chore(deps-dev): bump fast-xml-parser from 5.9.3 to 5.10.1 in /frontend/webcoder_ui

[dependabot]

Bumps fast-xml-parser from 5.9.3 to 5.10.1.

Release notes

Sourced from fast-xml-parser's releases.

v5.10.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

• Bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#849
• Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#848

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.10.1 / 2026-07-17

• fix: multiple DOCTYPE declarations.
• deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix
  • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

• update strnum

*5.9.2 / 2026-06-17

• dummy release to test changes in github action

*5.9.1 / 2026-06-17

• dummy release to test release from github action

*5.9.0 / 2026-06-15

• update strnum to 2.3.0
  • you can set hex, binary, enotation, infinity, unicode
• validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

• integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
  • This will consider xml-version as well. '1.0' is default
• update strnum to 2.3.0
  • You can set octal and binary parsing which is bydeault off
• update fast-xml-builder to 1.2.0
  • can sanitize tag names if found invalid
  • fix format output

5.7.3 / 2006-05-05

• fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
• fix stop node expression when ns prefix is removed (found by iruizsalinas)
• update XML Builder to 1.1.7
• mark addEntity deprecated

5.7.2 / 2026-04-25

• allow numerical external entity for backward compatibility

... (truncated)

Commits

• 2ce7191 5.10.1
• 4e1bb01 update for release
• ffd1269 deps: @​nodable/entities for treeshaking
• 4e546e0 fix: multiple DOCTYPE are not allowed
• 296b332 5.10.0
• 75f7565 update package guide
• 2d8d1d0 update details
• e58e4dd upgrade: xml-naming v0.3.0, PEM v1.6.2, is-unsafe v2.0.0
• 545e491 Bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 (#848)
• 5ea8aa1 Bump actions/checkout from 6.0.3 to 7.0.0 (#849)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Labels

The following labels could not be found: area:ci, type:chore. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.

[Prekzursil]

PR-specific note (#101). Unique content: fast-xml-parser 5.9.3->5.10.1 (GHSA-8r6m-32jq-jx6q), plus transitive @nodable/entities 2.2.0->3.0.0 and is-unsafe ^1.0.1->^2.0.0. Not superseded by any sibling.

---

Diagnosis: left OPEN. This PR is unique and still wanted, but it is blocked by two repo-level defects on main, neither of which this PR causes or can fix.

Blocker 1 — the required quality / quality check cannot pass for any PR.
It fails at step 20, gate-deps osv-scanner. osv-scanner exits 1 on ANY finding,
so the gate is all-or-nothing. Measured locally against a clean clone of main
(osv-scanner 2.3.8, the same version CI pins):

Total 17 packages affected by 25 known vulnerabilities
  (1 Critical, 14 High, 9 Medium, 1 Low) from 2 ecosystems

That set is NOT closable by bounded-floor bumps, so it is an owner call:

• react-router / react-router-dom 6.30.4 — GHSA-jjmj-jmhj-qwj2 has no
  patched 6.x at all. The advisory records introduced 6.30.2 / last_affected 6.30.4 for react-router-dom, and the fix lands only in
  react-router 7.13.0. Clearing it therefore requires a react-router v6 -> v7
  major migration, which is a runtime-dependency change with real app impact,
  not a dependency-hygiene bump.
• svgo 1.3.2 -> 2.8.3 and brace-expansion -> 5.0.8 are also cross-major.
  Note that forcing brace-expansion 5.x is NOT safe here on its own: 5.x
  exports { EXPANSION_MAX, EXPANSION_MAX_LENGTH, expand } with no callable
  module and no default export, while minimatch 3.x/9.x call the module
  directly — measured TypeError: expand is not a function. The consumer has to
  move up (glob/minimatch), not the dependency down.

Blocker 2 — npm ci is broken on main, so verify fails independently.
Reproduced locally on a clean clone of main with no PR applied:

npm error code EUSAGE
npm error Invalid: lock file's ws@7.5.11 does not satisfy ws@7.5.13
npm error `npm ci` can only install packages when your package.json and
npm error package-lock.json ... are in sync.

frontend/webcoder_ui/package.json overrides ws to ^7.5.11; since the lock
was written, 7.5.13 published, so the resolved ideal tree wants 7.5.13 while the
lock still pins 7.5.11. This is a pre-existing main defect (a caret override
drifting), not anything this PR did, and it blocks verify on every PR in the
repo. Fix is a lockfile refresh (npm install in frontend/webcoder_ui)
committed to main.

Note main's last recorded green quality run is 477b7ae from 2026-06-27, which
predates all 25 of these advisories — so main is stale-green, not actually green.

No action taken on this PR beyond this comment: it carries a real, unique change
and should survive.