[Snyk] Upgrade xml2js from 0.4.23 to 0.6.0

[PeterRao]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade xml2js from 0.4.23 to 0.6.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 2 versions ahead of your current version.
• The recommended version was released 2 months ago, on 2023-05-25.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-XML2JS-5414874	586/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 5.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: xml2js

• 0.6.0 - 2023-05-25
  

  Release new version

• 0.5.0 - 2023-04-09
  

  Update package.json with latest PR

• 0.4.23 - 2019-12-19

from xml2js GitHub release notes

Commit messages

Package name: xml2js

• 0e29f0e Release new version
• a25035c Remove old unused files
• 1de4688 Merge pull request 使用ali-oss+elment upload上传超大文件，chrome浏览器崩溃，而其他浏览器能正常上传的问题 #680 from Leonidas-from-XIV/zap-dependency-fix
• 3b97ae5 Merge pull request 特殊命名文件名签名冲突 #681 from Leonidas-from-XIV/cve-compat-fix
• 167a385 Fix zap to be the original dependency
• 5f6620f Compile changed coffeescript code
• 044cfe5 Undo API changes from IOS手机QQ浏览器上传超时 #603
• 7292aa9 fix: include missed key check
• 4c8ec89 fix: revert incorrectly adapted code
• ad3a297 refactor: extract function for key check
• d486007 fix: explicitly ignore vulnerable properties
• 246252a chore: revert previous CVE fix
• b856cb8 Add upper bound for coffeescript (for now)
• bd0f780 Bump dependency versions to fix security issues
• 3a8d46e Update lockfile
• 9f730bb Update package.json with latest PR
• 50a492a Merge pull request IOS手机QQ浏览器上传超时 #603 from autopulated/master
• 7bc3c5d Merge pull request 请问如何实现批量下载并且打包成一个zip #598 from fnimick/master
• f412a12 Merge pull request FEAT:add putTagging,getTagging and deleteTagging api #635 from wisesimpson/patch-1
• d318ce0 Update README.md
• 581b19a use Object.create(null) to create all parsed objects (prevent prototype replacement)
• a212950 Add documentation for `explicitCharkey` option
• 1832e0b Merge pull request STS token过期自动刷新怎么玩？ #512 from economia/master
• 198063c Merge pull request Add LGTM code quality badges #556 from Omega-Ariston/fix-issue544

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs