From cc2d74a44d1da491751f2b37f4e5b81cd8420f66 Mon Sep 17 00:00:00 2001
From: Andrew Rumble <andrew.rumble@overleaf.com>
Date: Tue, 9 Jun 2026 10:10:38 +0100
Subject: [PATCH] Merge pull request #34406 from
 overleaf/lg-xmldom-security-fix

[Security upgrade] update @xmldom/xmldom to ^0.8.13 in services/web

GitOrigin-RevId: 2a7d55f73a71c6eb2f82821069cd3a8b367a55a0
---
 services/web/package.json | 2 +-
 yarn.lock                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/services/web/package.json b/services/web/package.json
index 7ae7a2ba51..79323cf722 100644
--- a/services/web/package.json
+++ b/services/web/package.json
@@ -105,7 +105,7 @@
     "@stripe/react-stripe-js": "^3.9.0",
     "@stripe/stripe-js": "^7.7.0",
     "@tanstack/react-table": "^8.21.3",
-    "@xmldom/xmldom": "^0.7.13",
+    "@xmldom/xmldom": "^0.8.13",
     "accepts": "^1.3.7",
     "ai": "^6.0.169",
     "ajv": "^8.12.0",
diff --git a/yarn.lock b/yarn.lock
index 5396fe06dc..e623c667d2 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -7346,7 +7346,7 @@ __metadata:
     "@writefull/core": "npm:^1.27.27"
     "@writefull/ui": "npm:^1.27.27"
     "@writefull/utils": "npm:^1.27.27"
-    "@xmldom/xmldom": "npm:^0.7.13"
+    "@xmldom/xmldom": "npm:^0.8.13"
     abort-controller: "npm:^3.0.0"
     accepts: "npm:^1.3.7"
     acorn: "npm:^7.1.1"