chore(deps): bump feedsmith from 3.0.0-rc.1 to 3.0.0-rc.2

[dependabot]

Bumps feedsmith from 3.0.0-rc.1 to 3.0.0-rc.2.

Release notes

Sourced from feedsmith's releases.

v3.0.0-rc.2

3.0.0-rc.2 (2026-07-14)

Performance Improvements

• Simplify namespace stop nodes to deep wildcards (fc5e63e)

Commits

• 83449b3 chore: Update packages
• 081da0e Merge branch 'main' into rc
• fa77a57 Merge pull request #324 from macieklamberski/perf/simplify-stopnodes-wildcards
• fc5e63e perf: Simplify namespace stop nodes to deep wildcards
• 77de2a0 chore: Remove @​biomejs/biome dep, resolved via kvalita peer
• a3efca8 Merge branch 'main' into rc
• 023425c Merge pull request #319 from macieklamberski/chore/bump-x-net-benchmark
• fd785bb Merge pull request #318 from macieklamberski/fix/broken-namespace-spec-links
• 66bed58 chore: Bump golang.org/x/net to 0.55.0 in cross-language benchmark
• a631131 docs: Fix broken namespace specification links
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

License Issues

package-lock.json

Package	Version	License	Issue Type
feedsmith	3.0.0-rc.2	Null	Unknown License

OpenSSF Scorecard

Package	Version	Score	Details
npm/fast-xml-builder	1.3.0	Unknown	Unknown
npm/fast-xml-parser	5.10.0	🟢 8.4	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10 Code-Review ⚠️ 1 Found 4/28 approved changesets -- score normalized to 1 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo License 🟢 10 license file detected Packaging 🟢 10 packaging workflow detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 SAST 🟢 8 SAST tool detected but not run on all commits
npm/feedsmith	3.0.0-rc.2	Unknown	Unknown
npm/is-unsafe	2.0.0	Unknown	Unknown
npm/path-expression-matcher	1.6.2	Unknown	Unknown
npm/xml-naming	0.3.0	Unknown	Unknown

Scanned Files

• package-lock.json