Skip to content

build(deps): bump @xmldom/xmldom, expo and jest-expo#550

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-db9ca790cd
Closed

build(deps): bump @xmldom/xmldom, expo and jest-expo#550
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-db9ca790cd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps @xmldom/xmldom to 0.8.13 and updates ancestor dependencies @xmldom/xmldom, expo and jest-expo. These dependencies need to be updated together.

Updates @xmldom/xmldom from 0.7.13 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

0.8.10

Commits

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

  • updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

... (truncated)

Commits
  • e5c1480 0.8.13
  • 9611e20 style: drop unused import in test file
  • dc4dff3 docs: add 0.8.13 changelog entry
  • 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
  • aeff69f test: add normalize behavioral coverage to node.test.js
  • cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
  • 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
  • c007c51 refactor: migrate serializeToString to walkDOM
  • 2bb3899 test: add serializeToString coverage for uncovered branches
  • e69f38d refactor: migrate importNode to walkDOM
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates expo from 51.0.38 to 55.0.17

Changelog

Sourced from expo's changelog.

Changelog

This is the log of notable changes to the Expo client that are developer-facing. Package-specific changes not released in any SDK will be added here just before the release. Until then, you can find them in changelogs of the individual packages (see packages directory).

Unpublished

📚 3rd party library updates

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

55.0.0 — 2026-02-25

🛠 Breaking changes

  • expo-notifications
    • expose BackgroundNotificationTaskResult (#41291 by @​vonovak)
    • [ios], [internal] rename EXNotifications pod to ExpoNotifications (#42009 by @​vonovak)
    • [android] throw instead of logging a warning when attempting to use push notifications with Expo Go (#39459 by @​vonovak)
  • expo-modules-core
  • expo-localization
    • [Android] Default allowDynamicLocaleChangesAndroid to true when supportedLocales is configured (#41813 by @​Ubax)
  • expo-image-loader
  • expo-clipboard
    • Removed deprecated content property of the clipboard event listener. Use getStringAsync() instead. (#41739 by @​barthap)
  • expo-cellular
    • remove deprecated JS constants, return null as a replacement for deprecated native iOS methods (#43035 by @​vonovak)
  • expo-brightness
  • expo-blur
    • [Android] The dimezisBlurView experimental blur method will no longer work without creating a related BlurTargetView. (#39990 by @​behenate)

🎉 New features

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates jest-expo from 51.0.4 to 55.0.16

Changelog

Sourced from jest-expo's changelog.

Changelog

This is the log of notable changes to the Expo client that are developer-facing. Package-specific changes not released in any SDK will be added here just before the release. Until then, you can find them in changelogs of the individual packages (see packages directory).

Unpublished

📚 3rd party library updates

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

55.0.0 — 2026-02-25

🛠 Breaking changes

  • expo-notifications
    • expose BackgroundNotificationTaskResult (#41291 by @​vonovak)
    • [ios], [internal] rename EXNotifications pod to ExpoNotifications (#42009 by @​vonovak)
    • [android] throw instead of logging a warning when attempting to use push notifications with Expo Go (#39459 by @​vonovak)
  • expo-modules-core
  • expo-localization
    • [Android] Default allowDynamicLocaleChangesAndroid to true when supportedLocales is configured (#41813 by @​Ubax)
  • expo-image-loader
  • expo-clipboard
    • Removed deprecated content property of the clipboard event listener. Use getStringAsync() instead. (#41739 by @​barthap)
  • expo-cellular
    • remove deprecated JS constants, return null as a replacement for deprecated native iOS methods (#43035 by @​vonovak)
  • expo-brightness
  • expo-blur
    • [Android] The dimezisBlurView experimental blur method will no longer work without creating a related BlurTargetView. (#39990 by @​behenate)

🎉 New features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for jest-expo since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 22, 2026
@dependabot dependabot Bot mentioned this pull request Apr 22, 2026
Closed
@dependabot
build(deps): bump @xmldom/xmldom, expo and jest-expo
b0c0d09 
Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) to 0.8.13 and updates ancestor dependencies [@xmldom/xmldom](https://github.com/xmldom/xmldom), [expo](https://github.com/expo/expo/tree/HEAD/packages/expo) and [jest-expo](https://github.com/expo/expo/tree/HEAD/packages/jest-expo). These dependencies need to be updated together.


Updates `@xmldom/xmldom` from 0.7.13 to 0.8.13
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.7.13...0.8.13)

Updates `expo` from 51.0.38 to 55.0.17
- [Changelog](https://github.com/expo/expo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo)

Updates `jest-expo` from 51.0.4 to 55.0.16
- [Changelog](https://github.com/expo/expo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/jest-expo)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.13
  dependency-type: indirect
- dependency-name: expo
  dependency-version: 55.0.17
  dependency-type: direct:production
- dependency-name: jest-expo
  dependency-version: 55.0.16
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-db9ca790cd branch from 0eb658a to b0c0d09 Compare April 27, 2026 06:23
@dependabot @github

dependabot Bot commented on behalf of github May 4, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #558.

@dependabot dependabot Bot closed this May 4, 2026
@dependabot dependabot Bot deleted the dependabot/npm_and_yarn/multi-db9ca790cd branch May 4, 2026 06:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants