chore(deps): bump fast-xml-parser from 5.4.2 to 5.5.7 by dependabot[bot] · Pull Request #3494 · process-analytics/bpmn-visualization-js

dependabot · 2026-03-20T00:51:16Z

Bumps fast-xml-parser from 5.4.2 to 5.5.7.

Release notes

Sourced from fast-xml-parser's releases.

fix entity expansion and incorrect replacement and performance

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.5...v5.5.6

support onDangerousProperty

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.3...v5.5.5

update dependecies to fix typings

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.5.1...v5.5.2

integrate path-expression-matcher

support path-expression-matcher

fix: stopNode should not be parsed

performance improvement for stopNode checking

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.5.7 / 2026-03-19

fix: entity expansion limits

update strnum package to 2.2.0

5.5.6 / 2026-03-16

update builder dependency

fix incorrect regex to replace . in entity name

fix check for entitiy expansion for lastEntities and html entities too

5.5.5 / 2026-03-13

sanitize dangerous tag or attribute name

error on critical property name

support onDangerousProperty option

5.5.4 / 2026-03-13

declare Matcher & Expression as unknown so user is not forced to install path-expression-matcher

5.5.3 / 2026-03-11

upgrade builder

5.5.2 / 2026-03-11

update dependency to fix typings

5.5.1 / 2026-03-10

fix dependency

5.5.0 / 2026-03-10

support path-expression-matcher

fix: stopNode should not be parsed

performance improvement for stopNode checking

5.4.2 / 2026-03-03

support maxEntityCount option

5.4.1 / 2026-02-25

fix (#785) unpairedTag node should not have tag content

5.4.0 / 2026-02-25

migrate to fast-xml-builder

5.3.9 / 2026-02-25

support strictReservedNames

5.3.8 / 2026-02-25

support maxNestedTags

... (truncated)

Commits

a21c441 update package detail
239b64a check for min value for entity exapantion options
61cb666 restrict more properties to be unsafe
41abd66 performance improvement of reading DOCTYPE
3dfcd20 refactor: performance improvement
870043e update release info
6df401e update builder dependency
bd26122 check for entitiy expansion for lastEntities and html entities too
7e70dd8 fix incorrect regex to replace . in entity name
e54155f update package info
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.4.2 to 5.5.7. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.4.2...v5.5.7) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.5.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

…re changed in v5.5.0

github-actions · 2026-03-20T17:11:53Z

🎊 PR Preview 0483058 has been successfully built and deployed to https://process-analytics-bpmn-visualization-js-demo_preview-pr-3494.surge.sh

🕐 Build time: 0.011s

_{🤖 By surge-preview}

github-actions · 2026-03-20T17:12:24Z

🎊 PR Preview 0483058 has been successfully built and deployed to https://process-analytics-bpmn-visualization-js-doc_preview-pr-3494.surge.sh

🕐 Build time: 0.011s

_{🤖 By surge-preview}

sonarqubecloud · 2026-03-20T17:13:23Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
90.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Updates the XML parsing dependency to a newer fast-xml-parser release and adapts the BPMN XML parsing configuration to keep numeric attribute handling working with the updated library behavior.

Changes:

Bump fast-xml-parser from 5.4.2 to 5.5.7.
Update BpmnXmlParser options to use jPath: false and derive the node path from the new matcher argument in attributeValueProcessor.
Refresh package-lock.json with updated transitive dependencies (fast-xml-builder, strnum, path-expression-matcher).

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
src/component/parser/xml/BpmnXmlParser.ts	Adjusts parser options and attribute processing to remain compatible with `fast-xml-parser@5.5.7` path/matcher behavior.
package.json	Bumps `fast-xml-parser` dependency version.
package-lock.json	Locks updated dependency tree, including new/updated transitive packages.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/component/parser/xml/BpmnXmlParser.ts

tbouffard · 2026-03-23T09:49:24Z

⚠️ This fxp update significantly increases the size of the IIFE bundle.

File	master `cefb908` fxp 5.4.2	this PR fxp 5.5.7
bpmn-visualization.esm.js	207 818	208 133
bpmn-visualization.js	1 722 555	1 741 410
bpmn-visualization.min.js	987 515	996 865

Bundle size investigation: IIFE +9,350 bytes vs ESM +315 bytes

(from Claude code)

Root cause

The difference is explained by the bundling strategy (see rollup.config.mjs):

IIFE: uses resolve() + commonjs() → embeds all dependencies (including fast-xml-parser) directly in the bundle
ESM: uses externals({ devDeps: true }) → does not embed dependencies, keeps them as external imports

So when fast-xml-parser grows, the IIFE absorbs the entire increase, while the ESM only reflects changes in our own code.

