[MelvinBot]

Details

Bumps transitive fast-xml-parser 4.2.7 → 5.11.2 (plus strnum 1.0.5 → 2.5.1 and new v5 deps) via an npm overrides entry. An override is needed because the parent pins ^4.0.12 and alert #49 is only fixed in 5.7.0+. Same pin as App. Fixes Dependabot alerts #35, #36, #38, #43, #47, #49.

Usage: Not used by this library's code. It's a peer-only transitive dep: react-native → @react-native-community/cli-platform-ios, which uses XMLParser to read the build configuration from .xcscheme files. Not shipped in dist. The v5 API (XMLParser, ignoreAttributes) is unchanged for this use.

Change Log

• 4.3.0: stopNodes + removeNSPrefix; ignore Object.prototype props
• 4.3.x: CDATA entity fix; HTML numeric entities
• 4.4.0–4.5.2: attribute/stop node fixes; ignoreAttributes accepts function/array
• 5.0.0: ESM support (no API change)
• 5.0.x–5.2.x: CJS build fixes; strnum fixes; node metadata; DOCTYPE fixes
• 5.3.x: Uint8Array input; entity expansion limits (maxEntitySize, etc.); maxNestedTags
• 5.4.0: builder moved to fast-xml-builder
• 5.5.x: path-expression-matcher; dangerous tag/attr name sanitization; entity limit fixes
• 5.6.0: @nodable/entities for entity replacement
• 5.7.0: security: builder sanitizes CDATA/comment content; single-pass entity scan
• 5.7.x: stack overflow fix on long tag expressions
• 5.8.0: validate DOCTYPE entity names (xml-naming)
• 5.9.0: validate unsafe DOCTYPE entity values (is-unsafe)
• 5.10.x: dep upgrades; multiple DOCTYPE fix
• 5.11.0: endIndex metadata; no crash on unmatched closing tag
• 5.11.1: validator: no quadratic regex on whitespace
• 5.11.2: decode Uint8Array as UTF-8; typing fix

Related Issues

https://github.com/Expensify/Expensify/issues/695894

Manual Tests

1. npm ci succeeds and npm ls fast-xml-parser shows 5.11.2 overridden.
2. npm audit shows no fast-xml-parser advisories.
3. npm run build, npx eslint src, npm run ts pass.
4. Call getBuildConfigurationFromXcScheme from @react-native-community/cli-platform-ios on a sample .xcscheme; it returns the scheme's buildConfiguration.

Linked PRs

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}

[chiragsalian]

Archiving this repository so closing out this PR