chore: update dependency xml-crypto to v6

[renovate]

Note

Mend has cancelled the proposed renaming of the Renovate GitHub app being renamed to mend[bot].

This notice will be removed on 2025-10-07.

---

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
xml-crypto	^3.2.1 -> ^6.1.2

---

Release Notes

node-saml/xml-crypto (xml-crypto)

v6.1.2

Compare Source

• Remove all reference XML data if any are corrupted (#​502) (cac1c8d)

v6.1.1

Compare Source

• Adjust deprecation to better reflect real-world usage (#​499) (ab1c69e)

v6.1.0

Compare Source

• Introduce new .getSignedReferences() function of signature to help prevent signature wrapping attacks (#​489) (badaf20)

v6.0.1

Compare Source

• Merge commit from fork (8ac6118)

This addresses two critical CVE:

• CVE-2025-29774
• CVE-2025-29775

v6.0.0

Compare Source

💣 Major Changes

• [breaking-change] Set getCertFromKeyInfo to noop #​445

🔗 Dependencies

• [dependencies] [github_actions] Bump github/codeql-action from 2 to 3 #​434

📚 Documentation

• [documentation] Chore: Update README.md #​432

---

v5.1.1

Compare Source

🐛 Bug Fixes

• [bug] fix: template literal #​443

---

v5.1.0

Compare Source

🚀 Minor Changes

• [enhancement] Enhance derToPem to support XML pretty-print #​439

🔗 Dependencies

• [dependencies] [javascript] Bump @​typescript-eslint/parser from 6.13.0 to 6.18.1 #​442
• [dependencies] [javascript] Bump @​typescript-eslint/eslint-plugin from 6.13.0 to 6.18.1 #​441
• [dependencies] [javascript] Bump follow-redirects from 1.15.3 to 1.15.4 #​440
• [dependencies] [javascript] Bump eslint from 8.54.0 to 8.56.0 #​436
• [dependencies] [javascript] Bump @​types/node from 16.18.65 to 16.18.69 #​435
• [dependencies] [javascript] Bump release-it from 16.2.1 to 16.3.0 #​428

---

v5.0.0

Compare Source

💣 Major Changes

• [breaking-change] Mark getKeyInfo() private as it has no public consumers #​412
• [breaking-change] Remove the default for getKeyInfoContent forcing a consumer to choose #​411
• [documentation] [breaking-change] Remove default for transformation algorithm #​410
• [breaking-change] Remove default for signature algorithm #​408
• [breaking-change] Remove default for digest algorithm #​406
• [breaking-change] Remove default canonicalization algorithm #​405
• [chore] [breaking-change] Improve code clarity; remove unused functions #​397
• [breaking-change] Move validation messages to each reference #​396
• [breaking-change] Make references accessible only via get/set #​395
• [chore] [breaking-change] Reduce public interface by making some methods private #​394
• [chore] [breaking-change] Update build to support Node@​16 #​385

🚀 Minor Changes

• [enhancement] Add support for directly querying a node to see if it has passed validation #​389
• [enhancement] Add method for checking if element is signed #​368

🔗 Dependencies

• [dependencies] [javascript] Bump @​typescript-eslint/eslint-plugin from 5.62.0 to 6.13.0 #​422
• [dependencies] [javascript] Bump @​prettier/plugin-xml from 3.2.1 to 3.2.2 #​423
• [dependencies] [javascript] Bump @​types/mocha from 10.0.2 to 10.0.6 #​421
• [dependencies] [javascript] Bump @​types/chai from 4.3.6 to 4.3.11 #​419
• [dependencies] [javascript] Bump prettier from 3.0.3 to 3.1.0 #​418
• [dependencies] [javascript] Bump typescript from 5.2.2 to 5.3.2 #​415
• [dependencies] [javascript] Bump eslint from 8.51.0 to 8.54.0 #​414
• [dependencies] [github_actions] Bump actions/setup-node from 3 to 4 #​413
• [dependencies] [javascript] Bump @​babel/traverse from 7.22.4 to 7.23.2 #​407
• [dependencies] [github_actions] Bump actions/checkout from 3 to 4 #​392
• [dependencies] [javascript] Bump eslint-plugin-deprecation from 1.4.1 to 2.0.0 #​390
• [dependencies] [javascript] Bump typescript from 5.1.6 to 5.2.2 #​383
• [dependencies] [javascript] Bump eslint-config-prettier from 8.8.0 to 9.0.0 #​381
• [dependencies] Update dependencies; move to @​xmldom-scoped is-dom-node package #​402

