fix(deps): migrate vendored dav lib from xmldom to @xmldom/xmldom#775
Merged
Conversation
The vendored WebDAV/CalDAV/CardDAV client under js/dav bundled the
abandoned `xmldom` package (0.1.x), which carries a critical and several
high-severity advisories with no fix available on that release line
(vulnerable range <= 0.6.0, patched: none). The package was renamed to
`@xmldom/xmldom`; migrate to it (^0.8.13) to clear the advisories.
Changes:
- js/dav/lib/parser.js: require('@xmldom/xmldom') instead of 'xmldom'.
The DOMParser().parseFromString(str, 'text/xml') API is unchanged.
- js/dav/package.json: swap the dependency.
- js/dav/lib/debug.js: export via module.exports so the mixed ESM/CJS
sources bundle cleanly under a modern bundler (the original
browserify 11 / babel 5 toolchain no longer installs). No behaviour
change — debug(topic)(message) is preserved.
- js/dav/dav.js: regenerated browser bundle. Rebuilt with esbuild;
the exported `dav` API surface is byte-verified identical to the
previous bundle (36 exports, version 1.8.0) and the parser round-trips
a CalDAV/CardDAV multistatus document.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Signed-off-by: Thomas Müller <[email protected]>
phil-davis
approved these changes
Jul 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Migrate the vendored WebDAV/CalDAV/CardDAV client (
js/dav) from the abandonedxmldompackage to its maintained successor@xmldom/xmldom(^0.8.13).Why
[email protected]carries 1 critical + 5 high Dependabot advisories on theruntime dependency, all with no patch available on the
xmldomline(vulnerable range
<= 0.6.0,first_patched_version: none). The project wasrenamed to
@xmldom/xmldom, where these are fixed. This clears the runtimesecurity alerts blocking the app for the ownCloud 11 release.
Changes
js/dav/lib/parser.js—require('@xmldom/xmldom')instead of'xmldom'.The only usage is
new DOMParser().parseFromString(str, 'text/xml'), whoseAPI is identical across both packages.
js/dav/package.json— swap the dependency (@xmldom/xmldom ^0.8.13).js/dav/lib/debug.js— export viamodule.exports(wasexport default)so the module resolves under a modern bundler. Behaviour is unchanged
(
debug(topic)(message)); all sevenrequire('./debug')call sites and theone
import debug from './debug'continue to work.js/dav/dav.js— regenerated browser bundle.Note on the bundle rebuild
dav.jsis a prebuilt browser bundle. The original toolchain(
browserify@11/babel@5, ~2015) no longer installs on current npm, so thebundle was rebuilt with esbuild (IIFE, global
dav, browser platform).Verification performed:
davAPI is identical to the previous bundle — 36 exports,version 1.8.0(diffed programmatically).@xmldom/xmldomround-trips a CalDAV/CardDAVmultistatusdocument throughthe
parser.jscode path.require('xmldom')remains in the shipped bundle.The large
dav.jsdiff is entirely the regenerated bundle; the reviewablechange is the three source files above.