chore: upgrade xml2js and codemirror plugins

[benmccann]

This has been causing a security warning forever that's been impossible to get rid of. The dependency blocking the upgrade was finally fixed today

This PR is against the main branch. See #10462 for the svelte-4 version

[changeset-bot]

⚠️ No Changeset found

Latest commit: 912a0d2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[Rich-Harris]

man, you can't win — getting rid of dupes is a game of whack-a-mole. pnpm up -r --latest makes it much worse

that said we are behind on a few deps, would be good to update some of them

[benmccann]

I don't think we have to be perfect. As long as we don't have duplicates of codemirror (which would break things) or things like esbuild that have dozens of dependencies and explode the lockfile I think it's fine

[Rich-Harris]

agree, it's just a bummer to have like @types/[email protected] and @types/[email protected]. what are we doing, as an industry