🐛 Bug Fixes

• [bug] Ensure the X509Certificate tag is properly prefixed #​377
• [bug] Fix transform processing regression #​379
• [bug] Enforce consistent transform processing #​380

📚 Documentation

• [documentation] Clarify use of in signature validation #​401

⚙️ Technical Tasks

• [chore] Use is-dom-node for DOM node checking and narrowing #​388
• [chore] Improve and simplify validation logic #​373
• [chore] Add additional type checking #​369

---

v4.1.0

Compare Source

💣 Major Changes

• [bug] [breaking-change] Fix pemToDer() return type #​364

⚙️ Technical Tasks

• [chore] Improve exported typings #​367
• [chore] Use stricter typing in tests #​366
• [chore] Consistently reference xmldom #​365
• [chore] Rename findChilds() to findChildren() #​363

---

v4.0.1

Compare Source

🐛 Bug Fixes

• [bug] Use correct type for options #​360
• [bug] Fix validationErrors type #​361

---

v4.0.0

Compare Source

💣 Major Changes

• [documentation] [breaking-change] Expand the options, move idmode into options, fix types #​323
• [breaking-change] Refactor classes into their own files #​318
• [breaking-change] Prefer ES6 classes to prototypical inheritance #​316
• [breaking-change] Rename signingCert -> publicCert and signingKey -> privateKey #​315
• [semver-major] [breaking-change] Add support for in ; remove KeyInfoProvider #​301
• [semver-major] Target an LTS version of Node #​299

🚀 Minor Changes

• [enhancement] Exports C14nCanonicalization, ExclusiveCanonicalization #​336

🔗 Dependencies

• [dependencies] [javascript] Bump @​xmldom/xmldom from 0.8.8 to 0.8.10 #​358
• [dependencies] [javascript] Bump @​typescript-eslint/eslint-plugin from 5.60.1 to 5.62.0 #​357
• [dependencies] [javascript] Bump @​prettier/plugin-xml from 2.2.0 to 3.1.1 #​356
• [dependencies] [javascript] Bump prettier from 2.8.8 to 3.0.0 #​350
• [dependencies] [javascript] Bump release-it from 15.11.0 to 16.1.3 #​352
• [dependencies] [javascript] Bump prettier-plugin-packagejson from 2.4.3 to 2.4.5 #​353
• [dependencies] [javascript] Bump @​typescript-eslint/parser from 5.60.1 to 5.62.0 #​354
• [dependencies] [javascript] Bump typescript from 5.1.5 to 5.1.6 #​351
• [dependencies] [javascript] Bump word-wrap from 1.2.3 to 1.2.4 #​348
• [dependencies] [javascript] Bump eslint from 8.42.0 to 8.45.0 #​344
• [dependencies] Update gren for better support for branches #​340
• [dependencies] [github_actions] Bump codecov/codecov-action from 3.1.1 to 3.1.4 #​290

🐛 Bug Fixes

• [bug] Fix issue in case when namespace has no prefix #​330
• [bug] Use correct path for code coverage reports #​302

⚙️ Technical Tasks

• [chore] Enforce eslint no-unused-vars #​349
• [chore] Enforce eslint deprecation #​347
• [chore] Enforce eslint prefer-template #​346
• [chore] Enforce eslint no-this-alias #​345
• [chore] Convert this project to TypeScript #​325
• [chore] Rename files in preparation for TS migration #​343
• [chore] Don't force master branch when generating changelog #​342
• [chore] Enforce eslint no-unused-vars #​322
• [chore] Enforce eslint no-prototype-builtins #​321
• [chore] Enforce eslint eqeqeq rule #​320
• [chore] Update types #​319
• [chore] Adjust code to pass eslint prefer-const #​312
• [chore] Adjust code to pass eslint no-var #​311
• [chore] Adjust code to pass eslint curly #​310
• [chore] Adjust code to pass eslint one-var #​309
• [chore] Typings #​295
• [chore] Lint code for new linting rules #​300
• [chore] Make linting rules more strict #​293
• [chore] Replace Nodeunit with Mocha #​294

---

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.