fix: bump fast-xml-parser to 5.3.5 (CVE-2026-25896)

[anupamme]

Summary

• Pins fast-xml-parser to 5.3.5 via a root-level Yarn resolutions entry, replacing the previously locked 5.3.4 which is affected by CVE-2026-25896.
• Only package.json (one-line addition to resolutions) and yarn.lock (updated checksum + version lines) are changed.

Background

fast-xml-parser enters the project as a transitive devDependency only, via:

packages/joint-core (devDep: webdriverio@9.12.1)
  → webdriverio → @wdio/utils → edgedriver@6.3.0
    → fast-xml-parser@^5.3.3   ← was locked at 5.3.4 (CVE-2026-25896)

The library is never imported by the project's own source or test code; it is used internally by edgedriver to parse XML responses from the Edge WebDriver service during e2e tests. No runtime or production surface is affected.

Why no regression test

There is no direct call-site for fast-xml-parser in this codebase to test against. The fix is fully verified by the resolved version in yarn.lock (fast-xml-parser@npm:5.3.5) and by running yarn why fast-xml-parser post-install.

Why no changeset

This change only affects a transitive devDependency. No published package's API or runtime behavior is altered.

Closes / relates to

Replaces the now-closed #3464, which addressed the same CVE but was based on a stale branch that carried unrelated commits. This PR is based directly on current master with only the minimal change.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR mitigates CVE-2026-25896 by pinning the transitive devDependency fast-xml-parser to 5.3.5 at the workspace root, ensuring the vulnerable 5.3.4 is no longer selected in the dependency graph used by the e2e tooling chain.

Changes:

• Add a root-level Yarn resolutions override to force fast-xml-parser to 5.3.5.
• Update yarn.lock to reflect fast-xml-parser@5.3.5 and its updated transitive dependencies (strnum → 2.4.2, adding anynum).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
package.json	Adds a resolutions pin for fast-xml-parser to 5.3.5.
yarn.lock	Updates the resolved dependency entries/checksums for fast-xml-parser and its transitive dependencies.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.