ooxml-core 1.16.0 → 1.16.1

package/dist/docx/layout/index.mjs

@@ -10,15 +10,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;
@@ -15308,7 +15327,7 @@ function shapeSvg(spec, widthPx, heightPx, theme) {
     spec.flipH || spec.flipV ? `translate(${spec.flipH ? w : 0} ${spec.flipV ? h : 0}) scale(${spec.flipH ? -1 : 1} ${spec.flipV ? -1 : 1})` : ""
   ].filter(Boolean).join(" ");
   const label = escapeXml(lookupPresetShape(spec.preset) ? spec.preset : "Shape");
-  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform ? ` transform="${transform}"` : ""}>${paths}${text2}</g></svg>`;
+  return `<svg xmlns="http://www.w3.org/2000/svg" width="${round(w)}" height="${round(h)}" viewBox="0 0 ${round(w)} ${round(h)}" style="overflow:visible" role="img" aria-label="${label}"><g${transform ? ` transform="${escapeXml(transform)}"` : ""}>${paths}${text2}</g></svg>`;
 }
 
 // docx/layout/units.ts

package/dist/docx/load/index.cjs

@@ -3207,15 +3207,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/docx/load/index.mjs

@@ -3201,15 +3201,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/docx/ui/index.cjs

@@ -406,10 +406,18 @@ function isNonNegativeSafeInteger(value) {
 }
 
 // collab/identity.ts
+function randomToken() {
+  const cryptoApi = globalThis.crypto;
+  if (cryptoApi?.getRandomValues) {
+    return cryptoApi.getRandomValues(new Uint32Array(2)).reduce((s, n2) => s + n2.toString(36), "").slice(0, 8);
+  }
+  return (fallbackCounter++).toString(36).padStart(8, "0");
+}
+var fallbackCounter = 0;
 function createClientId() {
   const cryptoApi = globalThis.crypto;
   if (cryptoApi?.randomUUID) return cryptoApi.randomUUID();
-  return `c${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`;
+  return `c${Date.now().toString(36)}${randomToken()}`;
 }
 function clientKey(clientId) {
   if (!isValidId(clientId)) throw new Error("Invalid collaboration client ID");
@@ -780,15 +788,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/docx/ui/index.mjs

@@ -384,10 +384,18 @@ function isNonNegativeSafeInteger(value) {
 }
 
 // collab/identity.ts
+function randomToken() {
+  const cryptoApi = globalThis.crypto;
+  if (cryptoApi?.getRandomValues) {
+    return cryptoApi.getRandomValues(new Uint32Array(2)).reduce((s, n2) => s + n2.toString(36), "").slice(0, 8);
+  }
+  return (fallbackCounter++).toString(36).padStart(8, "0");
+}
+var fallbackCounter = 0;
 function createClientId() {
   const cryptoApi = globalThis.crypto;
   if (cryptoApi?.randomUUID) return cryptoApi.randomUUID();
-  return `c${Date.now().toString(36)}${Math.random().toString(36).slice(2, 10)}`;
+  return `c${Date.now().toString(36)}${randomToken()}`;
 }
 function clientKey(clientId) {
   if (!isValidId(clientId)) throw new Error("Invalid collaboration client ID");
@@ -758,15 +766,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/drawingml/index.cjs

@@ -12,15 +12,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/drawingml/index.mjs

@@ -10,15 +10,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/index.cjs

@@ -2226,15 +2226,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at2 = xml.indexOf("<");
+  while (at2 !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at2));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at2 + skip[0].length);
+      if (end === -1) return;
+      at2 = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at2;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at2 = xml.indexOf("<", at2 + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at2 = xml.indexOf("<", at2 + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/index.mjs

@@ -2220,15 +2220,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth2 = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at2 = xml.indexOf("<");
+  while (at2 !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at2));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at2 + skip[0].length);
+      if (end === -1) return;
+      at2 = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at2;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at2 = xml.indexOf("<", at2 + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at2 = xml.indexOf("<", at2 + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/math/index.cjs

@@ -2122,15 +2122,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/math/index.mjs

@@ -2120,15 +2120,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/opc/index.cjs

@@ -138,15 +138,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/opc/index.mjs

