Skip to content

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 18, 2025

Bumps xml-crypto to 6.1.2 and updates ancestor dependency soap. These dependencies need to be updated together.

Updates xml-crypto from 1.5.6 to 6.1.2

Release notes

Sourced from xml-crypto's releases.

v6.1.2

  • Remove all reference XML data if any are corrupted (#502) (cac1c8d)

v6.1.1

  • Adjust deprecation to better reflect real-world usage (#499) (ab1c69e)

v6.1.0

  • Introduce new .getSignedReferences() function of signature to help prevent signature wrapping attacks (#489) (badaf20)

v6.0.1

  • Merge commit from fork (8ac6118)

This addresses two critical CVE:

v6.0.0

  • Bump github/codeql-action from 2 to 3 (#434) (627d83f)
  • Set getCertFromKeyInfo to noop (#445) (2120172)
  • Chore: Update README.md (#432) (f8cbbb7)

v5.1.1

  • fix: template literal (#443) (1ceedc8)

v5.1.0

  • Bump @​typescript-eslint/parser from 6.13.0 to 6.18.1 (#442) (ecbedd9)
  • Bump @​typescript-eslint/eslint-plugin from 6.13.0 to 6.18.1 (#441) (9eb9002)
  • Bump follow-redirects from 1.15.3 to 1.15.4 (#440) (6f363ab)
  • Bump eslint from 8.54.0 to 8.56.0 (#436) (bf163dd)
  • Bump @​types/node from 16.18.65 to 16.18.69 (#435) (4f98697)
  • Bump release-it from 16.2.1 to 16.3.0 (#428) (4d3711a)
  • Enhance derToPem to support XML pretty-print (#439) (6e95c60)

v5.0.0

  • Bump @​typescript-eslint/eslint-plugin from 5.62.0 to 6.13.0 (#422) (66d887b)
  • Bump @​prettier/plugin-xml from 3.2.1 to 3.2.2 (#423) (7410d2e)
  • Bump @​types/mocha from 10.0.2 to 10.0.6 (#421) (36bcf0e)
  • Bump @​types/chai from 4.3.6 to 4.3.11 (#419) (ef513da)
  • Bump prettier from 3.0.3 to 3.1.0 (#418) (09176a5)
  • Bump typescript from 5.2.2 to 5.3.2 (#415) (f3da589)
  • Bump eslint from 8.51.0 to 8.54.0 (#414) (b7c90f5)
  • Bump actions/setup-node from 3 to 4 (#413) (9602607)
  • Bump @​babel/traverse from 7.22.4 to 7.23.2 (#407) (552a6d6)
  • Bump actions/checkout from 3 to 4 (#392) (7ad9a5f)
  • Bump eslint-plugin-deprecation from 1.4.1 to 2.0.0 (#390) (0f11269)
  • Bump typescript from 5.1.6 to 5.2.2 (#383) (8cf4966)
  • Bump eslint-config-prettier from 8.8.0 to 9.0.0 (#381) (9584e48)
  • Mark getKeyInfo() private as it has no public consumers (#412) (1099f59)
  • Remove the default for getKeyInfoContent forcing a consumer to choose (#411) (468d674)

... (truncated)

Changelog

Sourced from xml-crypto's changelog.

6.1.2 (2025-04-24)

🐛 Bug Fixes

  • [bug] [security] Remove all reference XML data if any are corrupted #502

v6.1.1 (2025-04-21)

🚀 Minor Changes

  • [enhancement] Adjust deprecation to better reflect real-world usage #499

v6.1.0 (2025-04-09)

🚀 Minor Changes

  • [enhancement] Introduce new .getSignedReferences() function of signature to help prevent signature wrapping attacks #489

v6.0.1 (2025-03-14)


v6.0.0 (2024-01-26)

💣 Major Changes

  • [breaking-change] Set getCertFromKeyInfo to noop #445

🔗 Dependencies

  • [dependencies] [github_actions] Bump github/codeql-action from 2 to 3 #434

📚 Documentation

  • [documentation] Chore: Update README.md #432

v5.1.1 (2024-01-17)

🐛 Bug Fixes

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by cjbarth, a new releaser for xml-crypto since your current version.


