Drop libxmljs, fix XML injection bugs, modernize for Node 20+

[ebensing]

Why

libxmljs@0.15.x — the only dependency — has four open advisories, one critical, and npm reports No fix available for every published version:

Advisory	Issue
GHSA-773h-w45w-f2f9	Denial of service
GHSA-mg49-jqgw-gcj6	Type confusion parsing crafted XML
GHSA-6433-x5p4-8jc7	Type confusion parsing crafted XML
GHSA-jv72-59wq-8rxm	Segfault → denial of service

The package was last published in Oct 2023 and needs a node-gyp/libxml2 native build against a NAN release pinned to the Node 4 era. Bumping the version — which is what every previous update to this repo did — cannot fix this.

So this PR builds the feed XML directly. node-rss now has zero dependencies, npm audit reports found 0 vulnerabilities, and there is no native module to compile.

Injection bugs fixed in our own code

Taking over serialization surfaced three real bugs that were previously masked by libxmljs:

• CDATA breakout. title and description are CDATA-wrapped, and a ]]> in either terminated the section early, injecting arbitrary XML into the feed. The sequence is now split across two sections.
• Unvalidated element names. Keys from options/fields became tag names verbatim, so a key like x><script injected markup. An element name cannot be escaped, so names are validated as XML names and rejected otherwise.
• Prototype pollution. for (var opt in options) feed[opt] = ... copied __proto__/constructor, and let options silently clobber addNewItem/items/defaults. Both are rejected now, and inherited properties are skipped.

Characters XML 1.0 cannot represent (control characters, unpaired surrogates) are stripped rather than producing a malformed document.

Verification

Beyond the unit tests, I generated a feed containing 11 adversarial payloads — ]]><script>, </item></channel></rss><evil/>, comment and processing-instruction breakouts, lone surrogates, nested CDATA — and parsed the result with a real XML parser:

• document is well-formed
• zero unexpected elements (nothing injected)
• every payload round-tripped as text, not markup
• no illegal control characters in the output

Compatibility

Output is unchanged in shape from the libxmljs version — same element order, namespaces, and 2-space indentation — with one deliberate exception:

Date values now serialize as RFC-1123 (Wed, 09 Sep 2026 15:04:56 GMT) instead of JavaScript's default date string (Wed Sep 09 2026 10:04:56 GMT-0500 (Central Daylight Time)), which is not a valid RSS date and never was. This matches what lastBuildDate already did. It's the reason for the major version bump.

Requires Node 20+. The public API (createNewFeed, getFeedXML, addNewItem, defaults.cdata) is otherwise unchanged, and examples/simple.js runs untouched.

Also in here

• exports map so ESM named imports work (import { getFeedXML } from 'node-rss'), with deep ./lib/* imports preserved
• Committed package-lock.json — npm audit previously failed outright with ENOLOCK
• files allowlist trims the published tarball to 4 files
• Strict mode, const/let, removed a stray UTF-8 BOM, fixed an "efficently" typo
• Tests: 19 cases on the built-in node:test runner covering every injection case above. No devDependencies, so npm ci installs nothing. Closes the long-standing "add tests" TODO.
• CI: test matrix across Node 20/22/24, plus an npm audit job to catch regressions
• Relicensed under MIT with the license text actually included; previous releases declared a bare "BSD", which is not a valid SPDX identifier, and shipped no LICENSE file

Review note

This repo has merged PRs from outside contributors (@dhendo, @jmathews, @upraised, @cnak145). Their contributions were all libxmljs version bumps in package.json, which no longer exist now that the dependency is gone — so there is likely nothing of theirs left in the tree to relicense. Worth a glance before merging if you want to be thorough about the license change.

🤖 Generated with Claude Code