@depup/fast-xml-parser 5.5.11-depup.1 → 5.11.0-depup.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@depup/fast-xml-parser",
-  "version": "5.5.11-depup.1",
+  "version": "5.11.0-depup.0",
   "description": "Validate XML, Parse XML, Build XML without C/C++ based libraries (with updated dependencies)",
   "main": "./lib/fxp.cjs",
   "type": "module",
@@ -23,13 +23,11 @@
     "test": "c8 --reporter=lcov --reporter=text jasmine spec/*spec.js",
     "test-types": "tsc --noEmit spec/typings/typings-test.ts",
     "unit": "jasmine",
-    "coverage": "nyc report --reporter html --reporter text -t .nyc_output --report-dir .nyc_output/summary",
     "perf": "node ./benchmark/perfTest3.js",
     "lint": "eslint src/**/*.js spec/**/*.js benchmark/**/*.js",
     "bundle": "webpack --config webpack.cjs.config.js",
     "prettier": "prettier --write src/**/*.js",
-    "checkReadiness": "publish-please --dry-run",
-    "publish-please": "publish-please"
+    "preversion": "npm test"
   },
   "bin": {
     "fxparser": "src/cli/cli.js"
@@ -75,14 +73,13 @@
     "@babel/plugin-transform-runtime": "^7.13.10",
     "@babel/preset-env": "^7.13.10",
     "@babel/register": "^7.13.8",
+    "@byspec/xml": "^0.1.0",
     "@types/node": "20",
     "babel-loader": "^8.2.2",
     "c8": "^10.1.3",
     "eslint": "^8.3.0",
-    "he": "^1.2.0",
     "jasmine": "^5.6.0",
     "prettier": "^3.5.1",
-    "publish-please": "^5.5.2",
     "typescript": "5",
     "webpack": "^5.64.4",
     "webpack-cli": "^4.9.1"
@@ -94,21 +91,24 @@
     }
   ],
   "dependencies": {
-    "fast-xml-builder": "^1.1.4",
-    "path-expression-matcher": "^1.5.0",
-    "strnum": "^2.2.3"
+    "@nodable/entities": "^3.0.0",
+    "fast-xml-builder": "^1.3.1",
+    "is-unsafe": "^2.0.0",
+    "path-expression-matcher": "^1.6.2",
+    "strnum": "^2.4.2",
+    "xml-naming": "^0.3.0"
   },
   "depup": {
     "changes": {
-      "path-expression-matcher": {
-        "from": "^1.4.0",
-        "to": "^1.5.0"
+      "fast-xml-builder": {
+        "from": "^1.2.0",
+        "to": "^1.3.1"
       }
     },
     "depsUpdated": 1,
     "originalPackage": "fast-xml-parser",
-    "originalVersion": "5.5.11",
-    "processedAt": "2026-04-10T05:04:43.827Z",
+    "originalVersion": "5.11.0",
+    "processedAt": "2026-08-16T08:07:19.703Z",
     "smokeTest": "passed"
   }
 }

package/src/fxp.d.ts

@@ -66,20 +66,23 @@ export class Expression {
 }
 
 // ---------------------------------------------------------------------------
-// ReadonlyMatcher
+// MatcherView
 // ---------------------------------------------------------------------------
 
 /**
- * A live read-only view of a Matcher instance, returned by Matcher.readOnly.
+ * A lightweight, live read-only view of a Matcher instance.
  *
- * All query and inspection methods work normally and always reflect the current
- * state of the underlying matcher. State-mutating methods (`push`, `pop`,
- * `reset`, `updateCurrent`, `restore`) are not present — calling them on the
- * underlying Proxy throws a `TypeError` at runtime.
+ * Returned by `Matcher.readOnly()`. The same instance is reused across every
+ * callback invocation — no allocation overhead per call. Reads directly from
+ * the parent Matcher's internal state so it always reflects the current parser
+ * position with no copying or freezing.
+ *
+ * Mutation methods (`push`, `pop`, `reset`, `updateCurrent`, `restore`) are
+ * simply absent — misuse is caught at compile time by TypeScript.
  *
  * This is the type received by all FXP user callbacks when `jPath: false`.
  */
-export interface ReadonlyMatcher {
+export class MatcherView {
   readonly separator: string;
 
