chore(deps): bump @xmldom/xmldom and @expo/config-plugins

[dependabot]

Bumps @xmldom/xmldom to 0.8.13 and updates ancestor dependency @expo/config-plugins. These dependencies need to be updated together.

Updates @xmldom/xmldom from 0.7.13 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)
• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

• update ownerDocument when moving nodes between documents [#933](https://github.com/xmldom/xmldom/issues/933) / [#932](https://github.com/xmldom/xmldom/issues/932)

Thank you, @​shunkica, for your contributions

0.8.10

Commits

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

• Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
  • Comment: throws when data contains -->
  • ProcessingInstruction: throws when data contains ?>
  • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
• Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

• implement ParentNode.children getter [#960](https://github.com/xmldom/xmldom/issues/960) / [#410](https://github.com/xmldom/xmldom/issues/410)

Fixed

• Security: createCDATASection now throws InvalidCharacterError when data contains "]]>", as required by the WHATWG DOM spec. GHSA-wh4c-j3r5-mjhp
• Security: XMLSerializer now splits CDATASection nodes whose data contains "]]>" into adjacent CDATA sections at serialization time, preventing XML injection via mutation methods (appendData, replaceData, .data =, .textContent =). GHSA-wh4c-j3r5-mjhp
• correctly traverse ancestor chain in Node.contains [#931](https://github.com/xmldom/xmldom/issues/931)

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

• updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

• preserve trailing whitespace in ProcessingInstruction data [#962](https://github.com/xmldom/xmldom/issues/962) / [#42](https://github.com/xmldom/xmldom/issues/42)

... (truncated)

Commits

• e5c1480 0.8.13
• 9611e20 style: drop unused import in test file
• dc4dff3 docs: add 0.8.13 changelog entry
• 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
• aeff69f test: add normalize behavioral coverage to node.test.js
• cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
• 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
• c007c51 refactor: migrate serializeToString to walkDOM
• 2bb3899 test: add serializeToString coverage for uncovered branches
• e69f38d refactor: migrate importNode to walkDOM
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.

Updates @expo/config-plugins from 7.9.2 to 57.0.5

Changelog

Sourced from @​expo/config-plugins's changelog.

Changelog

This is the log of notable changes to the Expo client that are developer-facing. Package-specific changes not released in any SDK will be added here just before the release. Until then, you can find them in changelogs of the individual packages (see packages directory).

Unpublished

📚 3rd party library updates

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

57.0.0 — 2026-07-08

🛠 Breaking changes

• @expo/ui
  • [universal][android] Use BasicTextField component instead of Filled Material TextField. (#46442 by @​nishan) (#46442 by @​intergalacticspacehighway)
• expo-modules-jsi
  • [iOS] JavaScriptError is now a copyable class conforming to Error (was a non-copyable struct), and JavaScriptValue no longer conforms to Error. (#47154 by @​tsapeta)
• expo-font
  • [web] Removed Server.resetServerContext(). Server-side font state is now scoped per-render via AsyncLocalStorage. (#46669 by @​hassankhan)
• @expo/cli
  • Make expo prebuild clear and regenerate the native folders by default. Pass --no-clean to apply changes to the existing folders instead. (#47209 by @​alanjhughes)

🎉 New features

• Initial release of @expo/require-utils 🥳
• pod-install
  • Support Bundler-managed CocoaPods installations (#43605 by @​tiwari91, @​kitten)
• @expo/ui
  • [iOS] Added the SwiftUI accessibilityHidden modifier to hide decorative views from VoiceOver and other assistive technologies during element traversal. (#46579 by @​ramonclaudio)
  • [iOS] Added the SwiftUI accessibilityIdentifier modifier to set a stable identifier for UI testing tools such as XCUITest. (#46556 by @​ramonclaudio)
  • [iOS] Added the SwiftUI dynamicTypeSize modifier to set or constrain the Dynamic Type size within a view. Accepts a single size or a { min, max } range, and cascades from <Host> to bound how far text scales at the largest accessibility sizes. (#46540 by @​ramonclaudio)
  • [iOS] Added children prop to Label component, allowing custom title views (e.g. a VStack with title and subtitle) while preserving native icon spacing and Dynamic Type icon sizing.
  • [iOS] Add buttonBorderShape SwiftUI modifier, which reshapes a styled button (for example a glass button) while preserving its native press effect. (#46348 by @​nishan) (#46348 by @​intergalacticspacehighway)
  • [jetpack-compose] Added NavigationBar and NavigationBarItem components.
  • [iOS] Added the SwiftUI listRowSpacing modifier. (#46417 by @​qiyangdev)
  • [iOS] Added support for custom SF Symbols in the SwiftUI Image component. (#46183 by @​cinques)
  • [swift-ui] Added <DisclosureGroup.Label> for custom label style. (#46288 by @​kudo)
  • [universal] Added <Collapsible.labelStyle> for custom label style. (#46288 by @​kudo)
  • [jetpack-compose] Added dropShadow and innerShadow modifiers. (#46364 by @​duyanhv)
  • [iOS] Added the SwiftUI imageScale modifier to scale SF Symbols within a view relative to the surrounding text (small, medium, large). (#46774 by @​ramonclaudio)
  • [jetpack-compose] Added onGloballyPositioned modifier, which reports a composable's window position and size. (#46744 by @​nishan) (#46744 by @​intergalacticspacehighway)
  • [iOS] Extended the SwiftUI onGeometryChange modifier to also report the view's global position (x/y) alongside its size. (#46744 by @​nishan) (#46744 by @​intergalacticspacehighway)
  • [iOS] Added the SwiftUI minimumScaleFactor modifier to let text shrink down to a given fraction of its size before truncating. (#46740 by @​nishan) (#46740 by @​intergalacticspacehighway)
  • [iOS][android] Added React Compiler-friendly get() / set() accessors to useNativeState, as an alternative to reading and writing .value. (#46690 by @​nishan) (#46692 by @​intergalacticspacehighway)

... (truncated)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for @​expo/config-plugins since your current version.