diff --git a/.changeset/dependabot-ff5881d.md b/.changeset/dependabot-ff5881d.md
new file mode 100644
index 0000000000..d08ceea0e4
--- /dev/null
+++ b/.changeset/dependabot-ff5881d.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-code-coverage-backend': patch
+---
+
+Bump `xml2js` from 0.4.23 to 0.5.0
diff --git a/plugins/code-coverage-backend/package.json b/plugins/code-coverage-backend/package.json
index 5d43e8901f..bbf3134729 100644
--- a/plugins/code-coverage-backend/package.json
+++ b/plugins/code-coverage-backend/package.json
@@ -44,7 +44,7 @@
     "@types/supertest": "^2.0.8",
     "msw": "^1.0.0",
     "supertest": "^6.1.6",
-    "xml2js": "^0.4.23"
+    "xml2js": "^0.5.0"
   },
   "files": [
     "dist",
diff --git a/yarn.lock b/yarn.lock
index 8a8a3189cc..4787f793f5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5903,7 +5903,7 @@ __metadata:
     supertest: ^6.1.6
     uuid: ^8.3.2
     winston: ^3.2.1
-    xml2js: ^0.4.23
+    xml2js: ^0.5.0
     yn: ^4.0.0
   languageName: unknown
   linkType: soft
@@ -40429,6 +40429,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"xml2js@npm:^0.5.0":
+  version: 0.5.0
+  resolution: "xml2js@npm:0.5.0"
+  dependencies:
+    sax: ">=0.6.0"
+    xmlbuilder: ~11.0.0
+  checksum: 1aa71d62e5bc2d89138e3929b9ea46459157727759cbc62ef99484b778641c0cd21fb637696c052d901a22f82d092a3e740a16b4ce218e81ac59b933535124ea
+  languageName: node
+  linkType: hard
+
 "xml@npm:=1.0.1":
   version: 1.0.1
   resolution: "xml@npm:1.0.1"