Skip to content

chore(deps): bump @xmldom/xmldom, expo, expo-constants, expo-linking, expo-router, expo-splash-screen and jest-expo in /mqtt-client-React-Native-Expo#253

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/mqtt-client-React-Native-Expo/multi-269e408b81
Open

chore(deps): bump @xmldom/xmldom, expo, expo-constants, expo-linking, expo-router, expo-splash-screen and jest-expo in /mqtt-client-React-Native-Expo#253
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/mqtt-client-React-Native-Expo/multi-269e408b81

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 22, 2026

Bumps @xmldom/xmldom to 0.8.13 and updates ancestor dependencies @xmldom/xmldom, expo, expo-constants, expo-linking, expo-router, expo-splash-screen and jest-expo. These dependencies need to be updated together.

Updates @xmldom/xmldom from 0.7.13 to 0.8.13

Release notes

Sourced from @​xmldom/xmldom's releases.

0.8.13

Commits

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.8.12

Commits

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Thank you, @​thesmartshadow, @​stevenobiajulu, for your contributions

xmldom/xmldom#357

0.8.11

0.8.11

Fixed

Thank you, @​shunkica, for your contributions

0.8.10

Commits

... (truncated)

Changelog

Sourced from @​xmldom/xmldom's changelog.

0.8.13

Fixed

  • Security: XMLSerializer.serializeToString() (and Node.toString(), NodeList.toString()) now accept a requireWellFormed option (fourth argument, after isHtml and nodeFilter). When { requireWellFormed: true } is passed, the serializer throws InvalidStateError for injection-prone node content, preventing XML injection via attacker-controlled node data. GHSA-j759-j44w-7fr8 GHSA-x6wf-f3px-wcqx GHSA-f6ww-3ggp-fr8h
    • Comment: throws when data contains -->
    • ProcessingInstruction: throws when data contains ?>
    • DocumentType: throws when publicId fails PubidLiteral, systemId fails SystemLiteral, or internalSubset contains ]>
  • Security: DOM traversal operations (XMLSerializer.serializeToString(), Node.prototype.normalize(), Node.prototype.cloneNode(true), Document.prototype.importNode(node, true), node.textContent getter, getElementsByTagName() / getElementsByTagNameNS() / getElementsByClassName() / getElementById()) are now iterative. Previously, deeply nested DOM trees would exhaust the JavaScript call stack and throw an unrecoverable RangeError. GHSA-2v35-w6hq-6mfw

Thank you, @​Jvr2022, @​praveen-kv, @​TharVid, @​decsecre583, @​tlsbollei, @​KarimTantawey, for your contributions

0.9.9

Added

Fixed

Code that passes a string containing "]]>" to createCDATASection and relied on the previously unsafe behavior will now receive InvalidCharacterError. Use a mutation method such as appendData if you intentionally need "]]>" in a CDATASection node's data.

Chore

  • updated dependencies

Thank you, @​stevenobiajulu, @​yoshi389111, @​thesmartshadow, for your contributions

0.8.12

Fixed

... (truncated)

Commits
  • e5c1480 0.8.13
  • 9611e20 style: drop unused import in test file
  • dc4dff3 docs: add 0.8.13 changelog entry
  • 842fa38 fix: prevent stack overflow in normalize (GHSA-2v35-w6hq-6mfw)
  • aeff69f test: add normalize behavioral coverage to node.test.js
  • cbdb0d7 fix: make walkDOM iterative to prevent stack overflow (GHSA-2v35-w6hq-6mfw)
  • 0b543d3 test: assert namespace declarations are isolated between siblings in serializ...
  • c007c51 refactor: migrate serializeToString to walkDOM
  • 2bb3899 test: add serializeToString coverage for uncovered branches
  • e69f38d refactor: migrate importNode to walkDOM
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by karfau, a new releaser for @​xmldom/xmldom since your current version.


Updates expo from 51.0.31 to 55.0.17

Changelog

Sourced from expo's changelog.

Changelog

Unpublished

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

  • Add Symbol.toStringTag to expo/fetch Response so it identifies as a standard Response object (#44806 by @​zoontek)
  • Prevent original* globals from being enumerable or from being created for globals with getters, since these may be side-effectful (#44407 by @​kitten)
  • Resolve paths relative to project root instead of server root in expo/scripts/resolveAppEntry.js (#44414 by @​kitten)

💡 Others

  • Decouple web entry files from react-native-web by adding web-specific forks for registerRootComponent, AppRegistry, AppEntryNotFound, and DevLoadingView. (#44298 by @​EvanBacon)
  • [iOS] Updated AppDelegate Swift header imports for xcframework compatibility. (#44248 by @​chrfalch)
  • [iOS] Remove RCTHostRuntimeDelegate usage now that it's merged into RCTHostDelegate. (#43838 by @​zoontek)

⚠️ Notices

55.0.2 — 2026-02-25

This version does not introduce any user-facing changes.

55.0.1 — 2026-02-25

This version does not introduce any user-facing changes.

55.0.0 — 2026-02-25

💡 Others

55.0.0-preview.12 — 2026-02-20

🐛 Bug fixes

  • Add missing Request-like input handling, method normalization, and URL argument support to fetch (#43194 by @​kitten)

55.0.0-preview.11 — 2026-02-16

... (truncated)

Commits
Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.


Updates expo-constants from 16.0.2 to 55.0.15

Changelog

Sourced from expo-constants's changelog.

Changelog

Unpublished

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

💡 Others

  • Switch app config generation from @expo/config to expo/config public API (#44721 by @​kitten)

55.0.7 — 2026-02-25

This version does not introduce any user-facing changes.

55.0.6 — 2026-02-20

This version does not introduce any user-facing changes.

55.0.5 — 2026-02-16

This version does not introduce any user-facing changes.

55.0.4 — 2026-02-08

This version does not introduce any user-facing changes.

55.0.3 — 2026-02-03

This version does not introduce any user-facing changes.

55.0.2 — 2026-01-26

This version does not introduce any user-facing changes.

55.0.1 — 2026-01-22

This version does not introduce any user-facing changes.

55.0.0 — 2026-01-21

🎉 New features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo-constants since your current version.


Updates expo-linking from 6.3.1 to 55.0.14

Changelog

Sourced from expo-linking's changelog.

Changelog

Unpublished

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

💡 Others

55.0.7 — 2026-02-25

This version does not introduce any user-facing changes.

55.0.6 — 2026-02-20

This version does not introduce any user-facing changes.

55.0.5 — 2026-02-20

This version does not introduce any user-facing changes.

55.0.4 — 2026-02-08

This version does not introduce any user-facing changes.

55.0.3 — 2026-01-26

This version does not introduce any user-facing changes.

55.0.2 — 2026-01-23

This version does not introduce any user-facing changes.

55.0.1 — 2026-01-22

This version does not introduce any user-facing changes.

55.0.0 — 2026-01-21

This version does not introduce any user-facing changes.

8.0.10 - 2025-12-05

This version does not introduce any user-facing changes.

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo-linking since your current version.


Updates expo-router from 3.5.23 to 55.0.13

Changelog

Sourced from expo-router's changelog.

Changelog

Unpublished

🛠 Breaking changes

  • Bumped minimum iOS/tvOS version to 16.4, macOS to 13.4. (#43296 by @​tsapeta)
  • Remove dependency on react-navigation and move the navigation code to expo-router (#44176 by @​Ubax)

🎉 New features

🐛 Bug fixes

💡 Others

  • Removed react-native-is-edge-to-edge dependency, AutoStatusBar component, and canOverrideStatusBarBehavior helper. (#44196 by @​zoontek)
  • Remove expo-router/doctor since this is covered by expo-doctor's duplicates check now (#43461 by @​kitten)
  • use KVC to provide native API compatible with both react-native-screens 4.24.0 and 4.23.0 (#43576 by @​Ubax)
  • Handle empty routes manifest gracefully (#43606 by @​kitten)
  • Upgrade react-navigation to the latest version (#43993 by @​Ubax)
  • Split StackToolbar components into multiple files (#43969 by @​Ubax)
  • add processHeaderItemsForPlatform (#44051 by @​Ubax)
  • refactor global-state logic (#44056 by @​Ubax)

55.0.2 — 2026-02-25

This version does not introduce any user-facing changes.

55.0.1 — 2026-02-25

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo-router since your current version.


Updates expo-splash-screen from 0.27.5 to 55.0.19

Changelog

Sourced from expo-splash-screen's changelog.

Changelog

Unpublished

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

  • [Android] Mitigate SurfaceControl.checkNotReleased crash on API 31-33 by cancelling splash exit animation on activity stop. (#44584 by @​zoontek)

💡 Others

  • Moved splash screen config plugins from @expo/prebuild-config into expo-splash-screen. (#44598 by @​zoontek)
  • [Android] Updated androidx.core:core-splashscreen from 1.2.0-alpha02 to 1.2.0. (#44584 by @​zoontek)
  • Make backgroundColor plugin prop optional, defaulting to #ffffff. (#44098 by @​zoontek)
  • [iOS] Use internal import React and reduce public API surface to internal access level. (#44248 by @​chrfalch)
  • Removed the expo_splash_screen_status_bar_translucent Android leftover attribute. (#43514 by @​zoontek)

55.0.9 — 2026-02-25

This version does not introduce any user-facing changes.

