[MikeMcC399]

Situation

npm audit and Dependabot report a vulnerability GHSA-474x-hrwr-fgx4 in fast-xml-parser@5.11.2, a transient dependency of @actions/cache@5.0.5.

$ npm audit
# npm audit report

basic-ftp  <=6.2.0
Severity: high
basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) - https://github.com/advisories/GHSA-c475-qrg2-pj4r
fix available via `npm audit fix --force`
Will install markdown-link-check@3.11.2, which is a breaking change
node_modules/basic-ftp
  get-uri  >=5.0.0
  Depends on vulnerable versions of basic-ftp
  node_modules/get-uri
    pac-proxy-agent  >=6.0.0
    Depends on vulnerable versions of get-uri
    node_modules/pac-proxy-agent
      proxy-agent  >=6.0.0
      Depends on vulnerable versions of pac-proxy-agent
      node_modules/proxy-agent
        link-check  >=5.3.0
        Depends on vulnerable versions of proxy-agent
        node_modules/link-check
          markdown-link-check  >=3.12.0
          Depends on vulnerable versions of link-check
          Depends on vulnerable versions of proxy-agent
          node_modules/markdown-link-check

fast-xml-parser  <=5.11.2
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags - https://github.com/advisories/GHSA-474x-hrwr-fgx4
fix available via `npm audit fix`
node_modules/fast-xml-parser

minimatch  7.0.0 - 11.0.0
Severity: moderate
minimatch has potential denial of service via globparts amplification - https://github.com/advisories/GHSA-g3hv-75wg-m249
fix available via `npm audit fix --force`
Will install eslint@9.39.5, which is a breaking change
node_modules/@eslint/config-array/node_modules/minimatch
node_modules/eslint/node_modules/minimatch
  @eslint/config-array  >=0.23.0
  Depends on vulnerable versions of minimatch
  node_modules/@eslint/config-array
    eslint  >=10.0.0-alpha.0
    Depends on vulnerable versions of @eslint/config-array
    Depends on vulnerable versions of minimatch
    node_modules/eslint
      @eslint/js  >=10.0.1
      Depends on vulnerable versions of eslint
      node_modules/@eslint/js

11 vulnerabilities (1 low, 4 moderate, 6 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Change

Use npm audit fix to update to fast-xml-parser@5.12.0 and rebuild the action.

---

Note

Low Risk
Low risk: vendored dependency and lockfile update to patch XML parsing DoS; no application logic changes beyond the rebuilt bundle.

Overview
Bumps fast-xml-parser from 5.11.2 to 5.12.0 (and refreshes related transitive deps such as is-unsafe, fast-xml-builder, @nodable/entities, and strnum), then rebuilds dist/index.js so the cached action ships the new parser.

This addresses the reported ReDoS / quadratic CPU issue when parsing malformed XML with unterminated stop-node tags (GHSA-474x-hrwr-fgx4). The bundled parser also picks up other upstream hardening from 5.12.x—e.g. safer stop-node scanning, optional entity decoding before unsafe-pattern checks, and cached XML name validation—without changing this repo’s own source beyond the lockfile and dist artifact.

^{Reviewed by Cursor Bugbot for commit 844c417. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

🎉 This PR is included in version 7.4.10 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