# Continuity ledger (per-branch)

## Human intent (must not be overwritten)

- Resolve Dependabot alert https://github.com/giselles-ai/giselle/security/dependabot/181 (CVE-2026-44665 / GHSA-5wm8-gmm8-39j9) for `fast-xml-builder` (transitive via `fast-xml-parser` → `@aws-sdk/xml-builder`).

## Goal (incl. success criteria)

- Bump transitive `fast-xml-builder` from 1.1.5 to a patched release (>= 1.1.7) so Dependabot alert #181 closes.
- Keep the change minimal and consistent with prior CVE bumps tracked under `pnpm.overrides`.

## Constraints/Assumptions

- `fast-xml-parser` is already pinned in `pnpm.overrides` at 5.7.2 (previous CVE bump).
- `fast-xml-parser@5.7.3` declares `fast-xml-builder: ^1.1.7`, so bumping the parser one patch pulls in the patched builder transitively.

## Key decisions

- Bump the existing `fast-xml-parser` override 5.7.2 → 5.7.3 instead of adding a separate `fast-xml-builder` override. Mirrors the pattern in commit 251f061d1 (CVE-2026-41650) and avoids redundant pins.

## State

- `package.json` `pnpm.overrides.fast-xml-parser` set to `5.7.3`.
- `pnpm install` resolved `fast-xml-builder@1.2.0` and `fast-xml-parser@5.7.3`.

## Done

- Updated override.
- Ran `pnpm install` to regenerate `pnpm-lock.yaml`.

## Now

- Run quality checks: `pnpm format`, `pnpm check-types`, `pnpm test`.

## Next

- Commit and open PR referencing https://github.com/giselles-ai/giselle/security/dependabot/181.

## Open questions (UNCONFIRMED if needed)

- None.

## Working set (files/ids/commands)

- `package.json` (pnpm.overrides)
- `pnpm-lock.yaml`
- Dependabot alert https://github.com/giselles-ai/giselle/security/dependabot/181
