Back to Explore

NaturalIntelligence/fast-xml-parser

GitHub
8 updates · last 90 days1 watchersOpen source

Last release:

fast-xml-parser is a JavaScript library (common JS, ESM, and browser compatible) for validating XML, parsing XML into JS objects, and building XML from JS objects. It is designed to be fast without relying on C/C++ based libraries, and it can also be used via a CLI command (fxparser) for quick XML processing.

Project status

  • Actively maintained, with upstream activity as recent as 2026-09-03 and multiple library updates in 2026 (v5.11.1 on 2026-08-27, v5.11.0 on 2026-08-16, v5.10.1 on 2026-07-16).
  • Update cadence appears fairly regular, roughly every 1 to 2 weeks in late 2026, and about monthly across the last few releases (May through August).

AI summary generated

AI-generated from public sources. May be inaccurate. Report

Recent updates

  • v5.11.1

    Release v5.11.1 is primarily described as GitHub Actions dependency bumps and a docs link fix. However, the code diff shows a substantive change to XML attribute validation logic inside the validator implementation.

  • v5.11.0

    fast-xml-parser v5.11.0 adds support for capturing an endIndex in node metadata (when captureMetaData is enabled), alongside an additional fix to prevent crashes on malformed XML with closing tags that lack matching opening tags. The parsing logic was updated to compute endIndex across multiple node types, and the TypeScript declarations were extended accordingly.

    Features

  • v5.10.1

    fast-xml-parser v5.10.1 makes a targeted change in XML parsing behavior around DOCTYPE handling, and bumps a core dependency. It also updates README guidance and test coverage for entity/doctype related edge cases.

    BreakingSecurity

  • v5.10.0

    v5.10.0 release notes only mention CI tooling updates (actions/checkout to v7.0.0 and zizmor-action to v0.5.7). The actual code diff also shows runtime dependency upgrades and a change in entity safety handling logic inside the XML parser.

  • v5.9.3

    Release v5.9.3 primarily changes GitHub Actions configuration, including workflow hardening and workflow fixes. The code diff also updates package metadata and bumps a couple of runtime dependencies (strnum and anynum) via lockfiles, but these are not described in the release notes.

    Security

  • v5.9.2

    v5.9.2 appears to be a release mainly intended to test GitHub Actions-based publishing and release automation. The release notes do not list any library behavior changes, and the code diff focuses on workflow pinning and minor release-process documentation/version bumps.

  • v5.9.1

    Release v5.9.1 is effectively documented as a dummy release intended to test publishing from GitHub Actions. The code diff shows no changes to the fast-xml-parser library source itself, but it does update release automation and regenerates dependency lockfiles.

  • v5.9.0

    fast-xml-parser v5.9.0 updates numeric parsing support via strnum and adds safety checks for potentially malicious doctype entity content using the is-unsafe library. The change introduces new entity handling logic in the XML parsing pipeline and updates related TypeScript types and bundled assets.

    SecurityFeatures

  • v5.8.0

    v5.8.0 upgrades XML parsing and related helpers by updating DOCTYPE validation logic and bumping core dependencies (strnum, fast-xml-builder). The release notes mention xml-naming integration for DOCTYPE entity and notation validation, and dependency bumps, but the code diff also contains additional behavioral and TypeScript typing changes.

    Features

  • v5.7.3

    v5.7.3 contains two parser bug fixes, an XML builder dependency bump, and a deprecation notice for XMLParser.addEntity. The main behavior changes relate to alwaysCreateTextNode output for self-closing tags and stop node handling when namespace prefixes are removed.

  • v5.7.2

    Version v5.7.2 updates fast-xml-parser to improve compatibility with external entities and fixes two reported parsing bugs. The code changes also adjust low-level tag expression parsing behavior (not just what is mentioned in the release notes), particularly around whitespace handling and how external entities are wired into the entity decoder.

    Breaking

  • v5.7.1

    fast-xml-parser v5.7.1 upgrades to @nodable/entities v2.1.0 and fast-xml-builder v1.1.5. The main functional change is migrating entity processing to @nodable/entities' EntityDecoder with a new `entityDecoder` option and updated entity expansion behavior (notably single-pass scanning).

    BreakingSecurityFeatures