Bump fast-xml-parser from 4.5.3 to 4.5.7

[dependabot]

Bumps fast-xml-parser from 4.5.3 to 4.5.7.

Release notes

Sourced from fast-xml-parser's releases.

Summary update on all the previous releases from v4.2.4

• Multiple minor fixes provided in the validator and parser
• v6 is added for experimental use.
• ignoreAttributes support function, and array of string or regex
• Add support for parsing HTML numeric entities
• v5 of the application is ESM module now. However, JS is also supported

Note: Release section in not updated frequently. Please check CHANGELOG or Tags for latest release information.

Commits

• 49a12f1 4.5.7
• 59d0145 update changelog
• e561c21 fix: escape comment and CDATA delimiters when building XML (GHSA-gh4j-gqv2-49...
• 42fbb0b update release info
• 805671c increase expansion limit as many system need it
• 9a2cf09 update version
• 88d0936 apply all fixes from v5
• d4eb6b4 update release version
• See full diff in compare view

---

Note

Low Risk
Dependency-only lockfile update with no direct code changes; risk is limited to transitive XML parsing in RN CLI tooling, and the bump includes security fixes rather than risky new behavior.

Overview
Updates the lockfile so fast-xml-parser resolves to 4.5.7 (from 4.5.3), with a minor strnum constraint change. The diff also drops a nested chain-registry entry under @chain-registry/utils as part of lockfile normalization.

This is a transitive dependency (e.g. React Native Community CLI packages that parse XML for Android/iOS config), not a direct app source change. The newer release includes security and parser fixes, notably escaping comment/CDATA delimiters when building XML and other backported validator/parser fixes.

^{Reviewed by Cursor Bugbot for commit 5a5ea34. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm fast-xml-parser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@react-native-community/cli@18.0.0 → npm/@react-native-community/cli-platform-android@18.0.0 → npm/@react-native-community/cli-platform-ios@18.0.0 → npm/react-native-bootsplash@6.3.8 → npm/fast-xml-parser@4.5.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report