Fix KeePass XML parser compatibility

[pullfrog]

Fixes #978.

kdbxweb builds its parser with the errorHandler object that @xmldom/xmldom removed in 0.9, so the root overrides entry pinning xmldom to >=0.9.10 (added as a security floor) broke every KeePass database with errorHandler object is no longer supported. kdbxweb has not shipped a release since 2021 and upstream still has the old code, so there is no version to upgrade to.

Since the plugin bundles kdbxweb, its xmldom import is now redirected at build time to src/xmldom-compat.ts, a small wrapper that translates errorHandler into the supported onError callback and re-exports the rest of xmldom untouched. The override stays where it is, and the constraint lives in the one plugin that has it rather than capping xmldom for the whole repo.

Two things worth knowing for anyone touching that config: esbuild's alias option cannot express this (it prefix-matches subpaths, so the shim's own import resolves back into the shim, which is why it uses an onResolve hook), and xmldom has to be a direct dependency of the plugin or it will not resolve under bun's isolated installs.

The alternative was pinning xmldom to ^0.8.13, the newest release kdbxweb can talk to and free of the advisories that motivated the override. That worked, but put a repo-wide ceiling on a dependency for one plugin's sake.

Plugin tests now run in CI

This shipped because no plugin package defined a test:ci script, and CI runs turbo test:ci. The keepass suite reproduces this bug exactly, and had been failing unnoticed.

• test:ci added to all 10 plugin packages that have tests. 1password and infisical build a separate test bundle first, without which their suites error out and report 31 and 5 tests "skipped".
• turbo's test:ci now depends on build, since plugin tests load dist/plugin.cjs rather than src.
• @varlock/website excluded from the root test:ci, so that new build dependency does not drag a full Astro build into every test run.

Unit tests cover the compat wrapper directly. A valid database cannot produce the non-fatal parse errors it guards against (the KDBX HMAC catches corruption first), so the strict-parse behavior is not reachable end to end.

Deferred KeePass setup

@initKeePass resolved dbPath/password eagerly at schema load, so an empty master password was fatal even when nothing in the schema read from KeePass. Setup now runs on the first kp()/kpBulk() call, memoized per instance. This is what the existing unused plugin with empty password causes no errors test always expected.

Verification

Full test:ci --force: 43/43 tasks, keepass 24/24. bun audit clean for the keepass plugin. Lint, typecheck:all, and the docs build all pass. Confirmed the built dist/plugin.cjs bundles xmldom 0.9.10 and opens real databases through it.

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using azure/gpt-5.6-sol ｜ 𝕏}

[github-actions]

The changes in this PR will be included in the next version bump.

Patch releases

• @varlock/keepass-plugin 2.0.0 → 2.0.1

Bump files in this PR

• fix-keepass-xmldom-parser.md (view diff) (edit)

Click here if you want to add another bump file to this PR

---

This comment is maintained by bumpy.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/varlock@979

npm i https://pkg.pr.new/@varlock/keepass-plugin@979

commit: b32b0c2

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	8bebc4b	Commit Preview URL Branch Preview URL	Aug 07 2026, 07:43 PM

[pullfrog]

Fixed the CI failure in commit 404fae4e and pushed it to PR #979. The test fixture's direct kdbxweb import was bypassing the plugin's bundled xmldom shim, so fixture creation now temporarily uses the compatible DOM implementation while plugin execution continues to exercise the bundle end to end; bun run test:ci passes all 43 tasks, and lint plus the KeePass typecheck pass.

Task list (5/5 completed)

• Confirm the CI failure was introduced by PR Fix KeePass XML parser compatibility #979
• Reproduce and diagnose the KeePass test failure
• Implement the minimal compatibility fix
• Run the exact CI test command and focused verification
• Review, commit, and push the fix to PR Fix KeePass XML parser compatibility #979

  ^{｜ View workflow run ｜ via Pullfrog ｜ Using azure/gpt-5.6-sol ｜ 𝕏}