What was added in fast-xml-parser 5.5.x (visible in the IIFE bundle)

The diff reveals 3 categories of new code in fxp 5.5.x:

Anti-prototype pollution security (~2 KB unminified)
- DANGEROUS_PROPERTY_NAMES / criticalProperties — lists of dangerous JS properties
- validatePropertyName() — validation of configured property names
- sanitizeName() — tag/attribute name sanitization
- defaultOnDangerousProperty() — automatic renaming of dangerous properties
- onDangerousProperty option in default settings
Expression/Matcher pattern matching system (~8-10 KB unminified)
- Expression class — selection pattern parsing (wildcards, namespaces, positions, attribute conditions)
- Matcher class — jPath matching with deep-wildcard, position (first, odd, even, nth), and namespace support
- Utility functions: extractRawAttributes(), extractNamespace(), stripAttributePrefix()
- The jPath parameter is now a Matcher object instead of a plain string (hence the attributeValueProcessor signature change)
toNumber / entity handling refactoring (~3-4 KB unminified)
- handleInfinity() — configurable Infinity handling
- resolveEnotation() — improved scientific notation handling
- Entity expansion limits: maxTotalExpansions, maxEntityCount, maxEntitySize, maxExpansionDepth, maxExpandedLength
- transformTagName() / sanitizeName() — tag name transformation pipeline

The +315 bytes in ESM

The ESM diff only contains our attributeValueProcessor modification: adapting to the new fxp 5.5.x signature (nodePathOrMatcher can be a Matcher object instead of a string) + adding jPath: false.

Conclusion

The ~9.3 KB minified delta is structural — it comes from code added in fast-xml-parser itself (security hardening, advanced matching). There is no way to reduce it via rollup configuration without excluding fxp from the
IIFE bundle (which would break its standalone usage). This is the expected cost of the version upgrade.

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

tbouffard · 2026-03-23T11:07:22Z

src/component/parser/xml/BpmnXmlParser.ts

+      const nodePath =
+        typeof nodePathOrMatcher === 'object' && nodePathOrMatcher !== null
+          ? String((nodePathOrMatcher as { toString(separator?: string, includeNs?: boolean): string }).toString('.', false))
+          : String(nodePathOrMatcher);


nitpick: SonarQube complains about this line

'nodePathOrMatcher' will use Object's default stringification format ('[object Object]') when stringified.

See https://sonarcloud.io/project/issues?sinceLeakPeriod=true&issueStatuses=OPEN%2CCONFIRMED&pullRequest=3494&id=process-analytics_bpmn-visualization-js&open=AZ0MPL8G69j3AYRLlI2j

dependabot bot added dependencies Pull requests that update a dependency (dev or runtime) javascript Pull requests that update Javascript code skip-changelog Do not include in Changelog and Release Notes labels Mar 20, 2026

dependabot bot mentioned this pull request Mar 20, 2026

chore(deps): bump fast-xml-parser from 5.4.2 to 5.5.6 #3493

Closed

tbouffard added 2 commits March 20, 2026 17:44

fix compilation error: the X2jOptions.attributeValueProcessor signatu…

ee1205c

…re changed in v5.5.0

fix impl

0483058

tbouffard requested a review from Copilot March 20, 2026 19:18

Copilot started reviewing on behalf of tbouffard March 20, 2026 19:19 View session

Copilot AI reviewed Mar 20, 2026

View reviewed changes

src/component/parser/xml/BpmnXmlParser.ts Outdated Show resolved Hide resolved

update link to fxp [skip ci]

7322026

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

tbouffard reviewed Mar 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump fast-xml-parser from 5.4.2 to 5.5.7#3494

chore(deps): bump fast-xml-parser from 5.4.2 to 5.5.7#3494
dependabot[bot] wants to merge 4 commits intomasterfrom
dependabot/npm_and_yarn/fast-xml-parser-5.5.7

dependabot bot commented on behalf of github Mar 20, 2026

Uh oh!

github-actions bot commented Mar 20, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 20, 2026 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Mar 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

tbouffard commented Mar 23, 2026 •

edited

Loading

Uh oh!

tbouffard Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

dependabot bot commented on behalf of github Mar 20, 2026

fix entity expansion and incorrect replacement and performance

support onDangerousProperty

update dependecies to fix typings

integrate path-expression-matcher

Uh oh!

github-actions bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sonarqubecloud bot commented Mar 20, 2026

Quality Gate passed

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

tbouffard commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bundle size investigation: IIFE +9,350 bytes vs ESM +315 bytes

Root cause

What was added in fast-xml-parser 5.5.x (visible in the IIFE bundle)

The +315 bytes in ESM

Conclusion

Uh oh!

tbouffard Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions bot commented Mar 20, 2026 •

edited

Loading

github-actions bot commented Mar 20, 2026 •

edited

Loading

tbouffard commented Mar 23, 2026 •

edited

Loading