Skip to content

chore(deps): bump fast-xml-parser and @aws-sdk/xml-builder#819

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d2fd79378c
Open

chore(deps): bump fast-xml-parser and @aws-sdk/xml-builder#819
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-d2fd79378c

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 30, 2026

Bumps fast-xml-parser and @aws-sdk/xml-builder. These dependencies needed to be updated together.
Updates fast-xml-parser from 5.5.8 to 5.7.3

Release notes

Sourced from fast-xml-parser's releases.

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

backward compatibility for numerical external entity, fix #705, #817

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

upgrade @​nodable/entities and FXB

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to use entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

use @​nodable/entities to replace entities

  • No API change
  • No change in performance for basic usage
  • No typing change
  • No config change
  • new dependency
  • breaking: error messages for entities might have been changed.

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0

performance improvment, increase entity expansion default limit

  • increase default entity explansion limit as many projects demand for that
maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,
  • performance improvement
    • reduce calls to toString
    • early return when entities are not present

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

  • fix: entity replacement for numeric entities
  • use @​nodable/entities to replace entities
    • this may change some error messages related to entities expansion limit or inavlid use
    • post check would be exposed in future version

... (truncated)

Commits
  • d6d8042 update to release
  • d263370 remove dev dependency 'he'
  • f9c9a2c update builder to 1.1.7
  • b65da87 update changelog and mark addEntity deprecated
  • c2ca631 update fxb
  • da75191 fix stop node expression when ns prefix is removed
  • 31bbc99 fix: alwaysCreateTextNode should create text node when attributes are present...
  • dab327a remove unnecessary
  • ab04eeb update docs
  • 383cb3f Revise security information for v6 release
  • Additional commits viewable in compare view

Updates @aws-sdk/xml-builder from 3.972.17 to 3.972.24

Changelog

Sourced from @​aws-sdk/xml-builder's changelog.

3.972.24 (2026-05-14)

Chores

3.972.23 (2026-05-12)

Chores

  • scripts: add submodule variant api surface parity linting (#8006) (3361fb2)

3.972.22 (2026-04-28)

Bug Fixes

  • xml-builder: inline nodable/entities for dist format compatibility (#7968) (02b6be6)

Chores

  • xml-builder: manual version bump for 3.972.21 release (#7969) (99bfb4b)

3.972.21 (2026-04-27)

Bug Fixes

  • xml-builder: fix(xml-builder): inline nodable/entities for dist format compatibility (#7968)

3.972.20 (2026-04-27)

Bug Fixes

  • xml-builder: use xml 1.1 parsing behavior for entities (#7964) (7a30bce)

3.972.19 (2026-04-23)

Chores

  • xml-builder: up fast-xml-parser to 5.7.1 (#7957) (110b1c0)

3.972.18 (2026-04-16)

Chores

Commits

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 30, 2026

Labels

The following labels could not be found: npm dependencies. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions
Copy link
Copy Markdown


══════════════════════════════════════════════════════════════════════
  FULL BUNDLE: cwr.js
══════════════════════════════════════════════════════════════════════
  Total:  161.6 KB raw  /  49.2 KB gzip  (EXACT)
──────────────────────────────────────────────────────────────────────
  Category                              Raw % of total
──────────────────────────────────────────────────────────────────────
  rrweb                             67.3 KB      41.7%
  app: plugins                      26.8 KB      16.6%
  aws-sdk/smithy                    17.6 KB      10.9%
  web-vitals                        10.8 KB       6.7%
  app: dispatch                     10.2 KB       6.3%
  app: sessions                      5.7 KB       3.6%
  app: orchestration                 5.2 KB       3.2%
  app: auth                          4.6 KB       2.8%
  app: event-cache                   4.0 KB       2.5%
  app: utils                         2.8 KB       1.7%
  app: other                         1.7 KB       1.1%
  tslib                              1.5 KB       0.9%
  shimmer                            1.4 KB       0.9%
  uuid                               0.8 KB       0.5%
  app: event-bus                     0.4 KB       0.3%
  app: remote-config                 0.4 KB       0.2%
  webpack runtime                    0.1 KB       0.1%
  (unattributed/boilerplate)         0.1 KB       0.1%
──────────────────────────────────────────────────────────────────────
  Sizes are EXACT (from source map character attribution).
  Gzip total is EXACT. Per-category gzip is not shown (not additive).