55.0.8 — 2026-02-20

This version does not introduce any user-facing changes.

55.0.7 — 2026-02-20

This version does not introduce any user-facing changes.

55.0.6 — 2026-02-16

This version does not introduce any user-facing changes.

55.0.5 — 2026-02-08

This version does not introduce any user-facing changes.

55.0.4 — 2026-02-03

This version does not introduce any user-facing changes.

55.0.3 — 2026-01-27

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for expo-splash-screen since your current version.


Updates jest-expo from 51.0.4 to 55.0.16

Changelog

Sourced from jest-expo's changelog.

Changelog

This is the log of notable changes to the Expo client that are developer-facing. Package-specific changes not released in any SDK will be added here just before the release. Until then, you can find them in changelogs of the individual packages (see packages directory).

Unpublished

📚 3rd party library updates

🛠 Breaking changes

🎉 New features

🐛 Bug fixes

55.0.0 — 2026-02-25

🛠 Breaking changes

  • expo-notifications
    • expose BackgroundNotificationTaskResult (#41291 by @​vonovak)
    • [ios], [internal] rename EXNotifications pod to ExpoNotifications (#42009 by @​vonovak)
    • [android] throw instead of logging a warning when attempting to use push notifications with Expo Go (#39459 by @​vonovak)
  • expo-modules-core
  • expo-localization
    • [Android] Default allowDynamicLocaleChangesAndroid to true when supportedLocales is configured (#41813 by @​Ubax)
  • expo-image-loader
  • expo-clipboard
    • Removed deprecated content property of the clipboard event listener. Use getStringAsync() instead. (#41739 by @​barthap)
  • expo-cellular
    • remove deprecated JS constants, return null as a replacement for deprecated native iOS methods (#43035 by @​vonovak)
  • expo-brightness
  • expo-blur
    • [Android] The dimezisBlurView experimental blur method will no longer work without creating a related BlurTargetView. (#39990 by @​behenate)

🎉 New features

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by alanhughes, a new releaser for jest-expo since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

… expo-router, expo-splash-screen and jest-expo

Bumps [@xmldom/xmldom](https://github.com/xmldom/xmldom) to 0.8.13 and updates ancestor dependencies [@xmldom/xmldom](https://github.com/xmldom/xmldom), [expo](https://github.com/expo/expo/tree/HEAD/packages/expo), [expo-constants](https://github.com/expo/expo/tree/HEAD/packages/expo-constants), [expo-linking](https://github.com/expo/expo/tree/HEAD/packages/expo-linking), [expo-router](https://github.com/expo/expo/tree/HEAD/packages/expo-router), [expo-splash-screen](https://github.com/expo/expo/tree/HEAD/packages/expo-splash-screen) and [jest-expo](https://github.com/expo/expo/tree/HEAD/packages/jest-expo). These dependencies need to be updated together.


Updates `@xmldom/xmldom` from 0.7.13 to 0.8.13
- [Release notes](https://github.com/xmldom/xmldom/releases)
- [Changelog](https://github.com/xmldom/xmldom/blob/master/CHANGELOG.md)
- [Commits](xmldom/xmldom@0.7.13...0.8.13)

Updates `expo` from 51.0.31 to 55.0.17
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo)

Updates `expo-constants` from 16.0.2 to 55.0.15
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo-constants/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo-constants)

Updates `expo-linking` from 6.3.1 to 55.0.14
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo-linking/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo-linking)

Updates `expo-router` from 3.5.23 to 55.0.13
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo-router/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo-router)

Updates `expo-splash-screen` from 0.27.5 to 55.0.19
- [Changelog](https://github.com/expo/expo/blob/main/packages/expo-splash-screen/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/expo-splash-screen)

Updates `jest-expo` from 51.0.4 to 55.0.16
- [Changelog](https://github.com/expo/expo/blob/main/CHANGELOG.md)
- [Commits](https://github.com/expo/expo/commits/HEAD/packages/jest-expo)

---
updated-dependencies:
- dependency-name: "@xmldom/xmldom"
  dependency-version: 0.8.13
  dependency-type: indirect
- dependency-name: expo
  dependency-version: 55.0.17
  dependency-type: direct:production
- dependency-name: expo-constants
  dependency-version: 55.0.15
  dependency-type: direct:production
- dependency-name: expo-linking
  dependency-version: 55.0.14
  dependency-type: direct:production
- dependency-name: expo-router
  dependency-version: 55.0.13
  dependency-type: direct:production
- dependency-name: expo-splash-screen
  dependency-version: 55.0.19
  dependency-type: direct:production
- dependency-name: jest-expo
  dependency-version: 55.0.16
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants