Skip to content

build(deps): bump fast-xml-parser, webdav and @nextcloud/eslint-config - #219

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-3de20ca3ca
Closed

build(deps): bump fast-xml-parser, webdav and @nextcloud/eslint-config#219
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-3de20ca3ca

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps fast-xml-parser to 5.10.1 and updates ancestor dependencies fast-xml-parser, webdav and @nextcloud/eslint-config. These dependencies need to be updated together.

Updates fast-xml-parser from 4.5.4 to 5.10.1

Release notes

Sourced from fast-xml-parser's releases.

v5.10.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.10.0...v5.10.1

v5.10.0

What's Changed

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.3...v5.10.0

v5.9.3

What's Changed

New Contributors

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.2...v5.9.3

v5.9.2

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.1...v5.9.2

v5.9.1

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.9.0...v5.9.1

update strnum, use is-unsafe

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

update strnum, FXB. Use xml-naming for DOCTYPE

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname because of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is by deault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

fix minor old bugs and update builder

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

backward compatibility for numerical external entity, fix #705, #817

  • allow numerical external entity for backward compatibility
  • fix #705: attributesGroupName working with preserveOrder

... (truncated)

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.10.1 / 2026-07-17

  • fix: multiple DOCTYPE declarations.
  • deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

  • upgrade:
    • xml-naming v0.3.0: cache support
    • PEM v1.6.2: sibling bug fix
    • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

  • update strnum

*5.9.2 / 2026-06-17

  • dummy release to test changes in github action

*5.9.1 / 2026-06-17

  • dummy release to test release from github action

*5.9.0 / 2026-06-15

  • update strnum to 2.3.0
    • you can set hex, binary, enotation, infinity, unicode
  • validate unsafe HTML or XML data in doctype entities unsing 'is-unsafe' library. User can override rules by overriding EntityDecoder.

*5.8.0 / 2026-05-12

  • integrate xml-naming to validate DOCTYPE entity name and notation name (using qname becaue of backward compatibility)
    • This will consider xml-version as well. '1.0' is default
  • update strnum to 2.3.0
    • You can set octal and binary parsing which is bydeault off
  • update fast-xml-builder to 1.2.0
    • can sanitize tag names if found invalid
    • fix format output

5.7.3 / 2006-05-05

  • fix: alwaysCreateTextNode should create text node when attributes are present for self closing node
  • fix stop node expression when ns prefix is removed (found by iruizsalinas)
  • update XML Builder to 1.1.7
  • mark addEntity deprecated

5.7.2 / 2026-04-25

  • allow numerical external entity for backward compatibility

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for fast-xml-parser since your current version.


Updates webdav from 5.8.0 to 5.10.0

Changelog

Sourced from webdav's changelog.

v5.10.0

2026-05-03

  • #406 Allow setting entity expansion limits (defaults to unlimited, again)
  • Dependency audit fixes and upgrades

v5.9.0

2026-02-04

Commits

Updates @nextcloud/eslint-config from 8.4.2 to 9.0.1

Release notes

Sourced from @​nextcloud/eslint-config's releases.

v9.0.1

v9.0.1 (2026-07-07)

Fixed

  • fix(vue): error on vue/attributes-order and vue/order-in-components instead of warn #1445 (susnux)
  • fix: no-deprecated-library-* rules incorrectly behave for nextcloud/vue syntax #1452 (Antreesy)
  • fix(no-deprecated-library-props): support win32 filesystem and different @nextcloud/vue directory structures #1454 (ShGKme)
  • fix(no-deprecated-library-props): support camelCase attributes #1453 (Antreesy)
  • fix: increase min. Node version to 22.14 #1455 (susnux)

v9.0.0

v9.0.0 (2026-06-26)

Breaking

This package now is using ESLint v10 and requires ESLint flat configurations. Please refer to the README on how to adjust your configuration for flat config.

Potential pitfalls

Some of the used eslint plugins still keep a ESLint v8 compatibility, this can cause some issues if not all packages are updated to the ESLint v10 compatible version.

If you see a linter error like the one below make sure to update all nested dependencies, either using the sledge hammer method (remove the lock file and run npm i) or by running npm update.