  All modules (110):
       15.5 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb-snapshot/es/rrweb-snapshot.js
       11.2 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/observer.js
       10.8 KB  ../../node_modules/web-vitals/dist/web-vitals.attribution.js
        7.7 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/mutation.js
        6.8 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/index.js
        6.8 KB  ../../node_modules/rrweb/es/rrweb/_virtual/image-bitmap-data-url-worker.js
        4.2 KB  ../core/src/dispatch/Dispatch.ts
        4.1 KB  ../core/src/plugins/event-plugins/NavigationPlugin.ts
        4.0 KB  ../core/src/event-cache/EventCache.ts
        3.8 KB  ../core/src/plugins/event-plugins/XhrPlugin.ts
        3.4 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/utils.js
        3.4 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/iframe-manager.js
        3.3 KB  ../core/src/sessions/SessionManager.ts
        3.3 KB  ../core/src/plugins/event-plugins/RRWebPlugin.ts
        3.1 KB  ../slim/src/orchestration/Orchestration.ts
        3.1 KB  ../../node_modules/@smithy/signature-v4/dist-es/SignatureV4.js
        2.9 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/observers/canvas/canvas-manager.js
        2.8 KB  ../core/src/plugins/event-plugins/FetchPlugin.ts
        2.5 KB  ../core/src/plugins/event-plugins/WebVitalsPlugin.ts
        2.4 KB  ../core/src/sessions/PageManager.ts
        2.4 KB  ../core/src/dispatch/CognitoIdentityClient.ts
        2.3 KB  ../../node_modules/@smithy/signature-v4/dist-es/HeaderFormatter.js
        2.2 KB  ../../node_modules/@smithy/fetch-http-handler/dist-es/fetch-http-handler.js
        2.2 KB  ../core/src/plugins/utils/http-utils.ts
        2.0 KB  ../core/src/plugins/event-plugins/DomEventPlugin.ts
        1.8 KB  ../../node_modules/@aws-crypto/sha256-js/build/module/RawSha256.js
        1.8 KB  ../core/src/dispatch/DataPlaneClient.ts
        1.6 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/observers/canvas/serialize-args.js
        1.5 KB  ../../node_modules/tslib/tslib.es6.mjs
        1.4 KB  ../../node_modules/shimmer/index.js
        1.3 KB  ./src/orchestration/Orchestration.ts
        1.3 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/shadow-dom-manager.js
        1.2 KB  ../core/src/plugins/event-plugins/ResourcePlugin.ts
        1.2 KB  ../core/src/utils/common-utils.ts
        1.2 KB  ../../node_modules/@smithy/signature-v4/dist-es/SignatureV4Base.js
        1.2 KB  ../../node_modules/rrweb/es/rrweb/packages/types/dist/types.js
        1.2 KB  ../slim/src/CommandQueue.ts
        1.0 KB  ../core/src/dispatch/FetchHttpHandler.ts
        1.0 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/cross-origin-iframe-mirror.js
        1.0 KB  ../core/src/dispatch/Authentication.ts
        1.0 KB  ../core/src/plugins/event-plugins/JsErrorPlugin.ts
        0.9 KB  ../core/src/plugins/event-plugins/PageViewPlugin.ts
        0.9 KB  ../core/src/utils/InternalLogger.ts
        0.9 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/stylesheet-manager.js
        0.9 KB  ../core/src/dispatch/StsClient.ts
        0.9 KB  ../core/src/plugins/PluginManager.ts
        0.9 KB  ../../node_modules/@aws-crypto/sha256-js/build/module/jsSha256.js
        0.9 KB  ../../node_modules/@smithy/protocol-http/dist-es/httpRequest.js
        0.8 KB  ../../node_modules/@aws-crypto/sha256-js/build/module/constants.js
        0.8 KB  ../core/src/plugins/utils/js-error-utils.ts
        0.8 KB  ../core/src/dispatch/BasicAuthentication.ts
        0.7 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/observers/canvas/webgl.js
        0.7 KB  ../core/src/dispatch/compression.ts
        0.6 KB  ../../node_modules/rrweb/es/rrweb/ext/tslib/tslib.es6.js
        0.6 KB  ../../node_modules/@smithy/signature-v4/dist-es/constants.js
        0.6 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/observers/canvas/2d.js
        0.5 KB  ../core/src/dispatch/EnhancedAuthentication.ts
        0.5 KB  ../../node_modules/@smithy/util-hex-encoding/dist-es/index.js
        0.5 KB  ../core/src/dispatch/RetryHttpHandler.ts
        0.5 KB  ../../node_modules/rrweb/es/rrweb/_virtual/_rollup-plugin-web-worker-loader__helper__browser__createBase64WorkerFactory.js
        0.4 KB  ../core/src/orchestration/config.ts
        0.4 KB  ../../node_modules/rrweb/es/rrweb/ext/base64-arraybuffer/dist/base64-arraybuffer.es5.js
        0.4 KB  ../core/src/plugins/utils/constant.ts
        0.4 KB  ../core/src/event-bus/EventBus.ts
        0.4 KB  ../core/src/utils/cookies-utils.ts
        0.4 KB  ../core/src/plugins/MonkeyPatched.ts
        0.4 KB  ../../node_modules/@smithy/signature-v4/dist-es/credentialDerivation.js
        0.4 KB  ./src/remote-config/remote-config.ts
        0.3 KB  ../core/src/dispatch/BeaconHttpHandler.ts
        0.3 KB  ./src/orchestration/config.ts
        0.3 KB  ../../node_modules/rrweb/es/rrweb/packages/rrweb/src/record/observers/canvas/canvas.js
        0.3 KB  ../../node_modules/@smithy/signature-v4/dist-es/getCanonicalQuery.js
        0.3 KB  ./src/dispatch/signing.ts
        0.3 KB  ../../node_modules/@smithy/signature-v4/dist-es/getPayloadHash.js
        0.3 KB  ../../node_modules/uuid/dist/esm-browser/rng.js
        0.3 KB  ./src/CommandQueue.ts
        0.3 KB  ../../node_modules/@aws-crypto/util/build/module/convertToBuffer.js
        0.3 KB  ../../node_modules/uuid/dist/esm-browser/stringify.js
        0.3 KB  ../../node_modules/rrweb/es/rrweb/_virtual/_rollup-plugin-web-worker-loader__helper__node__createBase64WorkerFactory.js
        0.3 KB  ../core/src/plugins/utils/performance-utils.ts
        0.3 KB  ../../node_modules/@smithy/protocol-http/dist-es/httpResponse.js
        0.3 KB  ../core/src/plugins/InternalPlugin.ts
        0.2 KB  ../../node_modules/rrweb/es/rrweb/_virtual/_rollup-plugin-web-worker-loader__helper__node__WorkerClass.js
        0.2 KB  ../../node_modules/@smithy/signature-v4/dist-es/moveHeadersToQuery.js
        0.2 KB  ../../node_modules/@smithy/querystring-builder/dist-es/index.js
        0.2 KB  ../../node_modules/@smithy/signature-v4/dist-es/getCanonicalHeaders.js
        0.2 KB  ./src/index-browser.ts
        0.2 KB  ../core/src/dispatch/utils.ts
        0.2 KB  ../../node_modules/uuid/dist/esm-browser/v4.js
        0.2 KB  ../../node_modules/@smithy/signature-v4/dist-es/utilDate.js
        0.2 KB  ../../node_modules/@smithy/fetch-http-handler/dist-es/request-timeout.js
        0.1 KB  ../../node_modules/@smithy/util-utf8/dist-es/toUint8Array.js
        0.1 KB  ../core/src/dispatch/request-timeout.ts
        0.1 KB  ../core/src/utils/random.ts
        0.1 KB  webpack/bootstrap
        0.1 KB  ../../node_modules/@smithy/is-array-buffer/dist-es/index.js
        0.1 KB  ../../node_modules/@smithy/signature-v4/dist-es/prepareRequest.js
        0.1 KB  ../../node_modules/@smithy/util-uri-escape/dist-es/escape-uri.js
        0.1 KB  ../../node_modules/@smithy/signature-v4/dist-es/headerUtil.js
        0.1 KB  ../../node_modules/rrweb/es/rrweb/_virtual/_rollup-plugin-web-worker-loader__helper__auto__isNodeJS.js
        0.1 KB  ../../node_modules/uuid/dist/esm-browser/native.js
        0.1 KB  ../core/src/errors/XhrError.ts
        0.1 KB  ../../node_modules/@smithy/util-middleware/dist-es/normalizeProvider.js
        0.1 KB  ../core/src/utils/constants.ts
        0.1 KB  ../../node_modules/@aws-crypto/util/build/module/isEmptyData.js
        0.0 KB  ../../node_modules/rrweb/es/rrweb/_virtual/_rollup-plugin-web-worker-loader__helper__auto__createBase64WorkerFactory.js
        0.0 KB  ../../node_modules/@smithy/fetch-http-handler/dist-es/create-request.js
        0.0 KB  ../../node_modules/@smithy/util-utf8/dist-es/fromUtf8.browser.js
        0.0 KB  ../../node_modules/@aws-crypto/util/node_modules/@smithy/util-utf8/dist-es/fromUtf8.browser.js
        0.0 KB  ../core/src/utils/version.ts


══════════════════════════════════════════════════════════════════════
  SLIM BUNDLE: cwr-slim.js
══════════════════════════════════════════════════════════════════════
  Total:  31.7 KB raw  /  9.7 KB gzip  (EXACT)
──────────────────────────────────────────────────────────────────────
  Category                              Raw % of total
──────────────────────────────────────────────────────────────────────
  app: dispatch                      8.7 KB      27.4%
  app: sessions                      5.7 KB      18.1%
  app: event-cache                   4.0 KB      12.7%
  app: orchestration                 3.5 KB      11.2%
  app: plugins                       2.7 KB       8.4%
  aws-sdk/smithy                     1.4 KB       4.6%
  app: utils                         1.4 KB       4.4%
  shimmer                            1.4 KB       4.4%
  app: other                         1.4 KB       4.4%
  uuid                               0.8 KB       2.7%
  app: event-bus                     0.4 KB       1.3%
  webpack runtime                    0.1 KB       0.4%
──────────────────────────────────────────────────────────────────────
  Sizes are EXACT (from source map character attribution).
  Gzip total is EXACT. Per-category gzip is not shown (not additive).

  All modules (35):
        4.2 KB  web-slim/../core/src/dispatch/Dispatch.ts
        4.0 KB  web-slim/../core/src/event-cache/EventCache.ts
        3.3 KB  web-slim/../core/src/sessions/SessionManager.ts
        3.1 KB  web-slim/./src/orchestration/Orchestration.ts
        2.4 KB  web-slim/../core/src/sessions/PageManager.ts
        1.8 KB  web-slim/../core/src/dispatch/DataPlaneClient.ts
        1.4 KB  web-slim/../../node_modules/shimmer/index.js
        1.2 KB  web-slim/./src/CommandQueue.ts
        1.0 KB  web-slim/../core/src/dispatch/FetchHttpHandler.ts
        0.9 KB  web-slim/../core/src/plugins/event-plugins/PageViewPlugin.ts
        0.9 KB  web-slim/../core/src/utils/InternalLogger.ts
        0.9 KB  web-slim/../core/src/plugins/PluginManager.ts
        0.9 KB  web-slim/../../node_modules/@smithy/protocol-http/dist-es/httpRequest.js
        0.7 KB  web-slim/../core/src/dispatch/compression.ts
        0.5 KB  web-slim/../core/src/dispatch/RetryHttpHandler.ts
        0.4 KB  web-slim/../core/src/orchestration/config.ts
        0.4 KB  web-slim/../core/src/event-bus/EventBus.ts
        0.4 KB  web-slim/../core/src/utils/cookies-utils.ts
        0.4 KB  web-slim/../core/src/plugins/MonkeyPatched.ts
        0.3 KB  web-slim/../core/src/dispatch/BeaconHttpHandler.ts
        0.3 KB  web-slim/../../node_modules/uuid/dist/esm-browser/rng.js
        0.3 KB  web-slim/../../node_modules/uuid/dist/esm-browser/stringify.js
        0.3 KB  web-slim/../../node_modules/@smithy/protocol-http/dist-es/httpResponse.js
        0.2 KB  web-slim/../core/src/plugins/InternalPlugin.ts
        0.2 KB  web-slim/../../node_modules/@smithy/querystring-builder/dist-es/index.js
        0.2 KB  web-slim/./src/index-browser.ts
        0.2 KB  web-slim/../../node_modules/uuid/dist/esm-browser/v4.js
        0.1 KB  web-slim/../core/src/dispatch/request-timeout.ts
        0.1 KB  web-slim/../core/src/plugins/utils/http-utils.ts
        0.1 KB  web-slim/webpack/bootstrap
        0.1 KB  web-slim/../../node_modules/@smithy/util-uri-escape/dist-es/escape-uri.js
        0.1 KB  web-slim/../core/src/plugins/utils/constant.ts
        0.1 KB  web-slim/../../node_modules/uuid/dist/esm-browser/native.js
        0.1 KB  web-slim/../core/src/utils/constants.ts
        0.0 KB  web-slim/../core/src/utils/version.ts

  Slim saves 80% gzip vs full (EXACT).

Report written to reports/bundle-stats-both.txt

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-d2fd79378c branch 2 times, most recently from 8a0b72a to 493ee96 Compare May 4, 2026 19:39
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) and [@aws-sdk/xml-builder](https://github.com/aws/aws-sdk-js-v3/tree/HEAD/packages-internal/xml-builder). These dependencies needed to be updated together.

Updates `fast-xml-parser` from 5.5.8 to 5.7.3
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v5.5.8...v5.7.3)

Updates `@aws-sdk/xml-builder` from 3.972.17 to 3.972.24
- [Release notes](https://github.com/aws/aws-sdk-js-v3/releases)
- [Changelog](https://github.com/aws/aws-sdk-js-v3/blob/main/packages-internal/xml-builder/CHANGELOG.md)
- [Commits](https://github.com/aws/aws-sdk-js-v3/commits/HEAD/packages-internal/xml-builder)

---
updated-dependencies:
- dependency-name: "@aws-sdk/xml-builder"
  dependency-version: 3.972.22
  dependency-type: indirect
- dependency-name: fast-xml-parser
  dependency-version: 5.7.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-d2fd79378c branch from 493ee96 to decf68f Compare May 19, 2026 18:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants