fix(pingidentity): resolve fast-xml-parser CVEs via AWS SDK lockfile refresh

[kim-tsao]

Summary

• Re-resolve legacy AWS SDK clients in workspaces/pingidentity with yarn up -R on @aws-sdk/client-s3, @aws-sdk/client-codecommit, and @aws-sdk/client-sts.
• Removes vulnerable fast-xml-parser lockfile lines 4.4.1 and 5.7.3; leaves a single patched 4.5.7 line for Azure/GCS (^4.3.x).
• Does not bump @backstage/* or @backstage-community/* directly.
• Classification: PLUGIN_DEV+RUNNER only — not a published-plugin production dependency in this workspace.

Approach

fast-xml-parser was not a direct dependency. Main had three lockfile lines:

Before	Source
4.4.1 (vulnerable)	@aws-sdk/core@3.622.0 on legacy S3/CodeCommit/STS clients
5.7.3	@aws-sdk/xml-builder@3.972.26 on newer credential-provider tree
4.5.7	@azure/core-xml, @google-cloud/storage

yarn up -R on the legacy AWS clients upgraded them to 3.1133.0 / @aws-sdk/core@3.978.0, which dropped the 4.4.1 pin. Newer @aws-sdk/xml-builder@3.972.40 no longer depends on fast-xml-parser, so the v5 line disappeared. Azure/GCS remain on patched 4.5.7.

Fully fixed

package	before	after	CVEs cleared
fast-xml-parser	4.4.1, 4.5.7, 5.7.3	4.5.7	CVE-2026-25896, CVE-2026-26278, CVE-2026-33036, CVE-2026-33349, CVE-2026-41650

Partial leftovers

None for fast-xml-parser.

Unchanged

None for fast-xml-parser.

Hey, I just made a Pull Request!

Follow-up to #10999 — clears the remaining fast-xml-parser Dependabot alerts in the pingidentity workspace lockfile.

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)
• All your commits have a Signed-off-by line in the message. (more info)

Made with Cursor

[PatAKnight]

LGTM