CVE @xmldom/xmldom <0.8.3

[Shinigami92]

Description

@xmldom/xmldom has reported a CVE which results in a (successfully) failing audit pipeline in our GitLab

Reduced test case

GHSA-9pgh-qqpf-7wqj

Steps to reproduce

1. Install video.js and/or @videojs/http-streaming
2. Run e.g. pnpm audit
3. Profit $$$

Errors

No response

What version of Video.js are you using?

7.20.3

Video.js plugins used.

@videojs/http-streaming

What browser(s) including version(s) does this occur with?

🤷

What OS(es) and version(s) does this occur with?

MacOS

[welcome]

👋 Thanks for opening your first issue here! 👋

If you're reporting a 🐞 bug, please make sure you include steps to reproduce it. We get a lot of issues on this repo, so please be patient and we will get back to you as soon as we can.
To help make it easier for us to investigate your issue, please follow the contributing guidelines.

[KJLJon]

It looks like @xmldom/xmldom has backported the fix and released 0.7.6 (see GHSA-9pgh-qqpf-7wqj).

Looking at the package-lock.json, it looks like the reason it is installed is because of mpd-parser. Since mpd-parser requires "@xmldom/xmldom": "^0.7.2", all that is needed is to do a npm update and you should have the latest package with the fixed version.

FYI: it looks like the CVE-2022-37616 hasn't been updated to include the 0.7.6 patched version, but the GHSA-9pgh-qqpf-7wqj has. Here is the PR for 0.7.x branch fix.