chore(deps): bump fast-xml-parser from 5.3.6 to 5.4.1 (#7796)

* chore(deps): bump fast-xml-parser from 5.3.6 to 5.4.1

Resolves CVE-2026-27942

* chore(xml-builder): increase max nested tags depth for this bump

* chore(xml-builder): increase maxNestedTags to 1024 for test compatibility

* chore: trigger CI

* chore: trigger CI

---------

Co-authored-by: Siddharth Srivastava <sidddsri@amazon.com>

Author: orien

packages-internal/xml-builder/package.json

@@ -4,7 +4,7 @@
   "description": "XML utilities for the AWS SDK",
   "dependencies": {
     "@smithy/types": "^4.13.0",
-    "fast-xml-parser": "5.3.6",
+    "fast-xml-parser": "5.4.1",
     "tslib": "^2.6.2"
   },
   "scripts": {

packages-internal/xml-builder/src/xml-parser.ts

@@ -8,6 +8,7 @@ const parser = new XMLParser({
   parseTagValue: false,
   trimValues: false,
   tagValueProcessor: (_: any, val: any) => (val.trim() === "" && val.includes("\n") ? "" : undefined),
+  maxNestedTags: 1024,
 });
 parser.addEntity("#xD", "\r");
 parser.addEntity("#10", "\n");

private/aws-protocoltests-restxml-schema/package.json

@@ -62,7 +62,7 @@
     "@smithy/util-stream": "^4.5.15",
     "@smithy/util-utf8": "^4.2.1",
     "entities": "2.2.0",
-    "fast-xml-parser": "5.3.6",
+    "fast-xml-parser": "5.4.1",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

private/aws-protocoltests-restxml/package.json

@@ -64,7 +64,7 @@
     "@smithy/util-utf8": "^4.2.1",
     "@smithy/uuid": "^1.1.1",
     "entities": "2.2.0",
-    "fast-xml-parser": "5.3.6",
+    "fast-xml-parser": "5.4.1",
     "tslib": "^2.6.2"
   },
   "devDependencies": {

yarn.lock

@@ -1176,7 +1176,7 @@ __metadata:
     concurrently: "npm:7.0.0"
     downlevel-dts: "npm:0.10.1"
     entities: "npm:2.2.0"
-    fast-xml-parser: "npm:5.3.6"
+    fast-xml-parser: "npm:5.4.1"
     premove: "npm:4.0.0"
     tslib: "npm:^2.6.2"
     typescript: "npm:~5.8.3"
@@ -1236,7 +1236,7 @@ __metadata:
     concurrently: "npm:7.0.0"
     downlevel-dts: "npm:0.10.1"
     entities: "npm:2.2.0"
-    fast-xml-parser: "npm:5.3.6"
+    fast-xml-parser: "npm:5.4.1"
     premove: "npm:4.0.0"
     tslib: "npm:^2.6.2"
     typescript: "npm:~5.8.3"
@@ -24963,7 +24963,7 @@ __metadata:
     "@tsconfig/recommended": "npm:1.0.1"
     concurrently: "npm:7.0.0"
     downlevel-dts: "npm:0.10.1"
-    fast-xml-parser: "npm:5.3.6"
+    fast-xml-parser: "npm:5.4.1"
     premove: "npm:4.0.0"
     tslib: "npm:^2.6.2"
     typescript: "npm:~5.8.3"
@@ -34033,14 +34033,22 @@ __metadata:
   languageName: node
   linkType: hard
 
-"fast-xml-parser@npm:5.3.6":
-  version: 5.3.6
-  resolution: "fast-xml-parser@npm:5.3.6"
+"fast-xml-builder@npm:^1.0.0":
+  version: 1.0.0
+  resolution: "fast-xml-builder@npm:1.0.0"
+  checksum: 10c0/2631fda265c81e8008884d08944eeed4e284430116faa5b8b7a43a3602af367223b7bf01c933215c9ad2358b8666e45041bc038d64877156a2f88821841b3014
+  languageName: node
+  linkType: hard
+
+"fast-xml-parser@npm:5.4.1":
+  version: 5.4.1
+  resolution: "fast-xml-parser@npm:5.4.1"
   dependencies:
+    fast-xml-builder: "npm:^1.0.0"
     strnum: "npm:^2.1.2"
   bin:
     fxparser: src/cli/cli.js
-  checksum: 10c0/0150cc0566f327a76115de8b11628d717fb179010ed9bb77c52e579a7e6055a0f92f42f83678a6f1ec5b74411faec09713cb1f9b94bc687068ad86884a9199fa
+  checksum: 10c0/8c696438a0c64135faf93ea6a93879208d649b7c9a3293d30d6eb750dc7f766fd083c0df5a82786b60809c3ead64fad155f28dbed25efea91017aaf9f64c91e5
   languageName: node
   linkType: hard