Skip to content

Bump fast-xml-parser, @react-native-community/cli and react-native-windows in /Apps/Playground#735

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/Apps/Playground/multi-9dd291266c
Open

Bump fast-xml-parser, @react-native-community/cli and react-native-windows in /Apps/Playground#735
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/npm_and_yarn/Apps/Playground/multi-9dd291266c

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 25, 2026

Bumps fast-xml-parser to 5.8.0 and updates ancestor dependencies fast-xml-parser, @react-native-community/cli and react-native-windows. These dependencies need to be updated together.

Updates fast-xml-parser from 4.5.6 to 5.8.0

Release notes

Sourced from fast-xml-parser's releases.

update strnum, FXB. Use xml-naming for DOCTYPE

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is by deault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

backward compatibility for numerical external entity, fix #705, #817

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

upgrade @​nodable/entities and FXB

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to use entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

use @​nodable/entities to replace entities

  • No API change
  • No change in performance for basic usage
  • No typing change
  • No config change
  • new dependency
  • breaking: error messages for entities might have been changed.

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.12...v5.6.0

performance improvment, increase entity expansion default limit

  • increase default entity explansion limit as many projects demand for that
</tr></table> 

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder
  • fix #817: stackoverflow when tag expression is very long

5.7.1 / 2026-04-20

  • fix typo in CJS typing file

5.7.0 / 2026-04-17

  • Use @nodable/entities v2.1.0
    • breaking changes
      • single entity scan. You're not allowed to user entity value to form another entity name.
      • you cant add numeric external entity
      • entity error message when expantion limit is crossed might change
    • typings are updated for new options related to process entity
    • please follow documentation of @nodable/entities for more detail.
    • performance
      • if processEntities is false, then there should not be impact on performance.
      • if processEntities is true, but you dont pass entity decoder separately then performance may degrade by approx 8-10%
      • if processEntities is true, and you pass entity decoder separately
        • if no entity then performance should be same as before
        • if there are entities then performance should be increased from past versions
    • ignoreAttributes is not required to be set to set xml version for NCR entity value
  • update 'fast-xml-builder' to sanitize malicious CDATA and comment's content

5.6.0 / 2026-04-15

  • fix: entity replacement for numeric entities
  • use @​nodable/entities to replace entities
    • this may change some error messages related to entities expansion limit or inavlid use
    • post check would be exposed in future version

... (truncated)

Commits

Updates @react-native-community/cli from 20.0.0 to 20.1.3

Commits

Updates react-native-windows from 0.81.21 to 1.0.0

Release notes

Sourced from react-native-windows's releases.

React Native Windows 0.82.0

We're excited to release React Native Windows 0.82.0 targeting React Native 0.82.0!

This release includes the commits to React Native Windows from 8/2/2025 - 01/15/2026.

How to upgrade?

You can view the changes made to the default new React Native Windows applications for C++ and C# using React Native Upgrade Helper. See this document for more details.

Starting with React Native Windows 0.82, the legacy Paper architecture has been completely removed. All apps now run exclusively on the New Architecture (Fabric). If you haven't already migrated your app to Fabric, you must do so before upgrading to 0.82. See the New Architecture migration guide for details

New Architecture-specific changes

Breaking Changes

  • Fixed focus restoration on close, removed minimize/maximize buttons, and hidden title bar icon for cleaner modal appearance : [Modal outstanding issues by iamAbhi-916 · Pull Request #15445 · microsoft/react-native-windows](microsoft/react-native-windows#15445)

  • Remove old architecture that is not supported in 0.82 : [Remove paper by acoates-ms · Pull Request #15354 · microsoft/react-native-windows](microsoft/react-native-windows#15354)

New Features

  • Add ability to customize native accessibility of custom native components : [Add ability to customize native accessibility of custom native components by acoates-ms · Pull Request #15532 · microsoft/react-native-windows](microsoft/react-native-windows#15532)

... (truncated)

Changelog

Sourced from react-native-windows's changelog.

Change Log - react-native-windows

0.0.0-canary.1055

Wed, 13 May 2026 18:22:07 GMT

Changes

  • Show tooltip on keyboard focus, enforce single visible tooltip (74712637+iamAbhi-916@users.noreply.github.com)
  • Fix #16047: Pressables inside ScrollView remained stuck in the pressed state after a touch-driven scroll, and on non-100% Windows display scales the next tap on a row would not register press. Two underlying causes were addressed: (1) VisualInteractionSource::TryRedirectForManipulation does not deliver PointerCaptureLost for the redirected pointer, leaving a zombie entry in CompositionEventHandler::m_activeTouches — now resolved by synthesizing a touchcancel from the InputPointerSource.PointerRoutedAway event, which fires reliably on the redirect path; and (2) ScrollViewComponentView::updateStateWithContentOffset wrote the raw physical-pixel ScrollPosition into ScrollViewShadowNode state's contentOffset, which Fabric layout treats as DIPs, so JS UIManager.measure() over-subtracted the offset by pointScaleFactor after any scroll on a >100% display, causing Pressability to fire LEAVE_PRESS_RECT synchronously and suppress press — now divides by pointScaleFactor to match the JS event-emitter paths in the same file. (gordomacmaster@gmail.com)
  • Bump @​react-native-windows/cli to v0.0.0-canary.290

0.0.0-canary.1054

Mon, 11 May 2026 14:34:27 GMT

Changes

0.0.0-canary.1053

Sun, 10 May 2026 18:20:42 GMT

Changes

0.0.0-canary.1052

Wed, 22 Apr 2026 16:40:25 GMT

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

…ndows

Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) to 5.8.0 and updates ancestor dependencies [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser), [@react-native-community/cli](https://github.com/react-native-community/cli/tree/HEAD/packages/cli) and [react-native-windows](https://github.com/microsoft/react-native-windows/tree/HEAD/vnext). These dependencies need to be updated together.


Updates `fast-xml-parser` from 4.5.6 to 5.8.0
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.6...v5.8.0)

Updates `@react-native-community/cli` from 20.0.0 to 20.1.3
- [Release notes](https://github.com/react-native-community/cli/releases)
- [Changelog](https://github.com/react-native-community/cli/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/react-native-community/cli/commits/v20.1.3/packages/cli)

Updates `react-native-windows` from 0.81.21 to 1.0.0
- [Release notes](https://github.com/microsoft/react-native-windows/releases)
- [Changelog](https://github.com/microsoft/react-native-windows/blob/main/vnext/CHANGELOG.md)
- [Commits](https://github.com/microsoft/react-native-windows/commits/HEAD/vnext)

---
updated-dependencies:
- dependency-name: fast-xml-parser
  dependency-version: 5.8.0
  dependency-type: indirect
- dependency-name: "@react-native-community/cli"
  dependency-version: 20.1.3
  dependency-type: direct:development
- dependency-name: react-native-windows
  dependency-version: 1.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants