build(deps): bump @xmldom/xmldom, expo and jest-expo

[dependabot]

Bumps @xmldom/xmldom to 0.8.13 and updates ancestor dependencies @xmldom/xmldom, expo and jest-expo. These dependencies need to be updated together.

Updates @xmldom/xmldom from 0.7.13 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)
• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

• update ownerDocument when moving nodes between documents [#933](https://github.com/xmldom/xmldom/issues/933) / [#932](https://github.com/xmldom/xmldom/issues/932)

Thank you, @​shunkica, for your contributions

0.8.10

Commits

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

• implement ParentNode.children getter [#960](https://github.com/xmldom/xmldom/issues/960) / [#410](https://github.com/xmldom/xmldom/issues/410)

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains [#931](https://github.com/xmldom/xmldom/issues/931)

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)

... (truncated)

Commits

• e5c1480 0.8.13
• 9611e20 style: drop unused import in test file
• dc4dff3 docs: add 0.8.13 changelog entry
• 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
• aeff69f test: add normalize behavioral coverage to node.test.js
• cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
• 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
• c007c51 refactor: migrate serializeToString to walkDOM
• 2bb3899 test: add serializeToString coverage for uncovered branches
• e69f38d refactor: migrate importNode to walkDOM
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.

Updates expo from 51.0.38 to 56.0.8

Changelog

Sourced from expo's changelog.

Changelog

This is the log of notable changes to the Expo client that are developer-facing. Package-specific changes not released in any SDK will be added here just before the release. Until then, you can find them in changelogs of the individual packages (see packages directory).

Unpublished

📚 3rd party library updates

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

56.0.0 — 2026-06-01

🛠 Breaking changes

• unimodules-app-loader
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-web-browser
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-video-thumbnails
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-task-manager
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-store-review
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-speech
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-sqlite
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-sms
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-sharing
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-secure-store
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-sensors
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-screen-capture
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-screen-orientation
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-print
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-network
  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
• expo-notifications

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo since your current version.

Updates jest-expo from 51.0.4 to 56.0.4

Changelog

Sourced from jest-expo's changelog.

56.0.4 — 2026-05-20

🎉 New features

• Align jest-expo's Babel config loading with @expo/metro-config changes (#45968 by @​kitten)

56.0.3 — 2026-05-15

This version does not introduce any user-facing changes.

56.0.2 — 2026-05-13

This version does not introduce any user-facing changes.

56.0.1 — 2026-05-13

🐛 Bug fixes

• Switch from react-native/jest-preset to @react-native/jest-preset (#45699 by @​kitten)

💡 Others

• Bump to react-server-dom-webpack@~19.0.6 (#45645 by @​kitten)

56.0.0 — 2026-05-05

🐛 Bug fixes

• Add missing expo-modules-core dependency. (#44874 by @​zoontek)
• Add @react-native/babel-preset to ignored transform patterns, since it's part of the transformer pipeline (#44152 by @​kitten)

💡 Others

• Drop expo dependencies from jest-expo to prevent cycles (#45048 by @​kitten)
• Fixed expo/fetch testing. (#44987 by @​kudo)

⚠️ Notices

• Added support for React Native 0.84.x. (#43018 by @​chrfalch)

55.0.17 - 2026-05-05

This version does not introduce any user-facing changes.

55.0.16 - 2026-04-13

This version does not introduce any user-facing changes.

55.0.15 - 2026-04-09

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for jest-expo since your current version.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.