Back to Explore

NaturalIntelligence/fast-xml-builder

GitHub
3 updates · last 90 days1 watchersOpen source

Last release:

fast-xml-builder is a JavaScript utility for generating XML from a JavaScript object (typically JSON-style data). It is useful when you already have parsed or modeled data in JSON form and need configurable XML output, including options for attributes, formatting, CDATA and comments, entity processing, and order preservation.

Project status

  • Actively maintained: the upstream repo shows a very recent push (2026-08-19) and the project has frequent recent updates (v1.3.1 on 2026-08-14, with additional updates in July and May 2026).
  • Update cadence: appears to be on the order of weeks to a bit over a month, with v1.3.0 (2026-07-11) and v1.3.1 (2026-08-14), plus further updates in early July and early May.

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v1.3.1

    v1.3.1 includes a targeted bug fix related to how values are stringified. Specifically, it preserves the negative zero sign when stringifying values, preventing incorrect “-0” handling.

  • v1.3.0

    Release v1.3.0 updates core XML name validation and upgrades key dependencies. The code change replaces per-call `xml-naming` validation (`qName(name, { xmlVersion })`) with a cached validator created once per build/serialization using `createValidator('qName', { xmlVersion })`.

  • v1.2.1

    Release v1.2.1 mainly updates XML serialization behavior in fast-xml-builder, with fixes around escaping/sanitizing content that can otherwise produce invalid or unsafe XML. The publisher-provided release notes are empty, so the behavioral changes below are effectively undocumented in the provided release notes.

    Security

  • v1.2.0

    Release v1.2.0 was published on 2026-05-08. The publisher provided no release notes, so there is no documented information about new features, bug fixes, breaking changes, security updates, or migration requirements.

  • 1.1.9

    Release 1.1.9 has no publisher-provided release notes in the supplied data. The code diff indicates a formatting behavior fix in the preserveOrder-to-XML path, plus documentation and test updates.

  • v1.1.8

    This release (v1.1.8) changes how the builder handles Processing Instruction (PI) tags, specifically ensuring PI tags do not emit any text body content. The changes are implemented in both the standard builder flow and the preserveOrder code path, with accompanying type definition tweaks and added/updated PI-related tests.

    Breaking

  • V1.1.7

    v1.1.7 focuses on security hardening for XML attribute generation. The implementation now escapes quote characters inside attribute values, ensuring generated XML stays well-formed and safer against injection vectors.

    Security

  • v1.1.6

    Version v1.1.6 (11 files changed, +84/-30) refactors and hardens how the XML builder escapes comment and CDATA content. The GitHub release notes field is empty, so most user-impacting behavioral changes are not explicitly documented there.

    BreakingSecurity

  • v1.1.5

    Release v1.1.5 contains security hardening changes to how the builder renders CDATA and XML comments. Specifically, it sanitizes embedded terminators inside `$cdata` and comment content to avoid producing broken XML when values contain sequences like `]]>` or `--`.

    Security

  • v1.1.4

    v1.1.4 introduces a `maxNestedTags` option to limit XML nesting depth during JSON-to-XML building. The build now throws an error when the nesting depth exceeds a configured limit, and the TypeScript typings are adjusted to avoid depending on `path-expression-matcher` types.

    Features

  • v1.1.2

    Release v1.1.2 was published on 2026-03-11, but the publisher provided no release notes or details about changes. As a result, developers should assume potential undocumented fixes or modifications and verify impact by reviewing the diff and running their test suite before upgrading.