TypeError: scopeManager.addGlobals is not a function

Added

  • feat: migrate to ESLint v10 #1323 (susnux)
  • feat: new modular config for (and with) ESLint v9 support #887
  • feat: merge plugin repository #899
  • feat: enforce non-breaking spaces before ellipsis for translations #948
  • feat: add special config for libraries #949
  • feat: add import and export rules #981
  • feat: introduce @​nextcloud/vue eslint plugin #939
  • feat(codeStyle): enforce top-level-function #1033 (ShGKme)
  • feat(nextcloud-vue): add rule for deprecated NcButton props #1045 (susnux)
  • feat(vue): add vue/no-useless-v-bind rule #1063 (susnux)
  • feat(vue): add vue/prefer-separate-static-class rule #1065 (susnux)
  • feat(vue3): add script-setup releated rules #1064 (susnux)
  • feat(no-deprecated-props): extend existing rules to support other components #1069 (Antreesy)
  • feat(imports): add custom plugin to suggest file extensions #1110 (susnux)
  • feat(filesystem): ignore all files within the .gitignore #1108 (susnux)
  • feat(l10n-plugin): also handle vue templates #1113 (susnux)
  • feat(nextcloud-vue-plugin): deprecate additional props #1163 (Antreesy)
  • feat(nextcloud-vue-plugin): deprecate additional exports #1162 (Antreesy)
  • feat(nextcloud-vue-plugin): deprecate NcPopover props #1165 (Antreesy)
  • feat(vue): add vue/component-options-name-casing with PascalCase #1261 (ShGKme)
  • feat(vue3): force camelCase for events in <script> #1262 (ShGKme)
  • feat(vue3): force camelCase for events in \<template> #1263 (ShGKme)
  • feat(vue3): force camelCase for slot names #1264 (ShGKme)
  • feat(vue3): force camelCase for props in template #1266 (ShGKme)

... (truncated)

Changelog

Sourced from @​nextcloud/eslint-config's changelog.

v9.0.1 (2026-07-07)

Fixed

  • fix(vue): error on vue/attributes-order and vue/order-in-components instead of warn #1445 (susnux)
  • fix: no-deprecated-library-* rules incorrectly behave for nextcloud/vue syntax #1452 (Antreesy)
  • fix(no-deprecated-library-props): support win32 filesystem and different @nextcloud/vue directory structures #1454 (ShGKme)
  • fix(no-deprecated-library-props): support camelCase attributes #1453 (Antreesy)
  • fix: increase min. Node version to 22.14 #1455 (susnux)

v9.0.0 (2026-06-26)

Breaking

This package now is using ESLint v10 and requires ESLint flat configurations. Please refer to the README on how to adjust your configuration for flat config.

Potential pitfalls

Some of the used eslint plugins still keep a ESLint v8 compatibility, this can cause some issues if not all packages are updated to the ESLint v10 compatible version.

If you see a linter error like the one below make sure to update all nested dependencies, either using the sledge hammer method (remove the lock file and run npm i) or by running npm update.

TypeError: scopeManager.addGlobals is not a function

Added

  • feat: migrate to ESLint v10 #1323 (susnux)
  • feat: new modular config for (and with) ESLint v9 support #887
  • feat: merge plugin repository #899
  • feat: enforce non-breaking spaces before ellipsis for translations #948
  • feat: add special config for libraries #949
  • feat: add import and export rules #981
  • feat: introduce @​nextcloud/vue eslint plugin #939
  • feat(codeStyle): enforce top-level-function #1033 (ShGKme)
  • feat(nextcloud-vue): add rule for deprecated NcButton props #1045 (susnux)
  • feat(vue): add vue/no-useless-v-bind rule #1063 (susnux)
  • feat(vue): add vue/prefer-separate-static-class rule #1065 (susnux)
  • feat(vue3): add script-setup releated rules #1064 (susnux)
  • feat(no-deprecated-props): extend existing rules to support other components #1069 (Antreesy)
  • feat(imports): add custom plugin to suggest file extensions #1110 (susnux)
  • feat(filesystem): ignore all files within the .gitignore #1108 (susnux)
  • feat(l10n-plugin): also handle vue templates #1113 (susnux)
  • feat(nextcloud-vue-plugin): deprecate additional props #1163 (Antreesy)
  • feat(nextcloud-vue-plugin): deprecate additional exports #1162 (Antreesy)
  • feat(nextcloud-vue-plugin): deprecate NcPopover props #1165 (Antreesy)
  • feat(vue): add vue/component-options-name-casing with PascalCase #1261 (ShGKme)
  • feat(vue3): force camelCase for events in <script> #1262 (ShGKme)
  • feat(vue3): force camelCase for events in \<template> #1263 (ShGKme)
  • feat(vue3): force camelCase for slot names #1264 (ShGKme)
  • feat(vue3): force camelCase for props in template #1266 (ShGKme)
  • feat(import): enforce consistent types imports and ban usage of inline type specifiers #1382 (susnux)