@@ -132,15 +132,34 @@ var DEFAULT_XML_LIMITS = {
   maxDepth: 512,
   maxNodes: 5e6
 };
-var MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+var TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+var MARKUP_SKIPS = [
+  ["<!--", "-->"],
+  ["<![CDATA[", "]]>"],
+  ["<?", "?>"]
+];
 function checkXmlLimits(xml, label, limits = {}) {
   const maxDepth = limits.maxDepth ?? DEFAULT_XML_LIMITS.maxDepth;
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at = xml.indexOf("<");
+  while (at !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at + skip[0].length);
+      if (end === -1) return;
+      at = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at = xml.indexOf("<", at + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at = xml.indexOf("<", at + match[0].length);
     if (closing) {
       depth--;
       continue;

package/dist/pptx/automation/index.cjs

@@ -39375,9 +39375,23 @@ function checkXmlLimits(xml, label, limits = {}) {
   const maxNodes = limits.maxNodes ?? DEFAULT_XML_LIMITS.maxNodes;
   let depth = 0;
   let nodes = 0;
-  for (const match of xml.matchAll(MARKUP_RE)) {
-    const [, closing, name, selfClosing] = match;
-    if (name === void 0) continue;
+  let at2 = xml.indexOf("<");
+  while (at2 !== -1) {
+    const skip = MARKUP_SKIPS.find(([open]) => xml.startsWith(open, at2));
+    if (skip) {
+      const end = xml.indexOf(skip[1], at2 + skip[0].length);
+      if (end === -1) return;
+      at2 = xml.indexOf("<", end + skip[1].length);
+      continue;
+    }
+    TAG_RE.lastIndex = at2;
+    const match = TAG_RE.exec(xml);
+    if (!match) {
+      at2 = xml.indexOf("<", at2 + 1);
+      continue;
+    }
+    const [, closing, , selfClosing] = match;
+    at2 = xml.indexOf("<", at2 + match[0].length);
     if (closing) {
       depth--;
       continue;
@@ -39418,7 +39432,7 @@ function named(element, local, ns, lenient = true) {
 function attr(element, local, ns, prefix) {
   return element?.getAttributeNS(ns, local) ?? element?.getAttribute(`${prefix}:${local}`) ?? void 0;
 }
-var DEFAULT_XML_LIMITS, MARKUP_RE, buildXml, isElement, elements, children2, first, relAttr;
+var DEFAULT_XML_LIMITS, TAG_RE, MARKUP_SKIPS, buildXml, isElement, elements, children2, first, relAttr;
 var init_xml = __esm({
   "xml/xml.ts"() {
     init_namespaces();
@@ -39426,7 +39440,12 @@ var init_xml = __esm({
       maxDepth: 512,
       maxNodes: 5e6
     };
-    MARKUP_RE = /<!--[\s\S]*?-->|<!\[CDATA\[[\s\S]*?\]\]>|<\?[\s\S]*?\?>|<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/g;
+    TAG_RE = /<(\/?)([^\s\/>]+)(?:\s+[^\s=\/>]+\s*=\s*(?:"[^"]*"|'[^']*'))*\s*(\/?)>/y;
+    MARKUP_SKIPS = [
+      ["<!--", "-->"],
+      ["<![CDATA[", "]]>"],
+      ["<?", "?>"]
+    ];
     buildXml = (node) => new xmldom.XMLSerializer().serializeToString(node);
     isElement = (node) => node.nodeType === 1;
     elements = (parent) => Array.from(parent.childNodes).filter(isElement);
@@ -93326,9 +93345,9 @@ function prefixOf(qname) {
 function findOutOfScopePrefixes(xml) {
   const missing = /* @__PURE__ */ new Set();
   const stack = [];
-  TAG_RE.lastIndex = 0;
+  TAG_RE2.lastIndex = 0;
   let m;
-  while (m = TAG_RE.exec(xml)) {
+  while (m = TAG_RE2.exec(xml)) {
     if (m[1]) {
       stack.pop();
       continue;
@@ -93418,7 +93437,7 @@ function declareUsedNamespaces(xml) {
   const nameEnd = rootStart + 1 + (/^[^\s/>]+/.exec(rootTag2.slice(1))?.[0].length ?? 0);
   return xml.slice(0, nameEnd) + additions.join("") + xml.slice(nameEnd);
 }
-var WELL_KNOWN_NAMESPACES, NAME, TAG_RE, ATTR_RE, USED_PREFIX_RE, DECL_RE;
+var WELL_KNOWN_NAMESPACES, NAME, TAG_RE2, ATTR_RE, USED_PREFIX_RE, DECL_RE;
 var init_xml_namespace_declarations = __esm({
   "pptx/core/utils/xml-namespace-declarations.ts"() {
     WELL_KNOWN_NAMESPACES = {
@@ -93458,7 +93477,7 @@ var init_xml_namespace_declarations = __esm({
       o: "urn:schemas-microsoft-com:office:office"
     };
     NAME = "[A-Za-z_][\\w.-]*";
-    TAG_RE = new RegExp(
+    TAG_RE2 = new RegExp(
       `<(/?)(${NAME}(?::${NAME})?)((?:\\s+[^\\s=>/]+\\s*=\\s*(?:"[^"]*"|'[^']*'))*)\\s*(/?)>`,
       "g"
     );