chore: Update xmlbuilder2 to version 4

[SveLil]

Version 3 of xmlbuilder2 has a security issue as it depends on js-yaml 3.14.1 (GHSA-mh29-5h37-fv8m)

Either the js-yaml version has to be overridden to 3.14.2 or xmlbuilder2 has to be updated to version 4

[jkowalleck]

feel free to work on a replacement in this very library

The thing I really would prefer is to not introduce breaking changes, meaning that v3 and v4 are supported here. But, this should be no stopper - if support for v3 is no longer possible, then we will simply release a BC mayor version :)

---

• see alos: feat: support xmlbuilder2@^4.0.0 #1368
• see also: chore(deps): bump xmlbuilder2 from 3.1.1 to 4.0.1 #1390

[jkowalleck]

Version 3 of xmlbuilder2 has a security issue as it depends on js-yaml 3.14.1 (GHSA-mh29-5h37-fv8m)

Either the js-yaml version has to be overridden to 3.14.2 or xmlbuilder2 has to be updated to version 4

@SveLil could you elaborate how GHSA-mh29-5h37-fv8m affects xmlbuilder2?

In addition, please be aware how node works: every package can have their own module resolution tree that does NOT affect other modules.

[jkowalleck]

Anyway, a fix in on the way. to be released soon.

[jkowalleck]

https://github.com/CycloneDX/cyclonedx-node-npm/releases/tag/v4.1.2

[SveLil]

@SveLil could you elaborate how GHSA-mh29-5h37-fv8m affects xmlbuilder2?

I don't think it affects xmlbuilder2 or especially cyclonedx-node but it's sometimes easier to fix than to explain that a security "issue" isn't really an issue.

Thanks for updating