Update fast-xml-parser to fix Dependabot issue

[wojtekn]

Related issues

• Fixes https://github.com/Automattic/studio/security/dependabot/146

How AI was used in this PR

I made a change myself.

Proposed Changes

• I propose updating fast-xml-parser to fix Dependabot issue.

Testing Instructions

• Confirm if CI goes through.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

[fredrikekelund]

It's actually not entirely sufficient to address these issues by updating the lockfile, because when we package the CLI, we use only apps/cli/package.json to install a node_modules directory to be copied to the output (without devDependencies).

In this case, because of how the version constraints work, we should still ship the latest version of fast-xml-parser with the packaged CLI, but that always depends on the dependency tree and the version constraints "along the way".

In this case, I would complement this PR with another PR in the Playground repo that updates the fast-xml-parser dependency version.

[fredrikekelund]

Are you using npm 11, @wojtekn?

[wojtekn]

Yes, 11.8.

[fredrikekelund]

I thought that would make it so we didn't have this flip-flopping of peer props in the lockfile, but it doesn't really matter either way…

[wpmobilebot]

📊 Performance Test Results

Comparing fd8665f vs trunk

app-size

Metric	trunk	fd8665f	Diff	Change
App Size (Mac)	1236.62 MB	1236.62 MB	+0.00 MB	⚪ 0.0%

site-editor

Metric	trunk	fd8665f	Diff	Change
load	1904 ms	1849 ms	55 ms	🟢 -2.9%

site-startup

Metric	trunk	fd8665f	Diff	Change
siteCreation	7106 ms	7111 ms	+5 ms	⚪ 0.0%
siteStartup	3924 ms	3911 ms	13 ms	⚪ 0.0%

---

Results are median values from multiple test runs.

Legend: 🟢 Improvement (faster) | 🔴 Regression (slower) | ⚪ No change (<50ms diff)

[wojtekn]

@fredrikekelund good point. In this case, it makes sense to close this one, update it in the Playground repo, and then update Playground in Studio when new version is released.

[fredrikekelund]

Updating the lockfile will make it so we have a newer version while developing Studio, so I still think it makes sense to land this PR. It won't make a difference when we package the CLI, though. Then, we should get the latest version that fits the constraint specified by Playground (^5.5.1 in this case)

[wojtekn]

@fredrikekelund sounds good, opened WordPress/wordpress-playground#3422