Back to Explore

NaturalIntelligence/fast-xml-parser

GitHub
6 updates · last 90 days1 watchersOpen source

Last release:

fast-xml-parser is a JavaScript library (common JS, ESM, and browser compatible) for validating XML, parsing XML into JS objects, and building XML from JS objects. It is designed to be fast without relying on C/C++ based libraries, and it can also be used via a CLI command (fxparser) for quick XML processing.

Project status

  • Actively maintained, with very recent upstream activity (last push on 2026-08-10) and library updates continuing through 2026-07 (v5.10.1 on 2026-07-16).
  • Update cadence appears steady, with multiple tags in June and July 2026 (roughly every few days to a week), though some updates are primarily CI or publishing automation rather than library behavior changes.

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v5.10.1

    fast-xml-parser v5.10.1 makes a targeted change in XML parsing behavior around DOCTYPE handling, and bumps a core dependency. It also updates README guidance and test coverage for entity/doctype related edge cases.

    BreakingSecurity

  • v5.10.0

    v5.10.0 release notes only mention CI tooling updates (actions/checkout to v7.0.0 and zizmor-action to v0.5.7). The actual code diff also shows runtime dependency upgrades and a change in entity safety handling logic inside the XML parser.

  • v5.9.3

    Release v5.9.3 primarily changes GitHub Actions configuration, including workflow hardening and workflow fixes. The code diff also updates package metadata and bumps a couple of runtime dependencies (strnum and anynum) via lockfiles, but these are not described in the release notes.

    Security

  • v5.9.2

    v5.9.2 appears to be a release mainly intended to test GitHub Actions-based publishing and release automation. The release notes do not list any library behavior changes, and the code diff focuses on workflow pinning and minor release-process documentation/version bumps.

  • v5.9.1

    Release v5.9.1 is effectively documented as a dummy release intended to test publishing from GitHub Actions. The code diff shows no changes to the fast-xml-parser library source itself, but it does update release automation and regenerates dependency lockfiles.

  • v5.9.0

    fast-xml-parser v5.9.0 updates numeric parsing support via strnum and adds safety checks for potentially malicious doctype entity content using the is-unsafe library. The change introduces new entity handling logic in the XML parsing pipeline and updates related TypeScript types and bundled assets.

    SecurityFeatures

  • v5.8.0

    v5.8.0 upgrades XML parsing and related helpers by updating DOCTYPE validation logic and bumping core dependencies (strnum, fast-xml-builder). The release notes mention xml-naming integration for DOCTYPE entity and notation validation, and dependency bumps, but the code diff also contains additional behavioral and TypeScript typing changes.

    Features

  • v5.7.3

    v5.7.3 contains two parser bug fixes, an XML builder dependency bump, and a deprecation notice for XMLParser.addEntity. The main behavior changes relate to alwaysCreateTextNode output for self-closing tags and stop node handling when namespace prefixes are removed.

  • v5.7.2

    Version v5.7.2 updates fast-xml-parser to improve compatibility with external entities and fixes two reported parsing bugs. The code changes also adjust low-level tag expression parsing behavior (not just what is mentioned in the release notes), particularly around whitespace handling and how external entities are wired into the entity decoder.

    Breaking

  • v5.7.1

    fast-xml-parser v5.7.1 upgrades to @nodable/entities v2.1.0 and fast-xml-builder v1.1.5. The main functional change is migrating entity processing to @nodable/entities' EntityDecoder with a new `entityDecoder` option and updated entity expansion behavior (notably single-pass scanning).

    BreakingSecurityFeatures