
contains ?>
DocumentType: throws when publicId fails
PubidLiteral, systemId fails
SystemLiteral, or internalSubset contains
]>


Security: DOM traversal operations
(XMLSerializer.serializeToString(),
Node.prototype.normalize(),
Node.prototype.cloneNode(true),
Document.prototype.importNode(node, true),
node.textContent getter,
getElementsByTagName() /
getElementsByTagNameNS() /
getElementsByClassName() / getElementById(),
Node.prototype.isEqualNode()) are now iterative.
Previously, deeply nested DOM trees would exhaust the JavaScript call
stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
isEqualNode now correctly returns false
for CDATASection nodes with different data

Deprecated

The splitCDATASections serializer option is deprecated
and will be removed in the next breaking release. The automatic
splitting of "]]>" in
CDATASection data was introduced as a workaround; use
requireWellFormed: true or ensure CDATASection
data does not contain "]]>" before
serialization.

Chore

updated dependencies

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions
0.8.13
Fixed

Security: XMLSerializer.serializeToString() (and
Node.toString(), NodeList.toString()) now
accept a requireWellFormed option (fourth argument, after
isHtml and nodeFilter). When {
requireWellFormed: true } is passed, the serializer throws
InvalidStateError for injection-prone node content,
preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8
GHSA-x6wf-f3px-wcqx
GHSA-f6ww-3ggp-fr8h

Comment: throws when data contains
-->
ProcessingInstruction: throws when data contains
?>
DocumentType: throws when publicId fails
PubidLiteral, systemId fails
SystemLiteral, or internalSubset contains
]>


Security: DOM traversal operations
(XMLSerializer.serializeToString(),
Node.prototype.normalize(),
Node.prototype.cloneNode(true),
Document.prototype.importNode(node, true),
node.textContent getter,
getElementsByTagName() /
getElementsByTagNameNS() /
getElementsByClassName() / getElementById())
are now iterative. Previously, deeply nested DOM trees would exhaust the
JavaScript call stack and throw an unrecoverable
RangeError. GHSA-2v35-w6hq-6mfw

Thank you,
@​Jvr2022,
@​praveen-kv,
@​TharVid,
@​decsecre583,
@​tlsbollei,
@​KarimTantawey,
for your contributions



Commits

bf396a5
0.9.10
78f6089
test: add missing serializer coverage for nodeFilter string return,
Attribute...
192ce5b
ci: remove unused imports flagged by CodeQL
ca81c06
test: lower stack size for tests
c9d5937
style: npm run format
1537fb4
docs: add 0.9.10 changelog entry
afd6f6f
docs: add 0.8.13 changelog entry
afeb4ee
refactor: align error mesage between branches
4845ef1
fix: prevent stack overflow in isEqualNode (GHSA-2v35-w6hq-6mfw)
dfb94a4
test: add missing isEqualNode behavioral coverage
Additional commits viewable in compare
view



Maintainer changes
This version was pushed to npm by karfau, a new releaser for
@​xmldom/xmldom since your current version.






Dependabot will resolve any conflicts with this PR as long as you don’t
alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.


Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits
that have been made to it
@dependabot show <dependency name> ignore conditions will show all
of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
Security Alerts
page.



Signed-off-by: dependabot[bot] support@github.com
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>