From b0c8dd307950c88fa4bae827b9edbdb19d0bab89 Mon Sep 17 00:00:00 2001
From: Anupam Mediratta <mediratta@gmail.com>
Date: Thu, 20 Aug 2026 06:55:39 +0530
Subject: [PATCH] fix: bump fast-xml-parser to 5.3.5 (CVE-2026-25896)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fast-xml-parser 5.3.4 is affected by CVE-2026-25896; 5.3.5 is the
minimal patched version. The library enters as a transitive devDep via
webdriverio → @wdio/utils → edgedriver. A root-level Yarn resolution
pins it to 5.3.5 across all transitive consumers.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 package.json |  3 ++-
 yarn.lock    | 27 ++++++++++++++++++---------
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/package.json b/package.json
index 1d537f1cda..99edaa37f5 100644
--- a/package.json
+++ b/package.json
@@ -34,7 +34,8 @@
     "./examples/*"
   ],
   "resolutions": {
-    "grunt-contrib-qunit/puppeteer": "24.22.0"
+    "grunt-contrib-qunit/puppeteer": "24.22.0",
+    "fast-xml-parser": "5.3.5"
   },
   "volta": {
     "node": "22.14.0",
diff --git a/yarn.lock b/yarn.lock
index 5ffa0fea5c..0a84516625 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -12546,6 +12546,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"anynum@npm:^1.0.1":
+  version: 1.0.1
+  resolution: "anynum@npm:1.0.1"
+  checksum: 10/096acef76cc8b9f34d43ec37ae9ba7a3d4e2e8c722a0dd59a78995248a8eb4021713ee91b55de106366ac4eaa47578ceb0fffe9829ef01d78b20f9fd6d412a88
+  languageName: node
+  linkType: hard
+
 "aproba@npm:^1.1.1":
   version: 1.2.0
   resolution: "aproba@npm:1.2.0"
@@ -18199,14 +18206,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-xml-parser@npm:^5.3.3":
-  version: 5.3.4
-  resolution: "fast-xml-parser@npm:5.3.4"
+"fast-xml-parser@npm:5.3.5":
+  version: 5.3.5
+  resolution: "fast-xml-parser@npm:5.3.5"
   dependencies:
-    strnum: "npm:^2.1.0"
+    strnum: "npm:^2.1.2"
   bin:
     fxparser: src/cli/cli.js
-  checksum: 10/0d7e6872fed7c3065641400d43cdf24c03177f05c343bfb31df53b79f0900b085c103f647852d0b00693125aa3f0e9d8b8cfc4273b168d4da0308f857dafe830
+  checksum: 10/913363c2cf9ab8038bd2b666698d99d44b977725f0198f3dfff3a5d34c3109ef49d3a163a0f390f69ed00ad33b81355112dec8be5e79a13f8e6c7aaf146204b8
   languageName: node
   linkType: hard
 
@@ -29716,10 +29723,12 @@ __metadata:
   languageName: node
   linkType: hard
 
-"strnum@npm:^2.1.0":
-  version: 2.1.2
-  resolution: "strnum@npm:2.1.2"
-  checksum: 10/7d894dff385e3a5c5b29c012cf0a7ea7962a92c6a299383c3d6db945ad2b6f3e770511356a9774dbd54444c56af1dc7c435dad6466c47293c48173274dd6c631
+"strnum@npm:^2.1.2":
+  version: 2.4.2
+  resolution: "strnum@npm:2.4.2"
+  dependencies:
+    anynum: "npm:^1.0.1"
+  checksum: 10/c624b2f1a4ba0962cfa66e645b583782e868d0f0ab2e038c3c554e81c2040c3e48463d1e078ff1d6ab4932a0b352f34bc51fdd4f8bbd9bf8da66bf9332c85cf4
   languageName: node
   linkType: hard