diff --git a/package-lock.json b/package-lock.json
index 822401d..2b8386f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -26,7 +26,7 @@
                 "telegraf": "^3.38.0",
                 "wechat4u": "^0.7.7",
                 "winston": "^3.2.1",
-                "xml2js": "^0.4.23"
+                "xml2js": "^0.5.0"
             },
             "devDependencies": {
                 "jpeg-js": "^0.4.3"
@@ -2279,6 +2279,18 @@
                 "xml2js": "^0.4.5"
             }
         },
+        "node_modules/parse-bmfont-xml/node_modules/xml2js": {
+            "version": "0.4.23",
+            "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz",
+            "integrity": "sha512-ySPiMjM0+pLDftHgXY4By0uswI3SPKLDw/i3UXbnO8M/p28zqexCUoPmQFrYD+/1BzhGJSs2i1ERWKJAtiLrug==",
+            "dependencies": {
+                "sax": ">=0.6.0",
+                "xmlbuilder": "~11.0.0"
+            },
+            "engines": {
+                "node": ">=4.0.0"
+            }
+        },
         "node_modules/parse-headers": {
             "version": "2.0.5",
             "resolved": "https://registry.npmjs.org/parse-headers/-/parse-headers-2.0.5.tgz",
@@ -3446,9 +3458,9 @@
             "integrity": "sha1-qQKekp09vN7RafPG4oI42VpdWig="
         },
         "node_modules/xml2js": {
-            "version": "0.4.23",
-            "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz",
-            "integrity": "sha512-ySPiMjM0+pLDftHgXY4By0uswI3SPKLDw/i3UXbnO8M/p28zqexCUoPmQFrYD+/1BzhGJSs2i1ERWKJAtiLrug==",
+            "version": "0.5.0",
+            "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.5.0.tgz",
+            "integrity": "sha512-drPFnkQJik/O+uPKpqSgr22mpuFHqKdbS835iAQrUC73L2F5WkboIRd63ai/2Yg6I1jzifPFKH2NTK+cfglkIA==",
             "dependencies": {
                 "sax": ">=0.6.0",
                 "xmlbuilder": "~11.0.0"
@@ -5271,6 +5283,17 @@
             "requires": {
                 "xml-parse-from-string": "^1.0.0",
                 "xml2js": "^0.4.5"
+            },
+            "dependencies": {
+                "xml2js": {
+                    "version": "0.4.23",
+                    "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz",
+                    "integrity": "sha512-ySPiMjM0+pLDftHgXY4By0uswI3SPKLDw/i3UXbnO8M/p28zqexCUoPmQFrYD+/1BzhGJSs2i1ERWKJAtiLrug==",
+                    "requires": {
+                        "sax": ">=0.6.0",
+                        "xmlbuilder": "~11.0.0"
+                    }
+                }
             }
         },
         "parse-headers": {
@@ -6182,9 +6205,9 @@
             "integrity": "sha1-qQKekp09vN7RafPG4oI42VpdWig="
         },
         "xml2js": {
-            "version": "0.4.23",
-            "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz",
-            "integrity": "sha512-ySPiMjM0+pLDftHgXY4By0uswI3SPKLDw/i3UXbnO8M/p28zqexCUoPmQFrYD+/1BzhGJSs2i1ERWKJAtiLrug==",
+            "version": "0.5.0",
+            "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.5.0.tgz",
+            "integrity": "sha512-drPFnkQJik/O+uPKpqSgr22mpuFHqKdbS835iAQrUC73L2F5WkboIRd63ai/2Yg6I1jzifPFKH2NTK+cfglkIA==",
             "requires": {
                 "sax": ">=0.6.0",
                 "xmlbuilder": "~11.0.0"
diff --git a/package.json b/package.json
index 23e5319..a235b7a 100644
--- a/package.json
+++ b/package.json
@@ -25,7 +25,7 @@
         "telegraf": "^3.38.0",
         "wechat4u": "^0.7.7",
         "winston": "^3.2.1",
-        "xml2js": "^0.4.23"
+        "xml2js": "^0.5.0"
     },
     "engines": {
         "node": ">=12.0.0"