Update package.json

[stephenwaite]

found this dependabot warning, what do you think @sjpadgett ?

[sjpadgett]

"@xmldom/xmldom": "0.7.7"

This is one of those very concerning version updates. Looking at change logs the access to module was changed at v0.6.0. Some sort of tiff I guess but the most concerning is that xmldom is widely used in openemr. HTMLPurifier, Bootstrap, jQuery, lforms, ckeditor and angular-sanitize!

I don't understand if our package import is the same dependency used by these other projects and why we included in the first place. We'd need to do a git search to get to bottom of that but if indeed xmldom is a dependency of above projects, were we required to include or was it included as npm dependency when including Bootstrap let's say?

Whatever the case, in this instance we're damn if we do and damn if we don't. Meaning how far do we let projects updates lag behind?
We certainly need to test this well and I have updated my dev but, we all need to help test this or any package updates.

[sjpadgett]

@stephenwaite oh sorry didn't notice this is oe-cda-schematron package. ignore above and i'll try to test.