build(deps): bump @xmldom/xmldom, @hpcc-js/util and @hpcc-js/comms in /esp/src

[dependabot]

Bumps @xmldom/xmldom to 0.9.10 and updates ancestor dependencies @xmldom/xmldom, @hpcc-js/util and @hpcc-js/comms. These dependencies need to be updated together.

Updates @xmldom/xmldom from 0.9.9 to 0.9.10

Release notes

Sourced from @​xmldom/xmldom's releases.

0.9.10

Commits

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
  • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
• isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

• The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

• updated dependencies

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.9.10

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option. When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -- anywhere, ends with -, or contains characters outside the XML Char production
  • ProcessingInstruction: throws when target contains : or matches xml (case-insensitive), or data contains characters outside the XML Char production or contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById(), Node.prototype.isEqualNode()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw
• isEqualNode now correctly returns false for CDATASection nodes with different data

Deprecated

• The splitCDATASections serializer option is deprecated and will be removed in the next breaking release. The automatic splitting of "]]>" in CDATASection data was introduced as a workaround; use requireWellFormed: true or ensure CDATASection data does not contain "]]>" before serialization.

Chore

• updated dependencies

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.13

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

Commits

• bf396a5 0.9.10
• 78f6089 test: add missing serializer coverage for nodeFilter string return, Attribute...
• 192ce5b ci: remove unused imports flagged by CodeQL
• ca81c06 test: lower stack size for tests
• c9d5937 style: npm run format
• 1537fb4 docs: add 0.9.10 changelog entry
• afd6f6f docs: add 0.8.13 changelog entry
• afeb4ee refactor: align error mesage between branches
• 4845ef1 fix: prevent stack overflow in isEqualNode (GHSA-2v35-w6hq-6mfw)
• dfb94a4 test: add missing isEqualNode behavioral coverage
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.

Updates @hpcc-js/util from 3.5.5 to 3.5.6

Release notes

Sourced from @​hpcc-js/util's releases.

composite: v3.5.6

3.5.6 (2026-04-07)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​hpcc-js/api bumped from ^3.4.15 to ^3.4.16
    • @​hpcc-js/chart bumped from ^3.7.4 to ^3.7.5
    • @​hpcc-js/common bumped from ^3.7.5 to ^3.7.6
    • @​hpcc-js/dgrid bumped from ^3.7.5 to ^3.7.6
    • @​hpcc-js/form bumped from ^3.4.4 to ^3.4.5
    • @​hpcc-js/html bumped from ^3.3.15 to ^3.3.16
    • @​hpcc-js/other bumped from ^3.5.4 to ^3.5.5
    • @​hpcc-js/phosphor bumped from ^3.5.4 to ^3.5.5
    • @​hpcc-js/util bumped from ^3.5.4 to ^3.5.5

map: v3.5.6

3.5.6 (2026-05-01)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​hpcc-js/api bumped from ^3.4.16 to ^3.4.17
    • @​hpcc-js/common bumped from ^3.7.6 to ^3.7.7
    • @​hpcc-js/graph bumped from ^3.7.5 to ^3.7.6
    • @​hpcc-js/layout bumped from ^3.5.11 to ^3.5.12
    • @​hpcc-js/other bumped from ^3.5.5 to ^3.5.6
    • @​hpcc-js/util bumped from ^3.5.5 to ^3.5.6
  • devDependencies
    • @​hpcc-js/esbuild-plugins bumped from ^1.8.7 to ^1.8.8

other: v3.5.6

3.5.6 (2026-05-01)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​hpcc-js/api bumped from ^3.4.16 to ^3.4.17
    • @​hpcc-js/common bumped from ^3.7.6 to ^3.7.7
    • @​hpcc-js/layout bumped from ^3.5.11 to ^3.5.12
  • devDependencies
    • @​hpcc-js/esbuild-plugins bumped from ^1.8.7 to ^1.8.8

util: v3.5.6

... (truncated)

Commits

• 630e839 chore: release main (#4588)
• 6bddfc8 fix(comms): regen ws_machine service (#4583)
• fa29fcb fix: bump versions (security) (#4587)
• 5fcd2df chore: release main (#4582)
• 322598f chore: add marshaller package to release-please configuration and manifest
• 080f70e chore(comms): bump the WsWorkunits service to v2.08 (#4580)
• f80b73b chore(comms): bump the FileSpray service to v1.29 (#4573)
• ddca2ce feat: port marshaller from 2.x.x to 3.x.x (#4579)
• 928afd7 chore: bump ESLint to latest version and fix new issues (#4576)
• 9264de0 fix: update axios version to 1.15.0 in package.json overrides (#4578)
• Additional commits viewable in compare view

Updates @hpcc-js/comms from 3.15.5 to 3.15.7

Release notes

Sourced from @​hpcc-js/comms's releases.

comms: v3.15.7

3.15.7 (2026-05-01)

Bug Fixes

• bump versions (security) (#4587) (fa29fcb)
• comms: regen ws_machine service (#4583) (6bddfc8)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​hpcc-js/util bumped from ^3.5.5 to ^3.5.6
  • devDependencies
    • @​hpcc-js/ddl-shim bumped from ^3.3.5 to ^3.3.6
    • @​hpcc-js/esbuild-plugins bumped from ^1.8.7 to ^1.8.8

comms: v3.15.6

3.15.6 (2026-04-08)

Bug Fixes

• comms: refactor wsdl generation to use minOccurs (#4548) (4c96517)

Commits

• 630e839 chore: release main (#4588)
• 6bddfc8 fix(comms): regen ws_machine service (#4583)
• fa29fcb fix: bump versions (security) (#4587)
• 5fcd2df chore: release main (#4582)
• 322598f chore: add marshaller package to release-please configuration and manifest
• 080f70e chore(comms): bump the WsWorkunits service to v2.08 (#4580)
• f80b73b chore(comms): bump the FileSpray service to v1.29 (#4573)
• ddca2ce feat: port marshaller from 2.x.x to 3.x.x (#4579)
• 928afd7 chore: bump ESLint to latest version and fix new issues (#4576)
• 9264de0 fix: update axios version to 1.15.0 in package.json overrides (#4578)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.