From 1ebe607a262385e287c4f44877480973a428de28 Mon Sep 17 00:00:00 2001
From: Aleksandr Borovskii <aleksandr.borovskii@brightsec.com>
Date: Mon, 5 Oct 2026 10:04:59 +0200
Subject: [PATCH] fix(deps): bump plist to ^3.1.1 to pull @xmldom/xmldom 0.9.x

plist@3.1.1 moves its @xmldom/xmldom dependency from ^0.8.8 to ^0.9.10,
replacing the vulnerable 0.8.10 resolution with 0.9.12 (outside every
flagged advisory range). Clears all 15 runtime @xmldom/xmldom Dependabot
alerts. plist.build() is API-stable across the bump; build and tests pass.
---
 package-lock.json | 20 +++++++++++---------
 package.json      |  2 +-
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index f4dfcc7..936ba8c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -12,7 +12,7 @@
       "dependencies": {
         "nan": "^2.28.0",
         "node-gyp-build": "^4.8.4",
-        "plist": "^3.1.0"
+        "plist": "^3.1.1"
       },
       "devDependencies": {
         "@commitlint/cli": "^20.3.1",
@@ -2312,11 +2312,12 @@
       }
     },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.8.10",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.10.tgz",
-      "integrity": "sha512-2WALfTl4xo2SkGCYRt6rDTFfk9R1czmBvUQy12gK2KuRKIpWEhcbbzy8EZXtz/jkRqHX8bFEc6FC1HjX4TUWYw==",
+      "version": "0.9.12",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.9.12.tgz",
+      "integrity": "sha512-5AXjrcMClTryPe9LgZrygpB1lj7s0S9E0+W+AHaVKAVyHanafK86iPSvG5xHVSp/jC+VH1UXu0TAEmY279xH7A==",
+      "license": "MIT",
       "engines": {
-        "node": ">=10.0.0"
+        "node": ">=14.6"
       }
     },
     "node_modules/acorn": {
@@ -9160,11 +9161,12 @@
       }
     },
     "node_modules/plist": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/plist/-/plist-3.1.0.tgz",
-      "integrity": "sha512-uysumyrvkUX0rX/dEVqt8gC3sTBzd4zoWfLeS29nb53imdaXVvLINYXTI2GNqzaMuvacNx4uJQ8+b3zXR0pkgQ==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/plist/-/plist-3.1.1.tgz",
+      "integrity": "sha512-ZIfcLJC+7E7FBFnDxm9MPmt7D+DidyQ26lewieO75AdhA2ayMtsJSES0iWzqJQbcVRSrTufQoy0DR94xHue0oA==",
+      "license": "MIT",
       "dependencies": {
-        "@xmldom/xmldom": "^0.8.8",
+        "@xmldom/xmldom": "^0.9.10",
         "base64-js": "^1.5.1",
         "xmlbuilder": "^15.1.1"
       },
diff --git a/package.json b/package.json
index ee0a1c1..199d0b5 100644
--- a/package.json
+++ b/package.json
@@ -37,7 +37,7 @@
   "dependencies": {
     "nan": "^2.28.0",
     "node-gyp-build": "^4.8.4",
-    "plist": "^3.1.0"
+    "plist": "^3.1.1"
   },
   "commitlint": {
     "extends": [