Skip to content

Upgrade: [dependabot] - bump fast-xml-parser and @aws-sdk/xml-builder#2586

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-8c3730b1f1
Open

Upgrade: [dependabot] - bump fast-xml-parser and @aws-sdk/xml-builder#2586
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/npm_and_yarn/multi-8c3730b1f1

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 24, 2026

Bumps fast-xml-parser and @aws-sdk/xml-builder. These dependencies needed to be updated together.
Updates fast-xml-parser from 5.5.8 to 5.7.1

Release notes

Sourced from fast-xml-parser's releases.

upgrade @​nodable/entities and FXB

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to use entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

use @​nodable/entities to replace entities

  • No API change
  • No change in performance for basic usage
  • No typing change
  • No config change
  • new dependency
  • breaking: error messages for entities might have been changed.

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0

performance improvment, increase entity expansion default limit

  • increase default entity explansion limit as many projects demand for that
maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,
  • performance improvement
    • reduce calls to toString
    • early return when entities are not present
    • prepare rawAttrsForMatcher only if user sets jPath: false

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.9...v5.5.10

fix typins and matcher instance in callbacks

combine typings file to avoid configuration changes pass readonly instance of matcher to the call backs to avoid accidental push/pop call

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

  • fix: entity replacement for numeric entities
  • use @​nodable/entities to replace entities
    • this may change some error messages related to entities expansion limit or inavlid use
    • post check would be exposed in future version

5.5.12 / 2026-04-13

  • Performance Improvement: update path-expression-matcher
    • use proxy pattern than Proxy class

5.5.11 / 2026-04-08

  • Performance Improvement
    • integrate ExpressionSet for stopNodes

5.5.10 / 2026-04-03

  • increase default entity explansion limit as many projects demand for that
  • performance improvement
    • reduce calls to toString
    • early return when entities are not present
    • prepare rawAttrsForMatcher only if user sets jPath: false

... (truncated)

Commits
  • 0f08303 fix typo
  • f529642 update to release v5.7.0
  • 52a8583 Revert "improve performance of attributes reading"
  • 8d187f9 update builder
  • e174168 improve performance of attributes reading
  • 79a8dde update docs
  • f5cd5a5 set xml version to decoder even if attributes are ignored
  • f44b923 remove unwanted tests
  • 869ec8b Use @​nodable/entities v2.1.0
  • 7cb49e5 update release detail
  • Additional commits viewable in compare view

Updates @aws-sdk/xml-builder from 3.972.18 to 3.972.19

Changelog

Sourced from @​aws-sdk/xml-builder's changelog.

3.972.19 (2026-04-23)

Chores

  • xml-builder: up fast-xml-parser to 5.7.1 (#7957) (110b1c0)
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Apr 24, 2026
Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot enabled auto-merge (squash) April 24, 2026 20:47
Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.5.8 to 5.7.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.5.8...v5.7.1)

Updates `@aws-sdk/xml-builder` from 3.972.18 to 3.972.19
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.19
  dependency-type: indirect
- dependency-name: fast-xml-parser
  dependency-version: 5.7.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-8c3730b1f1 branch from fcf48d8 to 7cb1e06 Compare April 25, 2026 12:47
Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

@sonarqubecloud
Copy link
Copy Markdown

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Copy link
Copy Markdown

@eps-autoapprove-dependabot eps-autoapprove-dependabot Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm approving this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants