archetech / archon / 29775440727

90%

push

github

security: override @xmldom/xmldom to 0.8.13 in react-wallet (#755)

@xmldom/xmldom is a transitive dep of the Capacitor/Trapeze native-project
build tooling (@trapezedev/project, mergexml -> 0.7.13; plist -> 0.8.11),
both below the 0.8.13 fix line. Add a top-level override forcing 0.8.13,
which collapses both copies to a single patched version.

Fixes GHSA-wh4c-j3r5-mjhp (CDATA), GHSA-f6ww-3ggp-fr8h (DocumentType),
GHSA-j759-j44w-7fr8 (comment) and GHSA-x6wf-f3px-wcqx (processing
instruction) — XML injection via unvalidated serialization.

Build-time tooling only (not shipped in the wallet bundle); 0.7->0.8 API
is compatible for these consumers. Lockfile regenerated via
npm install --package-lock-only.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2979 of 3529 branches covered (84.41%)

Branch coverage included in aggregate %.

6173 of 6599 relevant lines covered (93.54%)

835.78 hits per line