Bump @rgrove/parse-xml from 4.2.1 to 5.0.0

[dependabot]

Bumps @rgrove/parse-xml from 4.2.1 to 5.0.0.

Release notes

Sourced from @​rgrove/parse-xml's releases.

v5.0.0

parse-xml is now an ES module. The API is completely unchanged, but the package format and the minimum supported Node.js version have changed. See below for details.

Breaking Changes

• parse-xml is now an ES module. The package sets "type": "module" and ships ESM rather than CommonJS.

  If you already use import, you don't need to change anything:

  import { parseXml } from '@rgrove/parse-xml';

  Using require() also still works in Node.js 22+ thanks to require(esm):

  const { parseXml } = require('@rgrove/parse-xml');

  There are two cases that will require a change: bundlers or runtimes that can't resolve ESM at all will no longer work, and if your own project is CommonJS and written in TypeScript, you'll need TypeScript 5.8 or later with "module": "nodenext". Older versions of TypeScript and configs using "module": "node16" don't support require(esm) and will report an error.

• Node.js 22.12.0 is now the minimum supported version (up from 14.0.0, which hadn't actually been tested in some time).

• The package now has an exports map, so only its public API can be imported. The root entry and the Xml* node classes are unaffected:

  import { parseXml, XmlElement } from '@rgrove/parse-xml';
  import { XmlElement } from '@rgrove/parse-xml/dist/lib/XmlElement.js';

  But Parser, StringScanner, syntax, and types are no longer importable. These were never documented as public or exported from the package's entry point so this is unlikely to affect most people.

• The browser bundle at dist/browser.js is now ESM rather than CommonJS. This is the file bundlers pick up via the browser field, so it should be transparent. As an added bonus, it's also 1.1 KB smaller now.

  The minified global bundle at dist/global.min.js is unchanged, so loading parse-xml from a CDN with a <script> element and using the parseXml global works exactly as before.

Other Changes

• The published npm package is about 40% smaller (48 KB packed, down from 82 KB in 4.2.3) because it no longer includes unnecessary sourcemaps that are only useful during development.

Full Changelog: rgrove/parse-xml@v4.2.3...v5.0.0

v4.2.3

Fixed

• A document that starts with a valid processing instruction whose first characters are xml, such as <?xml-stylesheet ...?>, is no longer incorrectly rejected for having an invalid XML declaration. #47 (@​spokodev)

Full Changelog: rgrove/parse-xml@v4.2.2...v4.2.3

v4.2.2

... (truncated)

Changelog

Sourced from @​rgrove/parse-xml's changelog.

5.0.0 (2026-08-29)

parse-xml is now an ES module. The API is completely unchanged, but the package format and the minimum supported Node.js version have changed. See below for details.

Breaking Changes

• parse-xml is now an ES module. The package sets "type": "module" and ships ESM rather than CommonJS.

  If you already use import, you don't need to change anything:

  import { parseXml } from '@rgrove/parse-xml';

  Using require() also still works in Node.js 22+ thanks to require(esm):

  const { parseXml } = require('@rgrove/parse-xml');

  There are two cases that will require a change: bundlers or runtimes that can't resolve ESM at all will no longer work, and if your own project is CommonJS and written in TypeScript, you'll need TypeScript 5.8 or later with "module": "nodenext". Older versions of TypeScript and configs using "module": "node16" don't support require(esm) and will report an error.

• Node.js 22.12.0 is now the minimum supported version (up from 14.0.0, which hadn't actually been tested in some time).

• The package now has an exports map, so only its public API can be imported. The root entry and the Xml* node classes are unaffected:

  import { parseXml, XmlElement } from '@rgrove/parse-xml';
  import { XmlElement } from '@rgrove/parse-xml/dist/lib/XmlElement.js';

  But Parser, StringScanner, syntax, and types are no longer importable. These were never documented as public or exported from the package's entry point so this is unlikely to affect most people.

• The browser bundle at dist/browser.js is now ESM rather than CommonJS. This is the file bundlers pick up via the browser field, so it should be transparent. As an added bonus, it's also 1.1 KB smaller now.

  The minified global bundle at dist/global.min.js is unchanged, so loading parse-xml from a CDN with a <script> element and using the parseXml global works exactly as before.

Other Changes

• The published npm package is about 40% smaller (48 KB packed, down from 82 KB in 4.2.3) because it no longer includes unnecessary sourcemaps that are only useful during development.

4.2.3 (2026-07-26)

Fixed

• A document that starts with a valid processing instruction whose first characters are xml, such as <?xml-stylesheet ...?>, is no longer incorrectly rejected for having an invalid XML declaration. #47 (@​spokodev)

4.2.2 (2026-07-10)

Fixed

... (truncated)

Commits

• b15e011 Release 5.0.0
• 875aef7 Link to npmx.dev instead of npmjs.com
• 71267a9 Update benchmark results
• b76db17 Don't load conformance tests in the browser
• 013cb3c Stop publishing unnecessary sourcemaps
• 2370c48 Update TypeScript to 6.0.3
• 96ea55f Use pnpm 11.25.0
• 78c265b Bump the version and update the changelog and readme
• b9888d4 Convert the package to ESM
• 91fcb06 Replace nyc with c8 for coverage
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)