[Midnightbsd-cvs] [MidnightBSD/mports] ae18cd: build(deps-dev): bump @xmldom/xmldom from 0.8.11 t...

dependabot[bot] noreply at github.com
Thu Sep 3 12:01:41 EDT 2026 

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: ae18cd41d3c493d55a6995b6a404611f5c3d07f8
      https://github.com/MidnightBSD/mports/commit/ae18cd41d3c493d55a6995b6a404611f5c3d07f8
  Author: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
  Date:   2026-09-03 (Thu, 03 Sep 2026)

  Changed paths:
    M devel/electron41/Makefile
    M devel/electron41/distinfo
    M devel/electron41/files/packagejsons/.yarn/install-state.gz
    M devel/electron41/files/packagejsons/package.json
    M devel/electron41/files/packagejsons/yarn.lock

  Log Message:
  -----------
  build(deps-dev): bump @xmldom/xmldom from 0.8.11 to 0.8.15 in /devel/electron41/files/packagejsons (#806)

Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.8.11 to
0.8.15.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/xmldom/xmldom/releases">@​xmldom/xmldom's
releases</a>.</em></p>
<blockquote>
<h2>0.8.15</h2>
<p><a
href="https://github.com/xmldom/xmldom/compare/0.8.14...0.8.15">Commits</a></p>
<h3>Fixed</h3>
<ul>
<li>Security: parsing a deeply or repeatedly namespaced document no
longer consumes quadratic memory; the in-scope namespace map is
inherited through the prototype chain instead of being copied for every
prefix-declaring element (O(N) instead of O(N²)), preventing a
denial-of-service reachable from <code>DOMParser.parseFromString</code>
with default options. Serialized output is byte-identical. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g"><code>GHSA-965w-775f-mr7g</code></a></li>
<li>Security: attribute de-duplication during parsing is now O(M)
instead of O(M²); the <code>NamedNodeMap</code> parse-time dedup path
uses a null-prototype membership index, so a well-formed document with a
hostile number of duplicate attributes can no longer wedge the parse.
Attribute order and duplicate resolution (last value wins, first
position kept) are byte-identical, preserving the XML <a
href="https://www.w3.org/TR/xml/#uniqattspec">no-duplicate-attributes
well-formedness constraint</a>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6"><code>GHSA-8344-3jmq-59r6</code></a></li>
<li>Security: trimming trailing whitespace from an XML end tag (<a
href="https://www.w3.org/TR/xml/#NT-ETag"><code>ETag</code></a>) is now
anchored so it runs in linear time instead of backtracking quadratically
on a long whitespace run, preventing a ReDoS reachable from
<code>DOMParser.parseFromString</code>. Trimmed output is
byte-identical. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4"><code>GHSA-x4fp-j954-r2f4</code></a></li>
<li>Security: malformed-input recovery is now linear instead of
quadratic — the malformed tag-name scan terminates at an embedded
<code><</code>, and <code>Node.prototype.normalize()</code> merges
adjacent text nodes in O(K) instead of O(K²) (also reachable
programmatically), per <a
href="https://dom.spec.whatwg.org/#dom-node-normalize"><code>normalize()</code></a>
in the WHATWG DOM spec. DOM output is unchanged; only the reported error
text differs. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9"><code>GHSA-93r5-fhx6-vmg9</code></a></li>
<li>Security: <code>XMLSerializer.serializeToString()</code> under
<code>{ requireWellFormed: true }</code> now rejects a DocType
<code>name</code> that is not a valid XML <a
href="https://www.w3.org/TR/xml/#NT-Name"><code>Name</code></a>,
throwing <code>InvalidStateError</code> — matching the sibling
<code>publicId</code>/<code>systemId</code>/<code>internalSubset</code>
checks and preventing XML injection via <code>DocumentType.name</code>.
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv"><code>GHSA-27p8-2357-5qqv</code></a></li>
<li>Security: <code>XMLSerializer.serializeToString()</code> under
<code>{ requireWellFormed: true }</code> now validates a
processing-instruction target as an XML <a
href="https://www.w3.org/TR/xml-names/#NT-NCName"><code>NCName</code></a>
and rejects a case-insensitive <code>xml</code>, throwing
<code>InvalidStateError</code> — a check <code>0.8.x</code> did not
previously perform, preventing PI-target injection via
<code>></code>, <code>?</code>, or whitespace. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv"><code>GHSA-c7q8-3ch8-vqpv</code></a></li>
<li>Security: <code>Document.createEntityReference()</code> now rejects
an invalid XML <a
href="https://www.w3.org/TR/xml/#NT-Name"><code>Name</code></a> at
creation, and <code>XMLSerializer.serializeToString()</code> under
<code>{ requireWellFormed: true }</code> validates an
<code>EntityReference</code> <code>nodeName</code> as an XML
<code>Name</code>, throwing <code>InvalidStateError</code> — preventing
XML injection via an entity-reference name. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6"><code>GHSA-6gmq-8vp8-gcm6</code></a></li>
<li>Security: the parser now reports a not-well-formed end tag whose
valid name is followed by trailing content as a recoverable
<code>error</code> instead of accepting it silently, per the XML <a
href="https://www.w3.org/TR/xml/#NT-ETag"><code>ETag</code></a>
production; parsing recovers to the byte-identical DOM. Consumers that
want strict rejection can escalate the reported <code>error</code> to
fatal via the parser's <code>errorHandler</code>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59"><code>GHSA-6h8r-xr42-gp59</code></a></li>
</ul>
<p>Thank you,
<a href="https://github.com/ericchiang"><code>@​ericchiang</code></a>,
<a href="https://github.com/bhaswanthc"><code>@​bhaswanthc</code></a>,
<a
href="https://github.com/arpitjain099"><code>@​arpitjain099</code></a>,
<a
href="https://github.com/Paranoidgrinch"><code>@​Paranoidgrinch</code></a>,
for your contributions</p>
<h2>0.8.14</h2>
<p><a
href="https://github.com/xmldom/xmldom/compare/0.8.13...0.8.14">Commits</a></p>
<h3>Fixed</h3>
<ul>
<li>Security: <code>XMLSerializer.serializeToString()</code> now also
rejects invalid element and attribute names when <code>{
requireWellFormed: true }</code> is passed, throwing
<code>InvalidStateError</code> for a name that is not a valid XML <a
href="https://www.w3.org/TR/xml-names/#NT-QName"><code>QName</code></a>
(this covers the namespace prefix, which surfaces in the element
qualified name or in a synthesized <code>xmlns:</code> declaration).
This prevents XML injection via <code>createElement()</code> /
<code>setAttribute()</code>, extending the existing
<code>requireWellFormed</code> checks to the serialized name set. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj"><code>GHSA-w2rr-34g9-rvrj</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm"><code>GHSA-4w3w-2rp5-g8jm</code></a></li>
</ul>
<p>Thank you,
<a href="https://github.com/bhaswanthc"><code>@​bhaswanthc</code></a>,
<a
href="https://github.com/jmestwa-coder"><code>@​jmestwa-coder</code></a>,
for your contributions</p>
<h2>0.8.13</h2>
<p><a
href="https://github.com/xmldom/xmldom/compare/0.8.12...0.8.13">Commits</a></p>
<h3>Fixed</h3>
<ul>
<li>Security: <code>XMLSerializer.serializeToString()</code> (and
<code>Node.toString()</code>, <code>NodeList.toString()</code>) now
accept a <code>requireWellFormed</code> option (fourth argument, after
<code>isHtml</code> and <code>nodeFilter</code>). When <code>{
requireWellFormed: true }</code> is passed, the serializer throws
<code>InvalidStateError</code> for injection-prone node content,
preventing XML injection via attacker-controlled node data. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-j759-j44w-7fr8"><code>GHSA-j759-j44w-7fr8</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x6wf-f3px-wcqx"><code>GHSA-x6wf-f3px-wcqx</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-f6ww-3ggp-fr8h"><code>GHSA-f6ww-3ggp-fr8h</code></a>
<ul>
