MODGQL-204: xmldom 0.6.0, underscore 1.13.8 fixing vulns

https://folio-org.atlassian.net/browse/MODGQL-204

Bump underscore from ^1.13.1 to ^1.13.8 fixing
* https://www.cve.org/CVERecord?id=CVE-2026-27601

Bump xmldom from ^0.1.27 to ^0.6.0 fixing
* https://www.cve.org/CVERecord?id=CVE-2026-41674
* https://www.cve.org/CVERecord?id=CVE-2026-34601
* https://www.cve.org/CVERecord?id=CVE-2026-41673
* https://www.cve.org/CVERecord?id=CVE-2026-41672
* https://www.cve.org/CVERecord?id=CVE-2026-41675

Author: julianladisch

package.json

@@ -57,8 +57,9 @@
     "glob-parent": "^5.1.2",
     "json-ptr": "^3.0.0",
     "minimist": "^1.2.5",
-    "underscore": "^1.13.1",
+    "underscore": "^1.13.8",
     "validator": "^13.15.22",
+    "xmldom": "0.6.0",
     "@xmldom/xmldom": "^0.8.1"
   }
 }

yarn.lock

@@ -7981,10 +7981,10 @@ undefsafe@^2.0.5:
   resolved "https://registry.yarnpkg.com/undefsafe/-/undefsafe-2.0.5.tgz#38733b9327bdcd226db889fb723a6efd162e6e2c"
   integrity sha512-WxONCrssBM8TSPRqN5EmsjVrsv4A8X12J4ArBiiayv3DyyG3ZlIg6yysuuSYdZsVz3TKcTg2fd//Ujd4CHV1iA==
 
-underscore@1.9.1, underscore@^1.13.1:
-  version "1.13.7"
-  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.13.7.tgz#970e33963af9a7dda228f17ebe8399e5fbe63a10"
-  integrity sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g==
+underscore@1.9.1, underscore@^1.13.8:
+  version "1.13.8"
+  resolved "https://registry.yarnpkg.com/underscore/-/underscore-1.13.8.tgz#a93a21186c049dbf0e847496dba72b7bd8c1e92b"
+  integrity sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==
 
 undici-types@~7.8.0:
   version "7.8.0"
@@ -8349,10 +8349,10 @@ xmlbuilder@~9.0.1:
   resolved "https://registry.yarnpkg.com/xmlbuilder/-/xmlbuilder-9.0.7.tgz#132ee63d2ec5565c557e20f4c22df9aca686b10d"
   integrity sha512-7YXTQc3P2l9+0rjaUbLwMKRhtmwg1M1eDf6nag7urC7pIPYLD9W/jmzQ4ptRSUbodw5S0jfoGTflLemQibSpeQ==
 
-xmldom@0.1.27:
-  version "0.1.27"
-  resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.1.27.tgz#d501f97b3bdb403af8ef9ecc20573187aadac0e9"
-  integrity sha512-7WpJBYwyhvsddFJA51SOIU0Be9W44sbGGjc6Z3ly8Wx/Wl7nriMPZ5xf6Np9ASlJ6gACfXcTLukm4DtX372lFw==
+xmldom@0.1.27, xmldom@0.6.0:
+  version "0.6.0"
+  resolved "https://registry.yarnpkg.com/xmldom/-/xmldom-0.6.0.tgz#43a96ecb8beece991cef382c08397d82d4d0c46f"
+  integrity sha512-iAcin401y58LckRZ0TkI4k0VSM1Qg0KGSc3i8rU+xrxe19A/BN1zHyVSJY7uoutVlaTSzYyk/v5AmkewAP7jtg==
 
 xmlhttprequest@1.8.0:
   version "1.8.0"