Skip to content

Bump @xmldom/xmldom from 0.7.13 to 0.8.13#16038

Open
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/xmldom/xmldom-0.8.13
Open

Bump @xmldom/xmldom from 0.7.13 to 0.8.13#16038
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/xmldom/xmldom-0.8.13

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 23, 2026

Bumps @xmldom/xmldom from 0.7.13 to 0.8.13.

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

0.8.10

Commits

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

  • updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

... (truncated)

Commits
  • e5c1480 0.8.13
  • 9611e20 style: drop unused import in test file
  • dc4dff3 docs: add 0.8.13 changelog entry
  • 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
  • aeff69f test: add normalize behavioral coverage to node.test.js
  • cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
  • 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
  • c007c51 refactor: migrate serializeToString to walkDOM
  • 2bb3899 test: add serializeToString coverage for uncovered branches
  • e69f38d refactor: migrate importNode to walkDOM
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.
###### Microsoft Reviewers: [Open in CodeFlow](https://microsoft.github.io/open-pr/?codeflow=https://github.com//pull/16038)

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 23, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 23, 2026 00:15
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 23, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 23, 2026

Performance Test Results

Branch: dependabot/npm_and_yarn/xmldom/xmldom-0.8.13
Commit: 7b515731
Time: 2026-05-20T08:07:06.338Z
Tests: 161/161 passed

✅ Passed

161 scenario(s) across 28 suite(s) — no regressions

SectionList

Scenario Mean Median StdDev Renders vs Baseline
SectionList mount 5.10ms 5.00ms ±1.45ms 1 +0.0%
SectionList unmount 0.20ms 0.00ms ±0.42ms 0 +0.0%
SectionList rerender 11.80ms 11.00ms ±1.81ms 2 +4.8%
SectionList with-3-sections-15-items 5.70ms 5.00ms ±1.34ms 1 -9.1%
SectionList with-5-sections-50-items 6.20ms 5.00ms ±2.25ms 1 -16.7%
SectionList with-10-sections-200-items 8.60ms 5.50ms ±8.34ms 1 +0.0%
SectionList with-20-sections-200-items 5.10ms 5.00ms ±1.52ms 1 +0.0%
SectionList with-section-separator 2.20ms 2.00ms ±1.14ms 1 +0.0%
SectionList with-item-separator 2.10ms 2.00ms ±0.32ms 1 +0.0%
SectionList with-header-footer 2.00ms 2.00ms ±0.00ms 1 +0.0%
SectionList with-section-footer 1.90ms 2.00ms ±0.32ms 1 +0.0%
SectionList with-sticky-section-headers 2.00ms 2.00ms ±0.00ms 1 +0.0%
SectionList with-empty-list 0.50ms 0.50ms ±0.53ms 1 -50.0%
SectionList with-50-sections-1000-items 1.90ms 2.00ms ±0.32ms 1 +0.0%

FlatList

Scenario Mean Median StdDev Renders vs Baseline
FlatList mount 4.80ms 4.00ms ±1.23ms 1 +0.0%
FlatList unmount 0.10ms 0.00ms ±0.32ms 0 +0.0%
FlatList rerender 9.10ms 9.00ms ±1.10ms 2 +0.0%
FlatList with-10-items 4.60ms 5.00ms ±0.70ms 1 +25.0%
FlatList with-100-items 5.20ms 5.00ms ±1.23ms 1 +0.0%
FlatList with-500-items 4.70ms 4.00ms ±1.64ms 1 +0.0%
FlatList with-1000-items 4.70ms 4.50ms ±1.16ms 1 +12.5%
FlatList horizontal 4.50ms 4.00ms ±1.96ms 1 -20.0%
FlatList with-separator 1.50ms 1.50ms ±0.53ms 1 -25.0%
FlatList with-header-footer 2.00ms 2.00ms ±1.15ms 1 +0.0%
FlatList with-empty-list 0.50ms 0.50ms ±0.53ms 1 +0.0%
FlatList with-get-item-layout 1.50ms 1.50ms ±0.53ms 1 +50.0%
FlatList inverted 1.50ms 1.50ms ±0.53ms 1 +0.0%
FlatList with-num-columns 3.30ms 3.00ms ±1.77ms 1 +0.0%