<li>Comment: throws when <code>data</code> contains
<code>--></code></li>
<li>ProcessingInstruction: throws when <code>data</code> contains
<code>?></code></li>
<li>DocumentType: throws when <code>publicId</code> fails
<code>PubidLiteral</code>, <code>systemId</code> fails
<code>SystemLiteral</code>, or <code>internalSubset</code> contains
<code>]></code></li>
</ul>
</li>
<li>Security: DOM traversal operations
(<code>XMLSerializer.serializeToString()</code>,
<code>Node.prototype.normalize()</code>,
<code>Node.prototype.cloneNode(true)</code>,
<code>Document.prototype.importNode(node, true)</code>,
<code>node.textContent</code> getter,
<code>getElementsByTagName()</code> /
<code>getElementsByTagNameNS()</code> /
<code>getElementsByClassName()</code> / <code>getElementById()</code>)
are now iterative. Previously, deeply nested DOM trees would exhaust the
JavaScript call stack and throw an unrecoverable
<code>RangeError</code>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-2v35-w6hq-6mfw"><code>GHSA-2v35-w6hq-6mfw</code></a></li>
</ul>
<p>Thank you,
<a href="https://github.com/Jvr2022"><code>@​Jvr2022</code></a>,
<a href="https://github.com/praveen-kv"><code>@​praveen-kv</code></a>,
<a href="https://github.com/TharVid"><code>@​TharVid</code></a>,
<a href="https://github.com/decsecre583"><code>@​decsecre583</code></a>,
<a href="https://github.com/tlsbollei"><code>@​tlsbollei</code></a>,</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md">@​xmldom/xmldom's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/xmldom/xmldom/compare/0.8.14...0.8.15">0.8.15</a></h2>
<h3>Fixed</h3>
<ul>
<li>Security: parsing a deeply or repeatedly namespaced document no
longer consumes quadratic memory; the in-scope namespace map is
inherited through the prototype chain instead of being copied for every
prefix-declaring element (O(N) instead of O(N²)), preventing a
denial-of-service reachable from <code>DOMParser.parseFromString</code>
with default options. Serialized output is byte-identical. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g"><code>GHSA-965w-775f-mr7g</code></a></li>
<li>Security: attribute de-duplication during parsing is now O(M)
instead of O(M²); the <code>NamedNodeMap</code> parse-time dedup path
uses a null-prototype membership index, so a well-formed document with a
hostile number of duplicate attributes can no longer wedge the parse.
Attribute order and duplicate resolution (last value wins, first
position kept) are byte-identical, preserving the XML <a
href="https://www.w3.org/TR/xml/#uniqattspec">no-duplicate-attributes
well-formedness constraint</a>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6"><code>GHSA-8344-3jmq-59r6</code></a></li>
<li>Security: trimming trailing whitespace from an XML end tag (<a
href="https://www.w3.org/TR/xml/#NT-ETag"><code>ETag</code></a>) is now
anchored so it runs in linear time instead of backtracking quadratically
on a long whitespace run, preventing a ReDoS reachable from
<code>DOMParser.parseFromString</code>. Trimmed output is
byte-identical. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-x4fp-j954-r2f4"><code>GHSA-x4fp-j954-r2f4</code></a></li>
<li>Security: malformed-input recovery is now linear instead of
quadratic — the malformed tag-name scan terminates at an embedded
<code><</code>, and <code>Node.prototype.normalize()</code> merges
adjacent text nodes in O(K) instead of O(K²) (also reachable
programmatically), per <a
href="https://dom.spec.whatwg.org/#dom-node-normalize"><code>normalize()</code></a>
in the WHATWG DOM spec. DOM output is unchanged; only the reported error
text differs. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9"><code>GHSA-93r5-fhx6-vmg9</code></a></li>
<li>Security: <code>XMLSerializer.serializeToString()</code> under
<code>{ requireWellFormed: true }</code> now rejects a DocType
<code>name</code> that is not a valid XML <a
href="https://www.w3.org/TR/xml/#NT-Name"><code>Name</code></a>,
throwing <code>InvalidStateError</code> — matching the sibling
<code>publicId</code>/<code>systemId</code>/<code>internalSubset</code>
checks and preventing XML injection via <code>DocumentType.name</code>.
