[Snyk] Security upgrade xml-crypto from 0.10.1 to 2.1.0

[voltrue2]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	556/1000 Why? Recently disclosed, Has a fix available, CVSS 5.4	XML External Entity (XXE) Injection SNYK-JS-XMLDOM-1084960	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: xml-crypto

The new version differs by 87 commits.

• ca0e3c3 2.1.0
• 2136f8e Bump xmldom from 0.1.27 to 0.5.0 (#225)
• 9d5727b Merge pull request #220 from dosullivan557/master
• 52aa883 Merge pull request #218 from paulish/master
• 66fbb50 Bump junit from 4.12 to 4.13.1 in /test/validators/XmlCryptoJava (#217)
• 6985e40 ignore example files
• f65947f upversion
• 0410b22 Formatting package json
• 6c794eb Formatting package json
• 8b09330 Updated package json
• 37c117a 2.1.0
• 666225d Updated package json to not pull in example into module build
• 4e8d41e + use existingPrefixes while lookup for references
• 3d9db71 [SECURITY] Disable HMAC sig methods by default due to key confusion
• d295ecc 1.5.3
• 79fc2ac Merge pull request #209 from troyfactor4/master
• f982b0c return response as well even if async
• 4ffe0aa Async response for built in algo sign/verify
• 713f3d8 1.5.2
• 638ab6c Lock ejs to 2.6.1
• 2730604 1.5.1
• 07e2320 Merge pull request #207 from troyfactor4/master
• 234bc0b enable more use cases by returning the xml object in callback
• 01d462d Test suites of other projects (mocha) that include v1.5.0 fail with error: "Error: global leak detected: existingPrefixes"

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

[svzi]

@voltrue2 Could you please merge this dependency update?

[reecebedding]

Any update on this at all?

[thatshailesh]

@voltrue2 can you please merge this and other PRs to fix security vulnerabilities?