TouchableOpacity

Scenario Mean Median StdDev Renders vs Baseline
TouchableOpacity mount 1.00ms 1.00ms ±0.00ms 1 +0.0%
TouchableOpacity unmount 0.10ms 0.00ms ±0.32ms 0 +0.0%
TouchableOpacity rerender 1.00ms 1.00ms ±0.47ms 2 +0.0%
TouchableOpacity custom-active-opacity 0.80ms 1.00ms ±0.42ms 1 +0.0%
TouchableOpacity disabled 0.70ms 1.00ms ±0.48ms 1 +0.0%
TouchableOpacity with-all-handlers 0.70ms 1.00ms ±0.48ms 1 +0.0%
TouchableOpacity with-hit-slop 1.00ms 1.00ms ±1.15ms 1 +0.0%
TouchableOpacity with-delay 0.60ms 1.00ms ±0.52ms 1 +0.0%
TouchableOpacity nested 1.40ms 1.00ms ±0.52ms 1 +0.0%
TouchableOpacity multiple-10 5.40ms 5.00ms ±1.35ms 1 -16.7%
TouchableOpacity multiple-50 25.67ms 25.00ms ±2.82ms 1 -13.8%
TouchableOpacity multiple-100 34.07ms 26.00ms ±13.50ms 1 -48.0%

ScrollView

Scenario Mean Median StdDev Renders vs Baseline
ScrollView mount 0.60ms 0.00ms ±0.97ms 1 +0.0%
ScrollView unmount 0.00ms 0.00ms ±0.00ms 0 +0.0%
ScrollView rerender 0.40ms 0.00ms ±0.52ms 2 -100.0%
ScrollView children-20 2.87ms 3.00ms ±0.64ms 1 -25.0%
ScrollView children-100 16.07ms 16.00ms ±2.37ms 1 +0.0%
ScrollView horizontal 2.90ms 3.00ms ±0.57ms 1 -25.0%
ScrollView sticky-headers 3.80ms 4.00ms ±1.32ms 1 +33.3%
ScrollView scroll-indicators 0.90ms 1.00ms ±0.57ms 1 +0.0%
ScrollView nested 1.20ms 1.00ms ±0.63ms 1 +0.0%
ScrollView content-container-style 0.60ms 1.00ms ±0.52ms 1 +0.0%
ScrollView children-500 19.60ms 19.00ms ±2.20ms 1 +0.0%

TouchableHighlight

Scenario Mean Median StdDev Renders vs Baseline
TouchableHighlight mount 0.40ms 0.00ms ±0.52ms 1 -100.0%
TouchableHighlight unmount 0.10ms 0.00ms ±0.32ms 0 +0.0%
TouchableHighlight rerender 0.70ms 1.00ms ±0.48ms 2 +0.0%
TouchableHighlight custom-underlay-color 0.90ms 0.50ms ±1.52ms 1 +Infinity%
TouchableHighlight custom-active-opacity 0.30ms 0.00ms ±0.48ms 1 +0.0%
TouchableHighlight disabled 0.50ms 0.50ms ±0.53ms 1 +Infinity%
TouchableHighlight with-all-handlers 0.40ms 0.00ms ±0.52ms 1 +0.0%
TouchableHighlight with-hit-slop 0.30ms 0.00ms ±0.48ms 1 +0.0%
TouchableHighlight nested-touchables 1.00ms 1.00ms ±0.00ms 1 +0.0%
TouchableHighlight multiple-touchables-10 2.40ms 2.50ms ±0.70ms 1 -16.7%
TouchableHighlight multiple-touchables-50 13.20ms 12.50ms ±2.04ms 1 +0.0%
TouchableHighlight multiple-touchables-100 23.40ms 23.50ms ±3.57ms 1 +4.4%

Pressable

Scenario Mean Median StdDev Renders vs Baseline
Pressable mount 0.40ms 0.00ms ±0.52ms 1 +0.0%
Pressable unmount 0.00ms 0.00ms ±0.00ms 0 +0.0%
Pressable rerender 0.60ms 1.00ms ±0.52ms 2 +100.0%
Pressable with-all-handlers 0.30ms 0.00ms ±0.48ms 1 +0.0%
Pressable with-style-function 0.30ms 0.00ms ±0.48ms 1 +0.0%
Pressable disabled 0.40ms 0.00ms ±0.52ms 1 +0.0%
Pressable with-hit-slop 0.30ms 0.00ms ±0.48ms 1 +0.0%
Pressable nested 0.70ms 1.00ms ±0.48ms 1 +0.0%
Pressable multiple-10 3.47ms 3.00ms ±1.13ms 1 +0.0%
Pressable multiple-50 16.60ms 17.00ms ±2.29ms 1 +21.4%
Pressable multiple-100 17.73ms 12.00ms ±10.67ms 1 +0.0%

Modal

Scenario Mean Median StdDev Renders vs Baseline
Modal mount 0.20ms 0.00ms ±0.42ms 1 +0.0%
Modal unmount 0.00ms 0.00ms ±0.00ms 0 +0.0%
Modal rerender 0.30ms 0.00ms ±0.48ms 2 +0.0%
Modal slide-animation 0.30ms 0.00ms ±0.48ms 1 +0.0%
Modal fade-animation 0.30ms 0.00ms ±0.48ms 1 +0.0%
Modal transparent 0.40ms 0.00ms ±0.52ms 1 +0.0%
Modal with-callbacks 0.10ms 0.00ms ±0.32ms 1 +0.0%
Modal rich-content 1.50ms 1.50ms ±0.53ms 1 -25.0%
Modal with-accessibility 0.30ms 0.00ms ±0.48ms 1 +0.0%

Image

Scenario Mean Median StdDev Renders vs Baseline
Image mount 0.20ms 0.00ms ±0.42ms 1 +0.0%
Image unmount 0.00ms 0.00ms ±0.00ms 0 +0.0%
Image rerender 0.30ms 0.00ms ±0.48ms 2 +0.0%
Image with-resize-mode 0.10ms 0.00ms ±0.32ms 1 +0.0%
Image with-border-radius 0.00ms 0.00ms ±0.00ms 1 +0.0%
Image with-tint-color 0.10ms 0.00ms ±0.32ms 1 +0.0%
Image with-blur-radius 0.10ms 0.00ms ±0.32ms 1 +0.0%
Image with-accessibility 0.20ms 0.00ms ±0.42ms 1 +0.0%
Image multiple-10 1.00ms 1.00ms ±0.00ms 1 +0.0%
Image multiple-50 3.93ms 4.00ms ±0.26ms 1 +33.3%
Image multiple-100 8.27ms 8.00ms ±1.22ms 1 +0.0%

ActivityIndicator

Scenario Mean Median StdDev Renders vs Baseline
ActivityIndicator mount 0.20ms 0.00ms ±0.42ms 1 +0.0%
ActivityIndicator unmount 0.30ms 0.00ms ±0.95ms 0 +0.0%
ActivityIndicator rerender 0.30ms 0.00ms ±0.48ms 2 +0.0%
ActivityIndicator size-large 0.10ms 0.00ms ±0.32ms 1 +0.0%
ActivityIndicator size-small 0.20ms 0.00ms ±0.42ms 1 +0.0%
ActivityIndicator with-color 0.20ms 0.00ms ±0.42ms 1 +0.0%
ActivityIndicator not-animating 0.10ms 0.00ms ±0.32ms 1 +0.0%
ActivityIndicator with-accessibility 0.20ms 0.00ms ±0.42ms 1 +0.0%
ActivityIndicator multiple-10 1.00ms 1.00ms ±0.00ms 1 +0.0%
ActivityIndicator multiple-50 3.60ms 4.00ms ±0.51ms 1 +0.0%
ActivityIndicator multiple-100 7.87ms 8.00ms ±0.92ms 1 +14.3%

Switch

Scenario Mean Median StdDev Renders vs Baseline
Switch mount 0.30ms 0.00ms ±0.48ms 1 +0.0%
Switch unmount 0.00ms 0.00ms ±0.00ms 0 +0.0%
Switch rerender 0.40ms 0.00ms ±0.52ms 2 -100.0%
Switch value-true 0.40ms 0.00ms ±0.52ms 1 +0.0%
Switch disabled 0.30ms 0.00ms ±0.48ms 1 +0.0%
Switch custom-colors 0.30ms 0.00ms ±0.67ms 1 +0.0%
Switch on-value-change 0.30ms 0.00ms ±0.48ms 1 +0.0%
Switch with-accessibility 0.30ms 0.00ms ±0.48ms 1 +0.0%
Switch multiple-10 2.00ms 2.00ms ±0.93ms 1 +0.0%
Switch multiple-50 9.60ms 8.00ms ±2.59ms 1 -11.1%
Switch multiple-100 23.07ms 21.00ms ±6.69ms 1 +31.3%

Button

Scenario Mean Median StdDev Renders vs Baseline
Button mount 0.70ms 1.00ms ±0.48ms 1 +0.0%
Button unmount 0.10ms 0.00ms ±0.32ms 0 +0.0%
Button rerender 0.90ms 1.00ms ±0.57ms 2 +0.0%
Button disabled 0.60ms 1.00ms ±0.52ms 1 +0.0%
Button with-color 0.50ms 0.50ms ±0.53ms 1 +0.0%
Button with-accessibility 0.60ms 1.00ms ±0.52ms 1 +0.0%
Button multiple-10 5.67ms 5.00ms ±1.23ms 1 -16.7%
Button multiple-50 21.27ms 25.00ms ±7.91ms 1 -7.4%
Button multiple-100 16.13ms 16.00ms ±2.13ms 1 -15.8%

TextInput

Scenario Mean Median StdDev Renders vs Baseline
TextInput mount 0.20ms 0.00ms ±0.42ms 1 +0.0%
TextInput unmount 0.00ms 0.00ms ±0.00ms 0 +0.0%
TextInput rerender 0.30ms 0.00ms ±0.48ms 2 +0.0%
TextInput multiline 0.10ms 0.00ms ±0.32ms 1 +0.0%
TextInput with-value 0.10ms 0.00ms ±0.32ms 1 +0.0%
TextInput styled 0.20ms 0.00ms ±0.42ms 1 +0.0%
TextInput multiple-100 7.67ms 8.00ms ±1.59ms 1 +14.3%

View

Scenario Mean Median StdDev Renders vs Baseline
View mount 0.20ms 0.00ms ±0.42ms 1 +0.0%
View unmount 0.10ms 0.00ms ±0.32ms 0 +0.0%
View rerender 0.10ms 0.00ms ±0.32ms 2 +0.0%
View nested-50 3.27ms 3.00ms ±0.59ms 1 +0.0%
View nested-100 7.73ms 8.00ms ±1.33ms 1 +14.3%
View shadow 0.20ms 0.00ms ±0.42ms 1 +0.0%
View border-radius 0.10ms 0.00ms ±0.32ms 1 +0.0%
View nested-500 16.67ms 10.00ms ±12.33ms 1 +0.0%

Text

Scenario Mean Median StdDev Renders vs Baseline
Text mount 0.20ms 0.00ms ±0.42ms 1 +0.0%
Text unmount 0.00ms 0.00ms ±0.00ms 0 +0.0%
Text rerender 0.20ms 0.00ms ±0.42ms 2 +0.0%
Text long-1000 0.20ms 0.00ms ±0.42ms 1 +0.0%
Text nested 0.20ms 0.00ms ±0.42ms 1 +0.0%
Text styled 0.20ms 0.00ms ±0.42ms 1 +0.0%
Text multiple-100 8.00ms 8.00ms ±1.51ms 1 +14.3%

SectionList.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
SectionList native mount 4.47ms 4.43ms ±0.37ms 1 -31.8%

FlatList.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
FlatList native mount 4.30ms 4.19ms ±0.64ms 1 -54.6%

TouchableHighlight.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
TouchableHighlight native mount 1.32ms 1.28ms ±0.14ms 1 -38.8%

TouchableOpacity.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
TouchableOpacity native mount 1.54ms 1.47ms ±0.20ms 1 -53.2%

Pressable.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
Pressable native mount 1.34ms 1.31ms ±0.11ms 1 -48.0%

ScrollView.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
ScrollView native mount 3.13ms 3.10ms ±0.25ms 1 -23.4%

ActivityIndicator.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
ActivityIndicator native mount 1.37ms 1.15ms ±0.60ms 1 -53.6%

TextInput.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
TextInput native mount 1.83ms 1.75ms ±0.25ms 1 -57.3%

Switch.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
Switch native mount 1.24ms 1.06ms ±0.49ms 1 -38.7%

Button.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
Button native mount 1.61ms 1.56ms ±0.16ms 1 -40.0%

Modal.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
Modal native mount 0.86ms 0.85ms ±0.07ms 1 -30.6%

Image.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
Image native mount 1.55ms 1.51ms ±0.19ms 1 -33.1%

View.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
View native mount 0.94ms 0.93ms ±0.06ms 1 -34.6%

Text.native-perf-test.ts

Scenario Mean Median StdDev Renders vs Baseline
Text native mount 1.17ms 1.14ms ±0.16ms 1 -34.2%

Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) from 0.7.13 to 0.8.13.
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.7.13...0.8.13)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.13
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@vmoroz vmoroz force-pushed the dependabot/npm_and_yarn/xmldom/xmldom-0.8.13 branch from dd1eb0c to 58699e2 Compare April 23, 2026 21:59
@vmoroz vmoroz enabled auto-merge (squash) April 23, 2026 21:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants