stacklok / toolhive-studio / 24845972644

66%

main: 71%

Pull #2096

github

chore(security): ignore GHSA-gh4j-gqv2-49f6 on pinned fast-xml-parser

Pair with the 5.5.8 pin. The advisory only affects XMLBuilder.buildComment / buildCdata when callers pass unescaped user input; this repo does not use those APIs — the AWS SDK only parses responses. Ignore both the GHSA and its CVE alias (CVE-2026-41650) with a reason string so future reviewers see the rollback rationale inline.

3803 of 6273 branches covered (60.62%)

5871 of 8901 relevant lines covered (65.96%)

117.8 hits per line