Fixed

... (truncated)

Commits
  • 660197b Merge pull request #1456 from nextcloud-libraries/chore/v901
  • f466ba3 chore: prepare v9.0.1
  • 3755602 Merge pull request #1455 from nextcloud-libraries/fix/reg-node
  • c3e12f3 Merge pull request #1453 from nextcloud-libraries/fix/1001/adjust-rules-camel...
  • 282d890 fix: support camelCase attributes for deprecations
  • 6e88372 fix: increase min. Node version to 22.14
  • 4f469a3 Merge pull request #1454 from nextcloud-libraries/fix/find-package-json-lib
  • 1662e34 fix(no-deprecated-library-props): support win32 fs
  • 0e56404 Merge pull request #1447 from nextcloud-libraries/dependabot/npm_and_yarn/esl...
  • 60bb082 Merge pull request #1452 from nextcloud-libraries/fix/1001/adjust-rules
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​nextcloud/eslint-config since your current version.

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 26, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code labels Jul 26, 2026
@dependabot dependabot Bot mentioned this pull request Jul 26, 2026
Closed
@oleksandr-nc

oleksandr-nc commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
build(deps): bump fast-xml-parser, webdav and @nextcloud/eslint-config
2ab0db5 
Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) to 5.10.1 and updates ancestor dependencies [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser), [webdav](https://github.com/perry-mitchell/webdav-client) and [@nextcloud/eslint-config](https://github.com/nextcloud-libraries/eslint-config). These dependencies need to be updated together.


Updates `fast-xml-parser` from 4.5.4 to 5.10.1
- [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases)
- [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md)
- [Commits](NaturalIntelligence/fast-xml-parser@v4.5.4...v5.10.1)

Updates `webdav` from 5.8.0 to 5.10.0
- [Changelog](https://github.com/perry-mitchell/webdav-client/blob/master/CHANGELOG.md)
- [Commits](perry-mitchell/webdav-client@v5.8.0...v5.10.0)

Updates `@nextcloud/eslint-config` from 8.4.2 to 9.0.1
- [Release notes](https://github.com/nextcloud-libraries/eslint-config/releases)
- [Changelog](https://github.com/nextcloud-libraries/eslint-config/blob/main/CHANGELOG.md)
- [Commits](nextcloud-libraries/eslint-config@v8.4.2...v9.0.1)

---
updated-dependencies:
- dependency-name: "@nextcloud/eslint-config"
  dependency-version: 9.0.1
  dependency-type: direct:development
- dependency-name: fast-xml-parser
  dependency-version: 5.10.1
  dependency-type: indirect
- dependency-name: webdav
  dependency-version: 5.10.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/multi-3de20ca3ca branch from b288f25 to 2ab0db5 Compare July 31, 2026 11:53
@oleksandr-nc

oleksandr-nc commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Closing: this cannot be merged as-is, but its security content has been reapplied elsewhere.

The PR bundles two unrelated things. The useful half is fast-xml-parser 4.5.4 → 5.10.1 and webdav 5.8.0 → 5.10.0. The other half raises @nextcloud/eslint-config 8.4.2 → 9.0.1 and eslint 8.57.1 → 10.8.0, and that breaks the build:

error during build:
[vite-plugin-eslint] Could not find config file.
    at assertConfigurationExists (node_modules/eslint/lib/config/config-loader.js:80:17)

ESLint 9+ requires a flat config, and this app still ships .eslintrc.cjs, so vite-plugin-eslint finds nothing during the build. Confirmed three independent ways: CI here reports NPM build, NPM lint, eslint and node all failing; merging this into current main locally fails the same way; and building the merged tree copied outside the server checkout — where no ancestor eslint.config.js can interfere — fails too.

The fast-xml-parser and webdav updates are in chore/security-updates, together with the advisories the other closed PRs left behind (vite 7.3.6, js-yaml 4.3.0, brace-expansion, @babel/core), with eslint held at 8.57.1.

Migrating to flat config is worth doing, but it is its own change: it needs .eslintrc.cjs converted to eslint.config.js and the lint script's --ext flag dropped, which no longer exists in flat mode.

@dependabot @github

dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-3de20ca3ca branch July 31, 2026 12:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@oleksandr-nc oleksandr-nc Awaiting requested review from oleksandr-nc oleksandr-nc is a code owner
@kyteinsky kyteinsky Awaiting requested review from kyteinsky kyteinsky is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update Javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@oleksandr-nc