fix(webapp): pin fast-xml-parser past the 5.7 irsa break

.server-changes/irsa-xml-parser-pin.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Magic-link login works again on self-hosted deployments that use a role for cloud credentials

apps/webapp/test/fastXmlParserAwsEntities.test.ts

@@ -0,0 +1,27 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+const rootPackageJson = JSON.parse(
+  readFileSync(join(dirname(fileURLToPath(import.meta.url)), "../../../package.json"), "utf8")
+) as {
+  pnpm: { overrides: Record<string, string> };
+};
+
+describe("fast-xml-parser aws sdk compatibility", () => {
+  it("pins 5.x past the 5.7 window that rejects addEntity('#xD')", () => {
+    expect(rootPackageJson.pnpm.overrides["fast-xml-parser@>=5 <5.8.0"]).toBe("^5.8.0");
+  });
+
+  it("accepts the character-reference entities @aws-sdk/xml-builder registers", async () => {
+    const { XMLParser } = await import("fast-xml-parser");
+    const parser = new XMLParser({ htmlEntities: true });
+
+    expect(() => {
+      parser.addEntity("#xD", "\r");
+      parser.addEntity("#10", "\n");
+      parser.parse("<a>1</a>", true);
+    }).not.toThrow();
+  });
+});

package.json

@@ -128,7 +128,7 @@
       "protobufjs@>=7 <7.6.5": "^7.6.5",
       "@grpc/grpc-js@>=1.12.0 <1.12.7": "1.12.7",
       "fast-xml-parser@>=4 <4.5.5": "^4.5.5",
-      "fast-xml-parser@>=5 <5.7.0": "^5.7.0",
+      "fast-xml-parser@>=5 <5.8.0": "^5.8.0",
       "path-to-regexp@>=0.1 <0.1.13": "^0.1.13",
       "ajv@>=8 <8.18.0": "^8.18.0",
       "socket.io-parser@>=4 <4.2.7": "^4.2.7",