Skip to content

chore(deps): update dependency @xmldom/xmldom@<0.8.12 to v0.9.9#4422

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/xmldom-xmldom@-0.8.12-0.x
Open

chore(deps): update dependency @xmldom/xmldom@<0.8.12 to v0.9.9#4422
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/xmldom-xmldom@-0.8.12-0.x

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 12, 2026

This PR contains the following updates:

Package Change Age Confidence
@xmldom/xmldom@<0.8.12 0.8.120.9.9 age confidence

Release Notes

xmldom/xmldom (@​xmldom/xmldom@<0.8.12)

v0.9.9

Compare Source

Added
  • implement ParentNode.children getter #960 / #410
Fixed
  • Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
  • Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
  • correctly traverse ancestor chain in Node.contains #931

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore
  • updated dependencies

Thank you,
@​stevenobiajulu,
@​yoshi389111,
@​thesmartshadow,
for your contributions

v0.9.8

Compare Source

Fixed
  • fix: replace \u2029 as part of normalizeLineEndings #839 / #838
  • perf: speed up line detection #847 / #838
Chore
  • updated dependencies
  • drop jazzer and rxjs devDependencies #845

Thank you,
@​kboshold,
@​Ponynjaa,
for your contributions.

v0.9.7

Compare Source

Added
  • Implementation of hasAttributes #804
Fixed
  • locator is now true even when other options are being used for the DOMParser #802 / #803
  • allow case-insensitive DOCTYPE in HTML #817 / #819
Performance
  • simplify DOM.compareDocumentPosition #805
Chore
  • updated devDependencies

Thank you,
@​zorkow,
@​Ponynjaa,
@​WesselKroos,
for your contributions.

v0.9.6

Compare Source

Fixed
  • lower error level for unicode replacement character #790 / #794 / #797
Chore
  • updated devDependencies
  • migrate renovate config #792

Thank you, @​eglitise, for your contributions.

v0.9.5

Compare Source

Fixed
  • fix: re-index childNodes on insertBefore #763 / #766

Thank you,
@​mureinik,
for your contributions.

v0.9.4

Compare Source

Fixed
  • restore performance for large amount of child nodes #748 / #760
  • types: correct error handler level to warning (#​759) #754 / #759
Docs
  • test: verify BOM handling #758

Thank you,
@​luffynando,
@​mattiasw,
@​JoinerDev,
for your contributions.

v0.9.3

Compare Source

Fixed
  • restore more Node and ProcessingInstruction types #725 / #726
  • getElements* methods return LiveNodeList&lt;Element&gt; #731 / #734
  • Add more missing Node props #728, triggered by unclosed #724
Docs
Chore
  • updates devDependencies

Thank you,
@​Ponynjaa,
@​ayZagen,
@​sserdyuk,
@​wydengyre,
@​mykola-mokhnach,
@​benkroeger,
for your contributions.

v0.9.2

Compare Source

Feature
  • add Element.getElementsByClassName #722
Fixed
  • add missing types for Document.documentElement and Element.tagName #721 #720

Thank you, @​censujiang, @​Mathias-S, for your contributions

v0.9.1

Compare Source

Fixed
  • DOMParser.parseFromString requires mimeType as second argument #713
  • correct spelling of isHTMLMimeType in type definition #715 / #712
  • sync types with exports #717 / #285 / #695
Other
  • minimum tested node version is 14 #710

Thank you, @​krystofwoldrich, @​marvinruder, @​amacneil, @​defunctzombie,
@​tjhorner, @​danon, for your contributions

v0.9.0

Compare Source

Features
  • feat: expose all DOM level 2 element prototypes #637 / #40
  • feat: add iterator function to NodeList and NamedNodeMap #634 / #633
Fixed
  • parse empty/whitspace only doctype internal subset #692
  • avoid prototype clash in namespace prefix #554
  • report fatalError when doctype is inside elements #550
Other
  • test: add fuzz target and regression tests #556
  • chore: improve .gitignore and provide .envrc.template #697
  • chore: Apply security best practices #546
  • ci: check test coverage in PRs #524
  • docs: add missing commas to readme #566
  • docs: click to copy install command in readme #644
  • docs: enhance jsdoc comments #511

Thank you, @​kboshold, @​edi9999, @​apupier,
@​shunkica, @​homer0, @​jhauga,
@​UdayKharatmol, for your contributions


Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Apr 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

breaking changes dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant