Bump fast-xml-parser from 4.5.3 to 4.5.7

[dependabot]

Bumps fast-xml-parser from 4.5.3 to 4.5.7.

Release notes

Sourced from fast-xml-parser's releases.

Summary update on all the previous releases from v4.2.4

• Multiple minor fixes provided in the validator and parser
• v6 is added for experimental use.
• ignoreAttributes support function, and array of string or regex
• Add support for parsing HTML numeric entities
• v5 of the application is ESM module now. However, JS is also supported

Note: Release section in not updated frequently. Please check CHANGELOG or Tags for latest release information.

Commits

• 49a12f1 4.5.7
• 59d0145 update changelog
• e561c21 fix: escape comment and CDATA delimiters when building XML (GHSA-gh4j-gqv2-49...
• 42fbb0b update release info
• 805671c increase expansion limit as many system need it
• 9a2cf09 update version
• 88d0936 apply all fixes from v5
• d4eb6b4 update release version
• See full diff in compare view

---

Note

Low Risk
Lockfile-only transitive dependency bump with security fixes; no application source changes and limited exposure via dev/build-time RN CLI usage.

Overview
Updates the lockfile so fast-xml-parser resolves to 4.5.7 (from 4.5.3). The package is not a direct dependency; it is pulled in by @react-native-community/cli-config-android and cli-platform-apple for XML parsing in RN CLI tooling.

The 4.5.7 line includes parser/validator fixes ported from v5, including escaping comment and CDATA delimiters when building XML (security-related). The lockfile also drops a nested chain-registry entry under @chain-registry/utils and adjusts the strnum range for fast-xml-parser.

^{Reviewed by Cursor Bugbot for commit b6237f6. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm fast-xml-parser is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/@react-native-community/cli@18.0.0 → npm/@react-native-community/cli-platform-android@18.0.0 → npm/@react-native-community/cli-platform-ios@18.0.0 → npm/react-native-bootsplash@6.3.8 → npm/fast-xml-parser@4.5.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/fast-xml-parser@4.5.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report