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv"><code>GHSA-27p8-2357-5qqv</code></a></li>
<li>Security: <code>XMLSerializer.serializeToString()</code> under
<code>{ requireWellFormed: true }</code> now validates a
processing-instruction target as an XML <a
href="https://www.w3.org/TR/xml-names/#NT-NCName"><code>NCName</code></a>
and rejects a case-insensitive <code>xml</code>, throwing
<code>InvalidStateError</code> — a check <code>0.8.x</code> did not
previously perform, preventing PI-target injection via
<code>></code>, <code>?</code>, or whitespace. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv"><code>GHSA-c7q8-3ch8-vqpv</code></a></li>
<li>Security: <code>Document.createEntityReference()</code> now rejects
an invalid XML <a
href="https://www.w3.org/TR/xml/#NT-Name"><code>Name</code></a> at
creation, and <code>XMLSerializer.serializeToString()</code> under
<code>{ requireWellFormed: true }</code> validates an
<code>EntityReference</code> <code>nodeName</code> as an XML
<code>Name</code>, throwing <code>InvalidStateError</code> — preventing
XML injection via an entity-reference name. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6"><code>GHSA-6gmq-8vp8-gcm6</code></a></li>
<li>Security: the parser now reports a not-well-formed end tag whose
valid name is followed by trailing content as a recoverable
<code>error</code> instead of accepting it silently, per the XML <a
href="https://www.w3.org/TR/xml/#NT-ETag"><code>ETag</code></a>
production; parsing recovers to the byte-identical DOM. Consumers that
want strict rejection can escalate the reported <code>error</code> to
fatal via the parser's <code>errorHandler</code>. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59"><code>GHSA-6h8r-xr42-gp59</code></a></li>
</ul>
<p>Thank you,
<a href="https://github.com/ericchiang"><code>@​ericchiang</code></a>,
<a href="https://github.com/bhaswanthc"><code>@​bhaswanthc</code></a>,
<a
href="https://github.com/arpitjain099"><code>@​arpitjain099</code></a>,
<a
href="https://github.com/Paranoidgrinch"><code>@​Paranoidgrinch</code></a>,
for your contributions</p>
<h2><a
href="https://github.com/xmldom/xmldom/compare/0.9.10...0.9.11">0.9.11</a></h2>
<h3>Fixed</h3>
<ul>
<li>Security: <code>XMLSerializer.serializeToString()</code> now also
rejects invalid element and attribute names when <code>{
requireWellFormed: true }</code> is passed, throwing
<code>InvalidStateError</code> for a name that is not a valid XML <a
href="https://www.w3.org/TR/xml-names/#NT-QName"><code>QName</code></a>
(this covers the namespace prefix, which surfaces in the element
qualified name or in a synthesized <code>xmlns:</code> declaration).
This prevents XML injection via <code>createElement()</code> /
<code>setAttribute()</code>, extending the existing
<code>requireWellFormed</code> checks to the serialized name set. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj"><code>GHSA-w2rr-34g9-rvrj</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm"><code>GHSA-4w3w-2rp5-g8jm</code></a></li>
<li>Security: the processing-instruction grammar regex no longer
backtracks quadratically on an unterminated processing instruction
(<code><?…</code> with no closing <code>?></code>), preventing a
denial-of-service (ReDoS) reachable from
<code>DOMParser.parseFromString</code> with default options. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-g53g-w8rj-fmg7"><code>GHSA-g53g-w8rj-fmg7</code></a></li>
<li><code>CharacterData</code> <code>nodeValue</code> and
<code>data</code> are now kept in sync <a
href="https://redirect.github.com/xmldom/xmldom/pull/990"><code>[#990](https://github.com/xmldom/xmldom/issues/990)</code></a></li>
</ul>
<h3>Chore</h3>
<ul>
<li>updated dependencies</li>
</ul>
<p>Thank you,
<a href="https://github.com/bhaswanthc"><code>@​bhaswanthc</code></a>,
<a
href="https://github.com/jmestwa-coder"><code>@​jmestwa-coder</code></a>,
<a
href="https://github.com/stevenobiajulu"><code>@​stevenobiajulu</code></a>,
for your contributions</p>
<h2><a
href="https://github.com/xmldom/xmldom/compare/0.8.13...0.8.14">0.8.14</a></h2>
<h3>Fixed</h3>
<ul>
<li>Security: <code>XMLSerializer.serializeToString()</code> now also
rejects invalid element and attribute names when <code>{
requireWellFormed: true }</code> is passed, throwing
<code>InvalidStateError</code> for a name that is not a valid XML <a
href="https://www.w3.org/TR/xml-names/#NT-QName"><code>QName</code></a>
(this covers the namespace prefix, which surfaces in the element
qualified name or in a synthesized <code>xmlns:</code> declaration).
This prevents XML injection via <code>createElement()</code> /
<code>setAttribute()</code>, extending the existing
<code>requireWellFormed</code> checks to the serialized name set. <a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-w2rr-34g9-rvrj"><code>GHSA-w2rr-34g9-rvrj</code></a>
<a
href="https://github.com/xmldom/xmldom/security/advisories/GHSA-4w3w-2rp5-g8jm"><code>GHSA-4w3w-2rp5-g8jm</code></a></li>
</ul>
<p>Thank you,
<a href="https://github.com/bhaswanthc"><code>@​bhaswanthc</code></a>,
<a
href="https://github.com/jmestwa-coder"><code>@​jmestwa-coder</code></a>,
for your contributions</p>
<h2><a
href="https://github.com/xmldom/xmldom/compare/0.9.9...0.9.10">0.9.10</a></h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/xmldom/xmldom/commit/b5b8fb5b579ae1183b34e74b3bc39d7eb50a226a"><code>b5b8fb5</code></a>
0.8.15</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/327508ea98d169285b2c0559836332a9879de213"><code>327508e</code></a>
docs: add 0.8.15 CHANGELOG entry</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9"><code>f40ccb8</code></a>
fix: prevent quadratic malformed-tag recovery and normalize()
adjacent-text m...</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09"><code>3abb093</code></a>
fix: prevent end-tag whitespace-trim ReDoS via anchored trim
(GHSA-x4fp-j954-...</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213"><code>2c548f2</code></a>
fix: prevent quadratic attribute de-duplication via null-prototype
membership...</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/08a74b47c7f29d2e9b3212682856b959040d1838"><code>08a74b4</code></a>
test: characterize NamedNodeMap attribute de-duplication before the
index ref...</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d"><code>954370f</code></a>
fix: prevent quadratic namespace-map memory consumption via
prototype-chain i...</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828"><code>4430189</code></a>
fix: report not-well-formed end-tag trailing content
(GHSA-6h8r-xr42-gp59)</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0"><code>6c3fb5f</code></a>
fix: prevent XML injection via unsafe EntityReference name
(GHSA-6gmq-8vp8-gcm6)</li>
<li><a
href="https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b"><code>3b69487</code></a>
fix: prevent XML injection via unsafe processing instruction target
serializa...</li>
<li>Additional commits viewable in <a
href="https://github.com/xmldom/xmldom/compare/0.8.11...0.8.15">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by <a
href="https://www.npmjs.com/~karfau">karfau</a>, a new releaser for
<code>@​xmldom/xmldom</code> since your current version.</p>
</details>
<br />

---------

Signed-off-by: dependabot[bot] <support at github.com>
Signed-off-by: Lucas Holt <luke at foolishgames.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Lucas Holt <luke at foolishgames.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications

More information about the Midnightbsd-cvs mailing list