Updated dependencies to resolve security issue

[cgalvan]

Description

Updated dependencies to resolve security issue with fast-xml-parser: https://github.com/aws-geospatial/amazon-location-features-demo-web/security

Testing

Built/ran ci-test.

[its-aazizi]

@cgalvan PRs raised from forked repos against main do not have access to github secrets for security reasons, I believe that is the reason all tests are failing. The way we work around this is mentioned below;

1. PR for forked/feature_branch against aws-geospatial/feature_branch
2. Once merged, raise another PR aws-geospatual/feature_branch against main

[cgalvan]

@cgalvan PRs raised from forked repos against main do not have access to github secrets for security reasons, I believe that is the reason all tests are failing. The way we work around this is mentioned below;

1. PR for forked/feature_branch against aws-geospatial/feature_branch
2. Once merged, raise another PR aws-geospatual/feature_branch against main

Oh that makes sense :) I can do that, thanks!

[its-aazizi]

@cgalvan We have been locking down the version for deps, I see that "^" has been introduced for the updated deps.

[cgalvan]

@cgalvan We have been locking down the version for deps, I see that "^" has been introduced for the updated deps.

Will dependabot still give us minor version updates if we specify an explicit version instead of allowing compatible versions?

Best practice is to use ^ and commit the package-lock.json, which ensures developers are working with the same dependencies while also allowing dependencies to be updated within compatible range by dependabot.

[its-aazizi]

@cgalvan dependabot will still raise PRs regardless of the "^". We can definitely have "^" before the version for minor updates. I ended up removing the "^" after Vi's and Devesh's feedback.

[mbalfour-amzn]

No longer needed, dependabot PR resolved the issue.