Title: Bump fast-xml-parser from 5.5.7 to 5.7.1 by dependabot[bot] · Pull Request #3848 · github/codeql-action · GitHub
Open Graph Title: Bump fast-xml-parser from 5.5.7 to 5.7.1 by dependabot[bot] · Pull Request #3848 · github/codeql-action
X Title: Bump fast-xml-parser from 5.5.7 to 5.7.1 by dependabot[bot] · Pull Request #3848 · github/codeql-action
Description: Bumps fast-xml-parser from 5.5.7 to 5.7.1.
Release notes
Sourced from fast-xml-parser's releases.
upgrade @nodable/entities and FXB
Use @nodable/entities v2.1.0
breaking changes
single entity scan. You're not allowed to use entity value to form another entity name.
you cant add numeric external entity
entity error message when expantion limit is crossed might change
typings are updated for new options related to process entity
please follow documentation of @nodable/entities for more detail.
performance
if processEntities is false, then there should not be impact on performance.
if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
if processEntities is true, and you pass entity decoder separately
if no entity then performance should be same as before
if there are entities then performance should be increased from past versions
ignoreAttributes is not required to be set to set xml version for NCR entity value
update 'fast-xml-builder' to sanitize malicious CDATA and comment's content
use @nodable/entities to replace entities
No API change
No change in performance for basic usage
No typing change
No config change
new dependency
breaking: error messages for entities might have been changed.
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0
performance improvment, increase entity expansion default limit
increase default entity explansion limit as many projects demand for that
maxEntitySize: 10000,
maxExpansionDepth: 10000,
maxTotalExpansions: Infinity,
maxExpandedLength: 100000,
maxEntityCount: 1000,
performance improvement
reduce calls to toString
early return when entities are not present
prepare rawAttrsForMatcher only if user sets jPath: false
Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.9...v5.5.10
fix typins and matcher instance in callbacks
combine typings file to avoid configuration changes
pass readonly instance of matcher to the call backs to avoid accidental push/pop call
Changelog
Sourced from fast-xml-parser's changelog.
Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.
Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion
5.7.1 / 2026-04-20
fix #705: attributesGroupName working with preserveOrder
fix #817: stackoverflow when tag expression is very long
5.7.0 / 2026-04-17
Use @nodable/entities v2.1.0
breaking changes
single entity scan. You're not allowed to user entity value to form another entity name.
you cant add numeric external entity
entity error message when expantion limit is crossed might change
typings are updated for new options related to process entity
please follow documentation of @nodable/entities for more detail.
performance
if processEntities is false, then there should not be impact on performance.
if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
if processEntities is true, and you pass entity decoder separately
if no entity then performance should be same as before
if there are entities then performance should be increased from past versions
ignoreAttributes is not required to be set to set xml version for NCR entity value
update 'fast-xml-builder' to sanitize malicious CDATA and comment's content
5.6.0 / 2026-04-15
fix: entity replacement for numeric entities
use @nodable/entities to replace entities
this may change some error messages related to entities expansion limit or inavlid use
post check would be exposed in future version
5.5.12 / 2026-04-13
Performance Improvement: update path-expression-matcher
use proxy pattern than Proxy class
5.5.11 / 2026-04-08
Performance Improvement
integrate ExpressionSet for stopNodes
5.5.10 / 2026-04-03
increase default entity explansion limit as many projects demand for that
performance improvement
reduce calls to toString
early return when entities are not present
prepare rawAttrsForMatcher only if user sets jPath: false
5.5.9 / 2026-03-23
combine typing files
... (truncated)
Commits
0f08303 fix typo
f529642 update to release v5.7.0
52a8583 Revert "improve performance of attributes reading"
8d187f9 update builder
e174168 improve performance of attributes reading
79a8dde update docs
f5cd5a5 set xml version to decoder even if attributes are ignored
f44b923 remove unwanted tests
869ec8b Use @nodable/entities v2.1.0
7cb49e5 update release detail
Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show
Open Graph Description: Bumps fast-xml-parser from 5.5.7 to 5.7.1. Release notes Sourced from fast-xml-parser's releases. upgrade @nodable/entities and FXB Use @nodable/entities v2.1.0 breaking changes single en...
X Description: Bumps fast-xml-parser from 5.5.7 to 5.7.1. Release notes Sourced from fast-xml-parser's releases. upgrade @nodable/entities and FXB Use @nodable/entities v2.1.0 breaking changes singl...
Opengraph URL: https://github.com/github/codeql-action/pull/3848
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:f17e9fc5-435f-5ea0-b0b3-452d25a73b79 |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 9B5C:327B79:1AD2C79:25AD454:6A4CC6F0 |
| html-safe-nonce | e6db5349ac7e3fe052d76eb3afd4ecf4b7a84432871e775f82fe050d60bde488 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5QjVDOjMyN0I3OToxQUQyQzc5OjI1QUQ0NTQ6NkE0Q0M2RjAiLCJ2aXNpdG9yX2lkIjoiNTYwNjMyNTU0MTczNDc2MjIyNCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | 9b74b7906cc9f1a76281951d06788f6212dcdf07959a38b49f3949b45e61fd6c |
| hovercard-subject-tag | pull_request:3569795769 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/github/codeql-action/pull/3848/files |
| twitter:image | https://avatars.githubusercontent.com/in/29110?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/in/29110?s=400&v=4 |
| og:image:alt | Bumps fast-xml-parser from 5.5.7 to 5.7.1. Release notes Sourced from fast-xml-parser's releases. upgrade @nodable/entities and FXB Use @nodable/entities v2.1.0 breaking changes single en... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 3d11bb817438277de2a940854450e83a7d32b6aeb5014e9e6b00a6423900251c |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/github/codeql-action git https://github.com/github/codeql-action.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 259445878 |
| octolytics-dimension-repository_nwo | github/codeql-action |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 259445878 |
| octolytics-dimension-repository_network_root_nwo | github/codeql-action |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | d0da0eb92994395299ed4450bf67b0373005be36 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width