[Snyk] Security upgrade @xmldom/xmldom from 0.8.15 to 0.9.12

[chelojimenez]

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• mcpjam-inspector/package.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Regular Expression Denial of Service (ReDoS) SNYK-JS-XMLDOMXMLDOM-19498551

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

---

Note

Medium Risk
Single dependency bump across a minor major line (0.8→0.9) for a parser used on the server; low code churn but possible parsing/API behavior changes where XML is handled.

Overview
Bumps @xmldom/xmldom in mcpjam-inspector/package.json from the 0.8.x range to ^0.9.12, a Snyk-driven security fix for a high-severity ReDoS issue (SNYK-JS-XMLDOMXMLDOM-19498551).

There are no application code changes—only the declared dependency version. The package remains part of the server bundle externals (alongside xml-crypto), so runtime XML parsing behavior may change with the new release; smoke-testing XML/SAML or crypto-related flows is worthwhile after install.

^{Reviewed by Cursor Bugbot for commit 230276d. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Summary by cubic

Updates @xmldom/xmldom from 0.8.15 to 0.9.12 to address a high-severity Regular Expression Denial of Service vulnerability.

• No application code or migration steps are required.

^{Written for commit 230276d. Summary will update on new commits.}

[chelojimenez]

The upgrade of @xmldom/xmldom from version 0.8.15 to 0.9.12 introduces significant breaking changes that require code modifications.

Key Breaking Changes:

• Mandatory mimeType: The mimeType argument in DOMParser.parseFromString(xml, mimeType) is now mandatory. The library no longer automatically detects whether to apply XML or HTML parsing rules based on namespaces. You must explicitly provide a mimeType like 'text/xml' or 'text/html'.

• Stricter Error Handling: The parser is much stricter and will now throw a ParseError for non-well-formed XML that might have been silently accepted in previous versions. Code that relied on lenient parsing of invalid documents is likely to break.

• HTML Parsing Behavior: Support for automatic self-closing tags in HTML has been removed. If you were parsing HTML, you need to verify that your documents are well-formed according to the new, stricter rules.

• removeChild API: The removeChild API has been updated to align with specifications and may now throw a DOMException in cases where it previously did not.

Recommendation:
Before merging, review all usages of DOMParser.parseFromString and ensure a mimeType is explicitly provided. Thoroughly test your application's XML and HTML parsing functionality, paying close attention to error handling, as documents that were previously parsed successfully may now cause exceptions.

Source: Release notes

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d05e0a35-6cd4-4271-a322-f348f426d11f)

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[github-actions]

Internal preview

Preview URL will appear in Railway after the deploy finishes.
Deployed commit: cda3403
PR head commit: 230276d
Backend target: staging fallback.
Access is employee-only in non-production environments.

[cubic-dev-ai]

2 issues found across 1 file

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="mcpjam-inspector/package.json">

<violation number="1" location="mcpjam-inspector/package.json:151">
P1: Clean workspace installs now fail because the root lockfile still resolves `@xmldom/xmldom` to 0.8.13 and has no 0.9.12 entry. Regenerate and commit the root `package-lock.json` with this dependency bump.</violation>

<violation number="2" location="mcpjam-inspector/package.json:151">
P1: This direct bump does not remove the vulnerable 0.8.x parser from the workspace: `sdk` and `xml-crypto` still require incompatible 0.8.x ranges, forcing npm to install an older copy as well. Upgrade or override every consumer of `@xmldom/xmldom` (including `xml-crypto`), then regenerate the lockfile so the vulnerable version is absent.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Clean workspace installs now fail because the root lockfile still resolves @xmldom/xmldom to 0.8.13 and has no 0.9.12 entry. Regenerate and commit the root package-lock.json with this dependency bump.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At mcpjam-inspector/package.json, line 151:

<comment>Clean workspace installs now fail because the root lockfile still resolves `@xmldom/xmldom` to 0.8.13 and has no 0.9.12 entry. Regenerate and commit the root `package-lock.json` with this dependency bump.</comment>

<file context>
@@ -148,7 +148,7 @@
     "@workos-inc/authkit-react": "^0.12.0",
     "@workos-inc/node": "^10.2.0",
-    "@xmldom/xmldom": "^0.8.13",
+    "@xmldom/xmldom": "^0.9.12",
     "@xterm/addon-clipboard": "^0.2.0",
     "@xterm/addon-fit": "^0.11.0",
</file context>

[cubic-dev-ai]

P1: This direct bump does not remove the vulnerable 0.8.x parser from the workspace: sdk and xml-crypto still require incompatible 0.8.x ranges, forcing npm to install an older copy as well. Upgrade or override every consumer of @xmldom/xmldom (including xml-crypto), then regenerate the lockfile so the vulnerable version is absent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At mcpjam-inspector/package.json, line 151:

<comment>This direct bump does not remove the vulnerable 0.8.x parser from the workspace: `sdk` and `xml-crypto` still require incompatible 0.8.x ranges, forcing npm to install an older copy as well. Upgrade or override every consumer of `@xmldom/xmldom` (including `xml-crypto`), then regenerate the lockfile so the vulnerable version is absent.</comment>

<file context>
@@ -148,7 +148,7 @@
     "@workos-inc/authkit-react": "^0.12.0",
     "@workos-inc/node": "^10.2.0",
-    "@xmldom/xmldom": "^0.8.13",
+    "@xmldom/xmldom": "^0.9.12",
     "@xterm/addon-clipboard": "^0.2.0",
     "@xterm/addon-fit": "^0.11.0",
</file context>