Upgrade xmldom

[amacneil]

User-Facing Changes
None

Description
Upgrade xmldom (by switching to @xmldom/xmldom) to fix CVE-2021-32796. See xmldom/xmldom#271 for background on why the package name changed.

Types are now included in the package (xmldom/xmldom#191). This PR adds "lib": ["dom"] to hooks package tsconfig because the previous xmldom types were automatically adding this for us with a <reference lib="dom" /> (xmldom/xmldom#285).

[amacneil]

sanity check on this please?

required by https://github.com/foxglove/studio/blob/main/packages/hooks/src/useVisibilityState.ts

[defunctzombie]

LGTM

[karfau]

@amacneil (from the xmldom types perspective), I would really love to understand why the hooks package needed the change in tsconfig.json, since in the file you linked I do not see any reference to xmldom.
What exactly was the error message?

(The file you linked contains a reference to a global document, but that is not something that xmldom would "add for you".)

[defunctzombie]

@karfau The hooks package needed to specify "dom" in the lib config because the code in useVisibilityState (linked in an above comment) references the global "document". For that we need to tell typescript we want to bring in the dom library into our scope.

[karfau]

Yes, that makes sense. I just don't understand why this change was required as part of this PR/how it is related to updating xmldom.

[defunctzombie]

@karfau The previous xmldom types (@types/xmldom) had <reference lib="dom" />. This changes the typescript compiler configuration to add "dom" lib for any users of those types. The new types don't do this so the end user should add dom to their lib themselves.

[amacneil]

Weirdly the new types do still contain that reference, but typescript definitely ignored it when I upgraded the package.

I will try to make a minimal reproduction of this issue today.

[amacneil]

Moving discussion to xmldom/xmldom#285