   /** Check if current path matches an Expression. */
@@ -111,14 +114,14 @@ export interface ReadonlyMatcher {
 
   /** Current path as an array of tag names. */
   toArray(): string[];
-
-  /**
-   * Create a snapshot of the current state.
-   * The snapshot can be passed to the real Matcher.restore if needed.
-   */
-  snapshot(): MatcherSnapshot;
 }
 
+/**
+ * @deprecated Use {@link MatcherView} instead.
+ * Alias kept for backward compatibility.
+ */
+export type ReadonlyMatcher = MatcherView;
+
 /** Internal node structure — exposed via snapshot only. */
 export interface PathNode {
   tag: string;
@@ -141,8 +144,8 @@ export interface MatcherSnapshot {
  **********************************************************************/
 
 // jPath: true  → string
-// jPath: false → ReadonlyMatcher
-type JPathOrMatcher = string | ReadonlyMatcher;
+// jPath: false → MatcherView
+type JPathOrMatcher = string | MatcherView;
 type JPathOrExpression = string | Expression;
 
 export type ProcessEntitiesOptions = {
@@ -208,6 +211,14 @@ export type ProcessEntitiesOptions = {
   tagFilter?: ((tagName: string, jPathOrMatcher: JPathOrMatcher) => boolean) | null;
 };
 
+export type EntityDecoderOptions = {
+  setExternalEntities: (entities: Record<string, string>) => void;
+  addInputEntities: (entities: Record<string, string>) => void;
+  reset: () => void;
+  decode: (text: string) => string;
+  setXmlVersion: (version: string) => void;
+}
+
 export type X2jOptions = {
   /**
    * Preserve the order of tags in resulting JS object
@@ -394,9 +405,14 @@ export type X2jOptions = {
    * Whether to process HTML entities
    * 
    * Defaults to `false`
+   * @deprecated Use `entityDecoder` instead
    */
   htmlEntities?: boolean;
 
+  /**
+   * Custom entity decoder
+   */
+  entityDecoder?: EntityDecoderOptions;
   /**
    * Whether to ignore the declaration tag from output
    * 
@@ -487,7 +503,9 @@ export type strnumOptions = {
   hex: boolean;
   leadingZeros: boolean,
   skipLike?: RegExp,
-  eNotation?: boolean
+  eNotation?: boolean,
+  infinity?: string,
+  unicode?: boolean
 }
 
 export type validationOptions = {
@@ -680,11 +698,19 @@ export type ValidationError = {
 
 export class XMLParser {
   constructor(options?: X2jOptions);
-  parse(xmlData: string | Uint8Array, validationOptions?: validationOptions | boolean): any;
+
+  parse(xmlData: string | Uint8Array): any;
+  /**
+   * @deprecated The `validationOptions` parameter is deprecated.
+   * Use the `fast-xml-validator` package instead for XML validation.
+   * @see https://www.npmjs.com/package/fast-xml-validator
+   */
+  parse(xmlData: string | Uint8Array, validationOptions: validationOptions | boolean): any;
   /**
    * Add Entity which is not by default supported by this library
    * @param entityIdentifier {string} Eg: 'ent' for &ent;
    * @param entityValue {string} Eg: '\r'
+   * @deprecated Use `entityDecoder` instead
    */
   addEntity(entityIdentifier: string, entityValue: string): void;
 
@@ -701,9 +727,16 @@ export class XMLParser {
   static getMetaDataSymbol(): Symbol;
 }
 
+/** 
+ * @deprecated Use fast-xml-validator instead
+ * @see https://www.npmjs.com/package/fast-xml-validator
+ */
 export class XMLValidator {
   static validate(xmlData: string, options?: validationOptions): true | ValidationError;
 }
+/**
+ * @deprecated Use npm package 'fast-xml-builder' instead
+ */
 export class XMLBuilder {
   constructor(options?: XmlBuilderOptions);
   build(jObj: any): string;
@@ -716,4 +749,6 @@ export class XMLBuilder {
 export interface XMLMetaData {
   /** The index, if available, of the character where the XML node began in the input stream. */
   startIndex?: number;
+  /** The index, if available, of the character where the XML node ended in the input stream. */
+  endIndex?: number;
 }

package/src/xmlparser/DocTypeReader.js

@@ -1,11 +1,15 @@
-import { isName } from '../util.js';
+import { qName as isName } from 'xml-naming';
 
 export default class DocTypeReader {
-    constructor(options) {
+    constructor(options, xmlVersion) {
         this.suppressValidationErr = !options;
         this.options = options;
+        this.xmlVersion = xmlVersion || 1.0;
     }
 
+    setXmlVersion(xmlVersion = 1.0) {
+        this.xmlVersion = xmlVersion;
+    }
     readDocType(xmlData, i) {
         const entities = Object.create(null);
         let entityCount = 0;
@@ -19,8 +23,23 @@ export default class DocTypeReader {
             i = i + 9;
             let angleBracketsCount = 1;
             let hasBody = false, comment = false;
+            let quoteChar = null; // tracks an open SYSTEM/PUBLIC literal before the '[' body
             let exp = "";
             for (; i < xmlData.length; i++) {
+                // Inside a quoted external-identifier literal — XML allows '<'
+                // and '>' as plain data here, so they must not be interpreted
+                // as DOCTYPE structure until the matching quote closes.
+                if (quoteChar !== null) {
+                    if (xmlData[i] === quoteChar) quoteChar = null;
+                    exp += xmlData[i];
+                    continue;
+                }
+                if (!hasBody && !comment && (xmlData[i] === '"' || xmlData[i] === "'")) {
+                    quoteChar = xmlData[i];
+                    exp += xmlData[i];
+                    continue;
+                }
+
                 if (xmlData[i] === '<' && !comment) { //Determine the tag type
                     if (hasBody && hasSeq(xmlData, "!ENTITY", i)) {
                         i += 7;
@@ -35,11 +54,8 @@ export default class DocTypeReader {
                                 );
                             }
                             //const escaped = entityName.replace(/[.\-+*:]/g, '\\.');
-                            const escaped = entityName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-                            entities[entityName] = {
-                                regx: RegExp(`&${escaped};`, "g"),
-                                val: val
-                            };
+                            //const escaped = entityName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+                            entities[entityName] = val;
                             entityCount++;
                         }
                     }
@@ -78,7 +94,7 @@ export default class DocTypeReader {
                     exp += xmlData[i];
                 }
             }
-            if (angleBracketsCount !== 0) {
+            if (quoteChar !== null || angleBracketsCount !== 0) {
                 throw new Error(`Unclosed DOCTYPE`);
             }
         } else {
@@ -106,7 +122,7 @@ export default class DocTypeReader {
         }
         let entityName = xmlData.substring(startIndex, i);
 
-        validateEntityName(entityName);
+        validateEntityName(entityName, { xmlVersion: this.xmlVersion });
 
         // Skip whitespace after entity name
         i = skipWhitespace(xmlData, i);
@@ -149,7 +165,7 @@ export default class DocTypeReader {
         }
         let notationName = xmlData.substring(startIndex, i);
 
-        !this.suppressValidationErr && validateEntityName(notationName);
+        !this.suppressValidationErr && validateEntityName(notationName, { xmlVersion: this.xmlVersion });
 
         // Skip whitespace after notation name
         i = skipWhitespace(xmlData, i);
@@ -229,7 +245,7 @@ export default class DocTypeReader {
         let elementName = xmlData.substring(startIndex, i);
 
         // Validate element name
-        if (!this.suppressValidationErr && !isName(elementName)) {
+        if (!this.suppressValidationErr && !isName(elementName, { xmlVersion: this.xmlVersion })) {
             throw new Error(`Invalid element name: "${elementName}"`);
         }
 
@@ -276,7 +292,7 @@ export default class DocTypeReader {
         let elementName = xmlData.substring(startIndex, i);
 
