Address Security vulnerability #228

[g1rly-c0d3r]

Fixes #8325

https://github.com/specify/specify7/security/dependabot/228

Checklist

• Self-review the PR after opening it to make sure the changes look good and
  self-explanatory (or properly documented)
• Add relevant issue to release milestone

Testing instructions

• Light general testing
  • This PR updates a dependency related to localization, so test to make sure that no labels break anywhere.

Summary by CodeRabbit

• Chores
  • Added an XML-building development dependency to support project tooling.

[github-actions]

Warning

One or more dependencies are approaching or past End-of-Life.
Please plan upgrades accordingly.

STATUS=WARNING
NODE_VERSION=20
NODE_CYCLE=20
EOL_DATE=2026-04-30
DAYS_REMAINING=-82

--- Node.js ---
Version: 20
EOL: 2026-04-30
Status: WARNING

STATUS=OK
PYTHON_VERSION=3.12
PYTHON_CYCLE=3.12
EOL_DATE=2028-10-31
DAYS_REMAINING=833

--- Python ---
Version: 3.12
EOL: 2028-10-31
Status: OK

STATUS=WARNING
DJANGO_VERSION=4.2
DJANGO_CYCLE=4.2
EOL_DATE=2026-04-07
DAYS_REMAINING=-105

--- Django ---
Version: 4.2
EOL: 2026-04-07
Status: WARNING

[coderabbitai]

📝 Walkthrough

Walkthrough

The frontend package manifest adds fast-xml-builder version ^1.3.0 to its development dependencies without changing other shown fields.

Changes

Frontend dependency update

Layer / File(s)	Summary
Add XML builder dependency specifyweb/frontend/js_src/package.json	Adds fast-xml-builder version ^1.3.0 to devDependencies.

🚥 Pre-merge checks | ✅ 4 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Testing Instructions	⚠️ Warning	The testing note is too generic; the change hits schema-localization XML parsing/building, but the instructions only ask for broad label smoke-testing.	Add explicit localization/schema-localization checks, e.g. npm run localizationTests and the relevant Weblate/schema localization validation flow.
Linked Issues check	❓ Inconclusive	The dependency bump is relevant, but the excluded package-lock prevents confirming the resolved fixed version.	Check specifyweb/frontend/js_src/package-lock.json (filtered by !**/package-lock.json) to verify fast-xml-builder resolves to a fixed version >=1.1.7.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	Only a dependency update is shown, and it is directly tied to the security fix.
Automatic Tests	✅ Passed	PASS: The PR only changes package.json and package-lock.json, so no new automatic tests are necessary for this manifest-only dependency bump.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the PR's purpose of addressing security vulnerability #228.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch issue-8325

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}