v2.14.0

Highlights

@xmldom/xmldom upgraded from 0.8 to 0.9 (#636, #638). xmldom 0.8's typings start with /// <reference lib="dom" />, which forced the browser DOM types into every TypeScript project that imports samlify, even Node-only ones. 0.9 removes that line, so samlify no longer adds DOM globals such as document and window, or DOM's fetch/BodyInit types, to your program.

⚠️ Behaviour changes

• Malformed or non-XML input is now a parse error. xmldom 0.8 used to turn it into a partial document. For example:
  • encryptAssertion on a non-XML string now rejects with XML fatal error: missing root element instead of ERR_NO_ASSERTION.
  • Metadata with two root EntityDescriptor elements is now rejected.
• Parse error messages are wrapped by xmldom's ParseError. They still contain XML parsing error: / XML fatal error:. If you match error messages exactly, switch to a substring or regex match.
• setDOMParserOptions accepts xmldom 0.9 options. Use onError(level, message) instead of the deprecated errorHandler.
  • The old errorHandler: { warning, error, fatalError } object form still works: samlify converts it for you, although xmldom 0.9 itself rejects it.
  • Levels you leave out still fail closed.
  • TypeScript users who imported xmldom's Options type should use DOMParserOptions.

Dependencies

• @xmldom/xmldom ^0.8.11 → ^0.9.12.
• Nested @xmldom/xmldom used by @authenio/xml-encryption / xml-crypto → 0.8.15. This clears the open xmldom advisories in yarn audit for production dependencies.
• Dev: vitest 3.2.7, postcss 8.5.25, js-yaml 3.15.1. These include the pending Dependabot PRs #631, #633 and #635. The unused @types/xmldom was removed.

Tests

• New consumer type check in yarn test:types: compiles against the published declarations with lib: ["es2020"] and skipLibCheck: false, and fails if lib.dom comes back.

What's Changed

• fix: upgrade @xmldom/xmldom to 0.9 to keep lib.dom out of consumers (closes #636) by @tngan in #638
• docs: replace react-samlify reference with samlify-starter by @tngan

Full Changelog: v2.13.1...v2.14.0