         // Validate element name
-        validateEntityName(elementName)
+        validateEntityName(elementName, { xmlVersion: this.xmlVersion })
 
         // Skip whitespace after element name
         i = skipWhitespace(xmlData, i);
@@ -289,7 +305,7 @@ export default class DocTypeReader {
         let attributeName = xmlData.substring(startIndex, i);
 
         // Validate attribute name
-        if (!validateEntityName(attributeName)) {
+        if (!validateEntityName(attributeName, { xmlVersion: this.xmlVersion })) {
             throw new Error(`Invalid attribute name: "${attributeName}"`);
         }
 
@@ -324,7 +340,7 @@ export default class DocTypeReader {
 
                 // Validate notation name
                 notation = notation.trim();
-                if (!validateEntityName(notation)) {
+                if (!validateEntityName(notation, { xmlVersion: this.xmlVersion })) {
                     throw new Error(`Invalid notation name: "${notation}"`);
                 }
 
@@ -402,8 +418,8 @@ function hasSeq(data, seq, i) {
     return true;
 }
 
-function validateEntityName(name) {
-    if (isName(name))
+function validateEntityName(name, xmlVersion) {
+    if (isName(name, { xmlVersion: xmlVersion }))
         return name;
     else
         throw new Error(`Invalid entity name ${name}`);

package/src/xmlparser/OptionsBuilder.js

@@ -1,4 +1,5 @@
 import { DANGEROUS_PROPERTY_NAMES, criticalProperties } from "../util.js";
+import { COMMON_HTML, CURRENCY } from '@nodable/entities';
 
 const defaultOnDangerousProperty = (name) => {
   if (DANGEROUS_PROPERTY_NAMES.includes(name)) {
@@ -24,7 +25,8 @@ export const defaultOptions = {
   numberParseOptions: {
     hex: true,
     leadingZeros: true,
-    eNotation: true
+    eNotation: true,
+    unicode: false
   },
   tagValueProcessor: function (tagName, val) {
     return val;
@@ -39,6 +41,7 @@ export const defaultOptions = {
   unpairedTags: [],
   processEntities: true,
   htmlEntities: false,
+  entityDecoder: null,
   ignoreDeclaration: false,
   ignorePiTags: false,
   transformTagName: false,
@@ -85,18 +88,19 @@ function validatePropertyName(propertyName, optionName) {
  * @param {boolean|object} value 
  * @returns {object} Always returns normalized object
  */
-function normalizeProcessEntities(value) {
+function normalizeProcessEntities(value, htmlEntities) {
   // Boolean backward compatibility
   if (typeof value === 'boolean') {
     return {
       enabled: value, // true or false
       maxEntitySize: 10000,
-      maxExpansionDepth: 10,
-      maxTotalExpansions: 1000,
+      maxExpansionDepth: 10000,
+      maxTotalExpansions: Infinity,
       maxExpandedLength: 100000,
-      maxEntityCount: 100,
+      maxEntityCount: 1000,
       allowedTags: null,
-      tagFilter: null
+      tagFilter: null,
+      appliesTo: "all",
     };
   }
 
@@ -110,7 +114,8 @@ function normalizeProcessEntities(value) {
       maxExpandedLength: Math.max(1, value.maxExpandedLength ?? 100000),
       maxEntityCount: Math.max(1, value.maxEntityCount ?? 1000),
       allowedTags: value.allowedTags ?? null,
-      tagFilter: value.tagFilter ?? null
+      tagFilter: value.tagFilter ?? null,
+      appliesTo: value.appliesTo ?? "all",
     };
   }
 
@@ -141,7 +146,7 @@ export const buildOptions = function (options) {
   }
 
   // Always normalize processEntities for backward compatibility and validation
-  built.processEntities = normalizeProcessEntities(built.processEntities);
+  built.processEntities = normalizeProcessEntities(built.processEntities, built.htmlEntities);
   built.unpairedTagsSet = new Set(built.unpairedTags);
   // Convert old-style stopNodes for backward compatibility
   if (built.stopNodes && Array.isArray(built.stopNodes)) {