xmldom: DocType `name` Injection Bypasses requireWellFormed

Description

The @xmldom/xmldom serializer emits DocumentType.name verbatim into the <!DOCTYPE …> declaration with no well-formedness guard. GHSA-f6ww-3ggp-fr8h (CVE-2026-41674) hardened the serializer’s requireWellFormed path for a DocumentType’s sibling fields — publicId, systemId, and internalSubset — but it did not add any check for name.

Recommendation

Update the @xmldom/xmldom package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 0.9.0, <= 0.9.11

  >= 0.7.0, <= 0.8.14**

• Patched version(s): **0.9.12

  0.8.15**

References

• GHSA-27p8-2357-5qqv
• CVE-2026-83608
• CWE-91
• CAPEC-310