From fa6937577735f471df3878705bb0c65a45c98e80 Mon Sep 17 00:00:00 2001
From: "ugo.bechameil" <ugo.bechameil@hackolade.com>
Date: Fri, 24 Apr 2026 15:39:07 +0200
Subject: [PATCH] Fix fast-xml-parser cve

---
 package-lock.json | 52 ++++++++++++++++++++++++++++-------------------
 package.json      |  4 ++--
 2 files changed, 33 insertions(+), 23 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0712df7..0400263 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,19 +1,19 @@
 {
     "name": "Cassandra",
-    "version": "0.2.18",
+    "version": "0.2.19",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {
         "": {
             "name": "Cassandra",
-            "version": "0.2.18",
+            "version": "0.2.19",
             "hasInstallScript": true,
             "dependencies": {
                 "@webpod/ip": "0.6.1",
                 "antlr4": "4.8.0",
                 "async": "3.2.6",
                 "cassandra-driver": "4.3.1",
-                "fast-xml-parser": "5.5.7",
+                "fast-xml-parser": "5.7.1",
                 "jks-js": "1.1.5",
                 "lodash": "4.18.1"
             },
@@ -691,6 +691,18 @@
                 "@jridgewell/sourcemap-codec": "^1.4.14"
             }
         },
+        "node_modules/@nodable/entities": {
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/@nodable/entities/-/entities-2.1.0.tgz",
+            "integrity": "sha512-nyT7T3nbMyBI/lvr6L5TyWbFJAI9FTgVRakNoBqCD+PmID8DzFrrNdLLtHMwMszOtqZa8PAOV24ZqDnQrhQINA==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodable"
+                }
+            ],
+            "license": "MIT"
+        },
         "node_modules/@nodelib/fs.scandir": {
             "version": "2.1.5",
             "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
@@ -1483,7 +1495,6 @@
             "dev": true,
             "hasInstallScript": true,
             "license": "MIT",
-            "peer": true,
             "bin": {
                 "esbuild": "bin/esbuild"
             },
@@ -1605,9 +1616,9 @@
             }
         },
         "node_modules/fast-xml-builder": {
-            "version": "1.1.4",
-            "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.4.tgz",
-            "integrity": "sha512-f2jhpN4Eccy0/Uz9csxh3Nu6q4ErKxf0XIsasomfOihuSUa3/xw6w8dnOtCDgEItQFJG8KyXPzQXzcODDrrbOg==",
+            "version": "1.1.5",
+            "resolved": "https://registry.npmjs.org/fast-xml-builder/-/fast-xml-builder-1.1.5.tgz",
+            "integrity": "sha512-4TJn/8FKLeslLAH3dnohXqE3QSoxkhvaMzepOIZytwJXZO69Bfz0HBdDHzOTOon6G59Zrk6VQ2bEiv1t61rfkA==",
             "funding": [
                 {
                     "type": "github",
@@ -1620,9 +1631,9 @@
             }
         },
         "node_modules/fast-xml-parser": {
-            "version": "5.5.7",
-            "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.5.7.tgz",
-            "integrity": "sha512-LteOsISQ2GEiDHZch6L9hB0+MLoYVLToR7xotrzU0opCICBkxOPgHAy1HxAvtxfJNXDJpgAsQN30mkrfpO2Prg==",
+            "version": "5.7.1",
+            "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.7.1.tgz",
+            "integrity": "sha512-8Cc3f8GUGUULg34pBch/KGyPLglS+OFs05deyOlY7fL2MTagYPKrVQNmR1fLF/yJ9PH5ZSTd3YDF6pnmeZU+zA==",
             "funding": [
                 {
                     "type": "github",
@@ -1631,9 +1642,10 @@
             ],
             "license": "MIT",
             "dependencies": {
-                "fast-xml-builder": "^1.1.4",
-                "path-expression-matcher": "^1.1.3",
-                "strnum": "^2.2.0"
+                "@nodable/entities": "^2.1.0",
+                "fast-xml-builder": "^1.1.5",
+                "path-expression-matcher": "^1.5.0",
+                "strnum": "^2.2.3"
             },
             "bin": {
                 "fxparser": "src/cli/cli.js"
@@ -2475,7 +2487,6 @@
             "integrity": "sha512-EEHNdo5cW2w1xwYdBQ7d3IXDqWAtMkfVFrh+9gQ4kYbYJwygY4QXSh1eH80/xVipZdVKujAwBgg/nNNHk56kxQ==",
             "dev": true,
             "license": "MIT",
-            "peer": true,
             "bin": {
                 "tsgolint": "bin/tsgolint.js"
             },
@@ -2602,9 +2613,9 @@
             }
         },
         "node_modules/path-expression-matcher": {
-            "version": "1.1.3",
-            "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.1.3.tgz",
-            "integrity": "sha512-qdVgY8KXmVdJZRSS1JdEPOKPdTiEK/pi0RkcT2sw1RhXxohdujUlJFPuS1TSkevZ9vzd3ZlL7ULl1MHGTApKzQ==",
+            "version": "1.5.0",
+            "resolved": "https://registry.npmjs.org/path-expression-matcher/-/path-expression-matcher-1.5.0.tgz",
+            "integrity": "sha512-cbrerZV+6rvdQrrD+iGMcZFEiiSrbv9Tfdkvnusy6y0x0GKBXREFg/Y65GhIfm0tnLntThhzCnfKwp1WRjeCyQ==",
             "funding": [
                 {
                     "type": "github",
@@ -2685,7 +2696,6 @@
             "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
             "dev": true,
             "license": "MIT",
-            "peer": true,
             "bin": {
                 "prettier": "bin/prettier.cjs"
             },
@@ -2974,9 +2984,9 @@
             }
         },
         "node_modules/strnum": {
-            "version": "2.2.1",
-            "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.1.tgz",
-            "integrity": "sha512-BwRvNd5/QoAtyW1na1y1LsJGQNvRlkde6Q/ipqqEaivoMdV+B1OMOTVdwR+N/cwVUcIt9PYyHmV8HyexCZSupg==",
+            "version": "2.2.3",
+            "resolved": "https://registry.npmjs.org/strnum/-/strnum-2.2.3.tgz",
+            "integrity": "sha512-oKx6RUCuHfT3oyVjtnrmn19H1SiCqgJSg+54XqURKp5aCMbrXrhLjRN9TjuwMjiYstZ0MzDrHqkGZ5dFTKd+zg==",
             "funding": [
                 {
                     "type": "github",
diff --git a/package.json b/package.json
index 02e52ae..7950874 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
         "antlr4": "4.8.0",
         "async": "3.2.6",
         "cassandra-driver": "4.3.1",
-        "fast-xml-parser": "5.5.7",
+        "fast-xml-parser": "5.7.1",
         "jks-js": "1.1.5",
         "lodash": "4.18.1"
     },
@@ -80,4 +80,4 @@
         "fast-xml-parser": "$fast-xml-parser",
         "minimatch": "10.2.4"
     }
-}
\ No newline at end of file
+}