[dependabot]

Bumps fast-xml-parser from 5.11.2 to 5.12.0.

Release notes

Sourced from fast-xml-parser's releases.

v5.12.0

What's Changed

• fix: add endIndex to the CommonJS XMLMetaData declaration by @​dualfroz in NaturalIntelligence/fast-xml-parser#896
• Bump zizmorcore/zizmor-action from 0.6.1 to 0.8.0 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#906
• Bump actions/setup-node from 7.0.0 to 7.1.0 by @​dependabot[bot] in NaturalIntelligence/fast-xml-parser#904
• fix: preserve original metadata offsets for CRLF input by @​Sskift in NaturalIntelligence/fast-xml-parser#911
• docs: update NASA link in users list by @​CodeVertex55 in NaturalIntelligence/fast-xml-parser#885
• README.md: fix documentation links by @​maxlath in NaturalIntelligence/fast-xml-parser#872
• test: drop shadowed ignoreAttributes option by @​rajanpanth in NaturalIntelligence/fast-xml-parser#863

New Contributors

• @​dualfroz made their first contribution in NaturalIntelligence/fast-xml-parser#896
• @​Sskift made their first contribution in NaturalIntelligence/fast-xml-parser#911
• @​CodeVertex55 made their first contribution in NaturalIntelligence/fast-xml-parser#885
• @​maxlath made their first contribution in NaturalIntelligence/fast-xml-parser#872

Full Changelog: NaturalIntelligence/fast-xml-parser@v5.11.2...v5.12.0

Changelog

Sourced from fast-xml-parser's changelog.

Note: If you find missing information about particular minor version, that version must have been changed without any functional change in this library.

Note: Due to some last quick changes on v4, detail of v4.5.3 & v4.5.4 are not updated here. v4.5.4x is the last tag of v4 in github repository. I'm extremely sorry for the confusion

5.12.0 / 2026-11-03

• perf improvement for stop node: After the first failure in a given stop node, the function stops using readTagExp and switches to a cheap fallback.
• devdep:jasmine 7.0
• deps:
  • @​nodable/entities v3.1.0
  • fast-xml-builder v1.3.1
  • is-unsafe v2.0.3
  • strnum v2.5.1
• fix cjs typing
• fix: preserve original metadata offsets for CRLF input (#911) (By sskift)

5.11.2 / 2026-09-29

• fix (#875): decode Uint8Array XML input as UTF-8 (By emme1t)
• fix (#880) :type EntityDecoderOptions.setXmlVersion's version as a number (By Yevhenii Kotyrlo)

5.11.1 / 2026-08-27

• fix: validator; Replace regex with a single-pass scanner for attribute tokens, eliminating quadratic behavior on long whitespace runs.

5.11.0 / 2026-08-16

• feat: support for endIndex in node metadata (#850) [By Pavel Dranichnikov]
• fix: don't crash on a closing tag with no matching opening tag (#861) [By Haïm Dimer]
• fix: DOCTYPE to read SYSTEM/PUBLIC
• deps: strnum v2.4.2

5.10.1 / 2026-07-17

• fix: multiple DOCTYPE declarations.
• deps: @nodable/entities for treeshaking

5.10.0 / 2026-07-11

• upgrade:
  • xml-naming v0.3.0: cache support
  • PEM v1.6.2: sibling bug fix
  • is-unsafe v2.0.0: tree shaking

*5.9.3 / 2026-06-19

• update strnum

*5.9.2 / 2026-06-17

• dummy release to test changes in github action

*5.9.1 / 2026-06-17

• dummy release to test release from github action

*5.9.0 / 2026-06-15

• update strnum to 2.3.0

... (truncated)

Commits

• 976470f 5.12.0
• e6703ce update changelog
• cad3004 update browser bundle
• 404b15e deps update
• 1792392 devdep: jasmine 7
• edea043 specs: No duplicate suit or test name
• 0c36593 perf: stopnode
• 5680565 test: drop shadowed ignoreAttributes option (#863)
• 6b855c2 README.md: fix documentation links (#872)
• 4ad1388 docs: update NASA link in users list (#885)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[mittwald-machine]

🤖 Automated dependency review

Decision: Escalated to @mittwald/developer-relations

What changed upstream

Nothing changed since this workflow's earlier review of this PR (2026-11-09): fast-xml-parser 5.12.0 (release notes, changelog) is still the latest version on npm, the PR head is still 48e5d864 with no new commits, and no maintainer comments or reviews were added. The earlier review's summary of the upstream changes still applies unchanged: a CRLF metadata-offset fix that only runs when captureMetaData is enabled, a stopNode performance improvement that only applies when stopNodes are configured, a CJS typing fix (adds endIndex to the CommonJS XMLMetaData declaration), and the internal dependency updates that show up in the lockfile (fast-xml-builder 1.2.0 → 1.3.1, strnum 2.4.2 → 2.5.1, is-unsafe 2.0.0 → 2.0.3). There is no new upstream content to evaluate this run.

Impact on this repository

Unchanged from the earlier review: package.json already declares ^5.2.5, so the PR touches only yarn.lock and the .yarn/cache zips. I re-verified against the installed 5.12.0 type declarations (node_modules/fast-xml-parser/src/fxp.d.ts, installed version confirmed as 5.12.0): every parser and builder option used in src/lib/intellij/config.ts — ignoreAttributes, attributeNamePrefix, parseAttributeValue, format, suppressBooleanAttributes — is still declared, the dual ESM/CJS exports map is unchanged, the package declares no engines.node, and the license is still MIT. None of the 5.12.0 changes affect this repository's code path (the CRLF fix requires captureMetaData, the stopNode perf change requires stopNodes, and the strnum updates only touch edge-case number coercion of tag text), so no breaking change applies here.

Changes pushed to this PR

None.

Verification

I re-ran the full local check suite on this run and everything passes: yarn lint (clean), yarn compile (clean), and yarn test (Prettier check, license check, 192 unit tests including the intellij parse/build round-trip tests, 7 snapshots). CI on the PR head is unchanged from the earlier review: lint, compile, unit tests, license, README, docker image, and dependency resolution on Node 22 and 24 all pass; the only failure is still the pre-existing dependabot check, which fails on every Dependabot PR because the gh pr review --approve step in .github/workflows/automerge.yml hits the platform restriction "GitHub Actions is not permitted to approve pull requests" — unrelated to this bump and not fixable from this PR.

Why this needs a human

The technical review is unchanged and positive — no code changes are needed and the PR would be safe to merge as-is — but the PR still cannot be merged for reasons outside this repository's code, and nothing has changed on that front since the earlier review. (1) mergeStateStatus is still BLOCKED while mergeable is MERGEABLE, and reviewDecision is REVIEW_REQUIRED with no reviews on the PR, so a required review and/or a branch-protection rule on master is unsatisfied; the available token cannot read the branch-protection rules (HTTP 403), so the exact blocking rule cannot be identified from here. (2) The earlier run's merge attempts failed with GraphQL: mittwald-machine does not have the correct permissions to execute MergePullRequest (with and without --admin); the PR is still open and unmerged two days later with no maintainer activity, so that permission gap appears to be persistent, and re-deciding "merge" would only reproduce the same failed merge attempt. (3) The persistently failing dependabot check remains a further candidate blocker if it is configured as a required status check. What needs to happen: restore merge permission for the account the review workflow uses and/or satisfy the required review or branch protection on master, and fix the broken approve step in automerge.yml (out of scope for this review, which may not touch .github/). Once unblocked, this PR is safe to merge without any code changes.

_{Workflow run}