Updates soap from 0.31.0 to 1.4.1

Release notes

Sourced from soap's releases.

Version 1.4.1

  • [MAINTENANCE] Bump axios to 1.12.2 (#1350)

Version 1.4.0

  • [FIX] Fix harcoded namespace prefixes in parsing (#1347)
  • [ENHANCEMENT] Convert ref attributes to list (#1168)
  • [ENHANCEMENT] Add option overrideElementKey to change the key of the wsdl (#1334)
  • [ENHANCEMENT] Enable async methods for postProcess (#1338)
  • [MAINTENANCE] Bump actions/checkout from 4 to 5 (#1340)
  • [MAINTENANCE] Tune dependabot deps scheduling and updates (#1345)

Version 1.3.0

  • [ENHANCEMENT] Speed up parsing with many namespaces (#1322)
  • [ENHANCEMENT] Add *.ts to editorconfig (#1324)
  • [ENHANCEMENT] Call method using apply to enable access to it through "this" context (#1315)
  • [ENHANCEMENT] Handle deeply nested messages (#1313)
  • [ENHANCEMENT] Add test for redefined namespace in element (#1316)
  • [MAINTENANCE] Bump express from 4.21.2 to 5.1.0 (#1327)
  • [MAINTENANCE] Bump diff from 7.0.0 to 8.0.2 (#1326)
  • [MAINTENANCE] Bump sinon from 20.0.0 to 21.0.0 (#1321)
  • [MAINTENANCE] Bump @​types/lodash from 4.17.16 to 4.17.20 (#1320)
  • [MAINTENANCE] Bump mocha from 11.1.0 to 11.7.1 (#1319)
  • [MAINTENANCE] Bump body-parser from 1.20.3 to 2.2.0 (#1317)
  • [DOC] Update Readme to improve header

Version 1.2.1

  • [MAINTENANCE] Bump axios to 1.11.0 (#1314)

Version 1.2.0

  • [ENHANCEMENT] Remove hardcoded ID in timestamp (#1290)
  • [ENHANCEMENT] Allows SchemaElement instance to use import namespace as targetNamespace (#1296)
  • [ENHANCEMENT] Add optional parameter for response data encoding (#1303)
  • [MAINTENANCE] Bump axios to 1.10.0 and other minor deps (#1312)
  • [MAINTENANCE] Bump serve-static from 1.16.2 to 2.2.0 (#1308)
  • [MAINTENANCE] Bump semver from 7.7.1 to 7.7.2 (#1310)
  • [MAINTENANCE] Add dependabot workflow for deps and actions (#1301)

Version 1.1.12

  • [ENHANCEMENT] Add optional excludeReferencesFromSigning property to exclude elements (e.g., Body, Timestamp) from SOAP message signing (#1288)
  • [MAINTENANCE] Bump deps axios 1.9.0, debug 4.4.1, formidable 3.5.4 and xml-crypto 6.1.2

Version 1.1.11

  • [ENHANCEMENT] Allow xml key in first level for rpc (#1219)
  • [ENHANCEMENT] Do not set Connection header when forever is not set (#1259)
  • [MAINTENANCE] Packages updates, tsconfig changes, fix test path on Windows (#1280)
  • [MAINTENANCE] Bump xml-crypto to 6.1.1 (#1283)

Version 1.1.10

  • [MAINTENANCE] Update axios to 1.8.3, xml-crypto to 6.0.1 and some other deps to address security issues

... (truncated)

Changelog

Sourced from soap's changelog.

