swap XML library

[paustint]

xmlbuilder2 no longer works in browsers with their latest update which prompted this change

the new XML parser is usable in browser environments with one 1 dependency
and was already a transient dependency

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	react@​19.2.0
	prism-react-renderer@​2.4.1
	typescript@​5.9.3
	react-dom@​19.2.0

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[Copilot]

Pull request overview

This PR replaces the XML-to-object parsing approach used by the Salesforce API client to restore browser compatibility after xmlbuilder2’s browser parsing regressions, by introducing fast-xml-parser and normalizing SOAP/XML response shapes.

Changes:

• Add fast-xml-parser and update XML parsing in callout-adapter to return namespace-stripped object shapes (Envelope/Body/Header).
• Update Salesforce SOAP response typings/usages to align with the new parsed structure (e.g., Envelope instead of ns1:Envelope / soapenv:Envelope).
• Add/expand Vitest coverage around SOAP/XML parsing for callouts, Metadata API, and Bulk API.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
yarn.lock	Locks new/updated dependency graph for fast-xml-parser + xmlbuilder2 updates.
package.json	Adds fast-xml-parser dependency and bumps xmlbuilder2.
libs/types/src/lib/salesforce/apex.types.ts	Updates SOAP envelope typing keys to match namespace-stripped parsing.
libs/shared/utils/src/lib/utils.ts	Broadens getValueOrSoapNull return type to include parsed booleans/numbers.
libs/salesforce-api/src/lib/types.ts	Updates shared SOAP response types to use Envelope key.
libs/salesforce-api/src/lib/callout-adapter.ts	Replaces xmlbuilder2 parsing with fast-xml-parser and adds parseXml().
libs/salesforce-api/src/lib/api-metadata.ts	Updates SOAP response access paths for metadata calls to Envelope.
libs/salesforce-api/src/lib/api-apex.ts	Updates SOAP response access paths for Apex calls to Envelope.
libs/salesforce-api/src/lib/tests/callout-adapter.spec.ts	Adds tests validating SOAP/XML parsing behavior and error extraction.
libs/salesforce-api/src/lib/tests/api-metadata.spec.ts	Adds tests validating metadata SOAP parsing + type normalization.
libs/salesforce-api/src/lib/tests/api-bulk.spec.ts	Adds tests validating bulk XML parsing + numeric conversions.

Comments suppressed due to low confidence (1)

libs/types/src/lib/salesforce/apex.types.ts:16

• These SOAP response field unions use SoapNil, but SoapNil is currently modeled as { $: { 'xsi:nil': 'true' } } while the new fast-xml-parser based parsing appears to yield attribute-driven shapes (e.g. { '@xsi:nil': 'true' }). Consider updating SoapNil (or widening these unions) so types match the parsed runtime shape.

        result: {
          column: string | SoapNil;
          compileProblem: string | SoapNil;
          compiled: string | SoapNil;
          exceptionMessage: string | SoapNil;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.