Back to Explore

NaturalIntelligence/fast-xml-builder

GitHub
2 updates · last 90 days1 watchersOpen source

Last release:

fast-xml-builder is a JavaScript utility for generating XML from a JavaScript object (typically JSON-style data). It is useful when you already have parsed or modeled data in JSON form and need configurable XML output, including options for attributes, formatting, CDATA and comments, entity processing, and order preservation.

Project status

  • Actively maintained, with very recent activity (upstream push on 2026-08-01) and a latest published update v1.3.0 dated 2026-07-11.
  • Update cadence appears fairly steady in 2026, with updates clustered in early July (v1.2.1 on 2026-07-03, v1.3.0 on 2026-07-11), followed by a longer gap to v1.2.0 on 2026-05-08.

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v1.3.0

    Release v1.3.0 updates core XML name validation and upgrades key dependencies. The code change replaces per-call `xml-naming` validation (`qName(name, { xmlVersion })`) with a cached validator created once per build/serialization using `createValidator('qName', { xmlVersion })`.

  • v1.2.1

    Release v1.2.1 mainly updates XML serialization behavior in fast-xml-builder, with fixes around escaping/sanitizing content that can otherwise produce invalid or unsafe XML. The publisher-provided release notes are empty, so the behavioral changes below are effectively undocumented in the provided release notes.

    Security

  • v1.2.0

    Release v1.2.0 was published on 2026-05-08. The publisher provided no release notes, so there is no documented information about new features, bug fixes, breaking changes, security updates, or migration requirements.

  • 1.1.9

    Release 1.1.9 has no publisher-provided release notes in the supplied data. The code diff indicates a formatting behavior fix in the preserveOrder-to-XML path, plus documentation and test updates.

  • v1.1.8

    This release (v1.1.8) changes how the builder handles Processing Instruction (PI) tags, specifically ensuring PI tags do not emit any text body content. The changes are implemented in both the standard builder flow and the preserveOrder code path, with accompanying type definition tweaks and added/updated PI-related tests.

    Breaking

  • V1.1.7

    v1.1.7 focuses on security hardening for XML attribute generation. The implementation now escapes quote characters inside attribute values, ensuring generated XML stays well-formed and safer against injection vectors.

    Security

  • v1.1.6

    Version v1.1.6 (11 files changed, +84/-30) refactors and hardens how the XML builder escapes comment and CDATA content. The GitHub release notes field is empty, so most user-impacting behavioral changes are not explicitly documented there.

    BreakingSecurity

  • v1.1.5

    Release v1.1.5 contains security hardening changes to how the builder renders CDATA and XML comments. Specifically, it sanitizes embedded terminators inside `$cdata` and comment content to avoid producing broken XML when values contain sequences like `]]>` or `--`.

    Security

  • v1.1.4

    v1.1.4 introduces a `maxNestedTags` option to limit XML nesting depth during JSON-to-XML building. The build now throws an error when the nesting depth exceeds a configured limit, and the TypeScript typings are adjusted to avoid depending on `path-expression-matcher` types.

    Features

  • v1.1.2

    Release v1.1.2 was published on 2026-03-11, but the publisher provided no release notes or details about changes. As a result, developers should assume potential undocumented fixes or modifications and verify impact by reviewing the diff and running their test suite before upgrading.