deps: bump @xmldom/xmldom from 0.8.12 to 0.9.9 in the production-dependencies group across 1 directory

[dependabot]

Bumps the production-dependencies group with 1 update in the / directory: @xmldom/xmldom.

Updates @xmldom/xmldom from 0.8.12 to 0.9.9

Release notes

Sourced from @​xmldom/xmldom's releases.

0.9.9

Commits

Added

• implement ParentNode.children getter [#960](https://github.com/xmldom/xmldom/issues/960) / [#410](https://github.com/xmldom/xmldom/issues/410)

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains [#931](https://github.com/xmldom/xmldom/issues/931)

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

xmldom/xmldom#435

0.9.8

Commits

Fixed

• fix: replace \u2029 as part of normalizeLineEndings [#839](https://github.com/xmldom/xmldom/issues/839) / [#838](https://github.com/xmldom/xmldom/issues/838)
• perf: speed up line detection [#847](https://github.com/xmldom/xmldom/issues/847) / [#838](https://github.com/xmldom/xmldom/issues/838)

Chore

• updated dependencies
• drop jazzer and rxjs devDependencies [#845](https://github.com/xmldom/xmldom/issues/845)

Thank you, @​kboshold, @​Ponynjaa, for your contributions.

xmldom/xmldom#435

0.9.7

Commits

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.9.9

Added

• implement ParentNode.children getter [#960](https://github.com/xmldom/xmldom/issues/960) / [#410](https://github.com/xmldom/xmldom/issues/410)

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains [#931](https://github.com/xmldom/xmldom/issues/931)

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

Commits

• 7ffb16b 0.9.9
• 07aade1 docs: add missing references to changelog (#970)
• 2b852e8 fix: XML injection via unsafe CDATA serialization (GHSA-wh4c-j3r5-mjhp) (#969)
• d9adeff chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 (#966)
• be45d04 chore: add local CI script and format:check (#965)
• 2d73ddd chore(deps-dev): bump yauzl from 3.2.0 to 3.2.1 (#963)
• 385c392 chore(deps): bump minimatch (#961)
• 7750b31 feat: implement ParentNode.children getter (#960)
• aa806cd chore(deps-dev): bump lodash from 4.17.21 to 4.17.23 (#958)
• 7d2610c chore(deps): update npm to v11.6.3 (#947)
• Additional commits viewable in compare view

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 73216e4.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/@xmldom/xmldom	0.9.9	🟢 7.5	Details Check Score Reason Code-Review ⚠️ 1 Found 1/7 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 26 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Dependency-Update-Tool 🟢 10 update tool detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 License 🟢 10 license file detected CII-Best-Practices 🟢 5 badge detected: Passing Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Fuzzing 🟢 10 project is fuzzed Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches Vulnerabilities 🟢 5 5 existing vulnerabilities detected SAST 🟢 9 SAST tool detected but not run on all commits CI-Tests 🟢 10 29 out of 29 merged PRs checked by a CI test -- score normalized to 10 Contributors 🟢 10 project has 12 contributing companies or organizations

Scanned Files

• package-lock.json

[felickz]

@copilot fix the failing CI (https://github.com/advanced-security/codeql-sarif-security-standard-annotator/actions/runs/24470965202/job/71510783260?pr=211 https://github.com/advanced-security/codeql-sarif-security-standard-annotator/actions/runs/24470972824/job/71510794644?pr=211) for this PR

[Copilot]

@copilot fix the failing CI (https://github.com/advanced-security/codeql-sarif-security-standard-annotator/actions/runs/24470965202/job/71510783260?pr=211 https://github.com/advanced-security/codeql-s...

Fixed in 0c7c365. The @xmldom/xmldom 0.9.9 upgrade changed parseFromString to require a second mimeType argument. The fix adds 'text/xml' as the required argument and casts the result through unknown to maintain type compatibility with the xpath library.