1.4.1 / 2025-09-15

  • [MAINTENANCE] Bump axios to 1.12.2 (#1350)

1.4.0 / 2025-09-15

  • [FIX] Fix harcoded namespace prefixes in parsing (#1347)
  • [ENHANCEMENT] Convert ref attributes to list (#1168)
  • [ENHANCEMENT] Add option overrideElementKey to change the key of the wsdl (#1334)
  • [ENHANCEMENT] Enable async methods for postProcess (#1338)
  • [MAINTENANCE] Bump actions/checkout from 4 to 5 (#1340)
  • [MAINTENANCE] Tune dependabot deps scheduling and updates (#1345)

1.3.0 / 2025-08-13

  • [ENHANCEMENT] Speed up parsing with many namespaces (#1322)
  • [ENHANCEMENT] Add *.ts to editorconfig (#1324)
  • [ENHANCEMENT] Call method using apply to enable access to it through "this" context (#1315)
  • [ENHANCEMENT] Handle deeply nested messages (#1313)
  • [ENHANCEMENT] Add test for redefined namespace in element (#1316)
  • [MAINTENANCE] Bump express from 4.21.2 to 5.1.0 (#1327)
  • [MAINTENANCE] Bump diff from 7.0.0 to 8.0.2 (#1326)
  • [MAINTENANCE] Bump sinon from 20.0.0 to 21.0.0 (#1321)
  • [MAINTENANCE] Bump @​types/lodash from 4.17.16 to 4.17.20 (#1320)
  • [MAINTENANCE] Bump mocha from 11.1.0 to 11.7.1 (#1319)
  • [MAINTENANCE] Bump body-parser from 1.20.3 to 2.2.0 (#1317)
  • [DOC] Update Readme to improve header

1.2.1 / 2025-07-24

  • [MAINTENANCE] Bump axios to 1.11.0 (#1314)

1.2.0 / 2025-07-22

  • [ENHANCEMENT] Remove hardcoded ID in timestamp (#1290)
  • [ENHANCEMENT] Allows SchemaElement instance to use import namespace as targetNamespace (#1296)
  • [ENHANCEMENT] Add optional parameter for response data encoding (#1303)
  • [MAINTENANCE] Bump axios to 1.10.0 and other minor deps (#1312)
  • [MAINTENANCE] Bump serve-static from 1.16.2 to 2.2.0 (#1308)
  • [MAINTENANCE] Bump semver from 7.7.1 to 7.7.2 (#1310)
  • [MAINTENANCE] Add dependabot workflow for deps and actions (#1301)

1.1.12 / 2025-06-01

  • [ENHANCEMENT] Add optional excludeReferencesFromSigning property to exclude elements (e.g., Body, Timestamp) from SOAP message signing (#1288)
  • [MAINTENANCE] Bump deps axios 1.9.0, debug 4.4.1, formidable 3.5.4 and xml-crypto 6.1.2

1.1.11 / 2025-04-22

  • [ENHANCEMENT] Allow xml key in first level for rpc (#1219)

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by vasily.martynov, a new releaser for soap since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [xml-crypto](https://github.com/node-saml/xml-crypto) to 6.1.2 and updates ancestor dependency [soap](https://github.com/vpulim/node-soap). These dependencies need to be updated together.


Updates `xml-crypto` from 1.5.6 to 6.1.2
- [Release notes](https://github.com/node-saml/xml-crypto/releases)
- [Changelog](https://github.com/node-saml/xml-crypto/blob/v6.1.2/CHANGELOG.md)
- [Commits](node-saml/xml-crypto@v1.5.6...v6.1.2)

Updates `soap` from 0.31.0 to 1.4.1
- [Release notes](https://github.com/vpulim/node-soap/releases)
- [Changelog](https://github.com/vpulim/node-soap/blob/master/History.md)
- [Commits](vpulim/node-soap@v0.31.0...v1.4.1)

---
updated-dependencies:
- dependency-name: xml-crypto
  dependency-version: 6.1.2
  dependency-type: indirect
- dependency-name: soap
  dependency-version: 1.4.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 18, 2025
@dependabot dependabot bot mentioned this pull request Sep 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant