fix(webapp): pin fast-xml-parser past the broken 5.7 window

[ArjunCodess]

Summary

• the webapp's AWS XML stack calls addEntity("#xD"), and fast-xml-parser 5.7.0–5.7.1 rejects that name, so IRSA credential resolution never gets as far as parsing STS
• the existing >=5 <5.7.0 override stopped at 5.7.x, which is the broken window; this moves it to >=5 <5.8.0 → ^5.8.0 and keeps the 4.x line as-is
• 5.8.0 is the first release that accepts those entities again

Fixes #4951

Test plan

• confirm pnpm why fast-xml-parser no longer lists 5.7.0 or 5.7.1
• run the issue repro against the resolved 5.8.0 copy: addEntity("#xD") then parse("<a>1</a>", true) should not throw
• on a self-hosted IRSA webapp, magic-link / SES send should get past credential resolution

[changeset-bot]

⚠️ No Changeset found

Latest commit: e3de592

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Hi @ArjunCodess, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 303531fe-e5c9-4523-ad3f-4be0f8a7fb0d

📥 Commits

Reviewing files that changed from the base of the PR and between 3dcafbd and e3de592.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• .server-changes/irsa-xml-parser-pin.md
• package.json

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}