From 3ceef994de87862ce29d5c2b13b7a6ed026c99b1 Mon Sep 17 00:00:00 2001
From: Danny Avila <danny@librechat.ai>
Date: Thu, 23 Apr 2026 10:04:47 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20chore:=20Bump=20`@xmldo?=
 =?UTF-8?q?m/xmldom`=20to=200.8.13=20via=20Root=20Override=20(#12795)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Addresses Dependabot advisory (uncontrolled recursion in XML serialization, DoS).
All transitive parents — mammoth, @node-saml/node-saml, xml-crypto, xml-encryption —
already accept `^0.8.x`, so this is a patch-level bump with no breaking changes.
---
 package-lock.json | 6 +++---
 package.json      | 1 +
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 1c0b58a759..7f0724ef0c 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -21854,9 +21854,9 @@
       }
     },
     "node_modules/@xmldom/xmldom": {
-      "version": "0.8.12",
-      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.12.tgz",
-      "integrity": "sha512-9k/gHF6n/pAi/9tqr3m3aqkuiNosYTurLLUtc7xQ9sxB/wm7WPygCv8GYa6mS0fLJEHhqMC1ATYhz++U/lRHqg==",
+      "version": "0.8.13",
+      "resolved": "https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.8.13.tgz",
+      "integrity": "sha512-KRYzxepc14G/CEpEGc3Yn+JKaAeT63smlDr+vjB8jRfgTBBI9wRj/nkQEO+ucV8p8I9bfKLWp37uHgFrbntPvw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
diff --git a/package.json b/package.json
index 1947c0e49c..02a7552036 100644
--- a/package.json
+++ b/package.json
@@ -140,6 +140,7 @@
   },
   "overrides": {
     "@anthropic-ai/sdk": "0.73.0",
+    "@xmldom/xmldom": "^0.8.13",
     "@librechat/agents": {
       "@langchain/anthropic": {
         "@anthropic-ai/sdk": "0.73.0",