Skip to content

chore(deps): bump entities from 8.1.0 to 9.0.0 - #209

Merged
unbraind merged 2 commits into
mainfrom
dependabot/npm_and_yarn/entities-9.0.0
Nov 6, 2026
Merged

unbraind merged 2 commits into
mainfrom
dependabot/npm_and_yarn/entities-9.0.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026 •

Copy link
Copy Markdown
Contributor

Bumps entities from 8.1.0 to 9.0.0.

Release notes

Sourced from entities's releases.

v9.0.0

Full speed unlocked: This release features a faster approach to decoding entities based on cuckoo hashing, replacing the previous trie-based approach. Instead of walking a trie character by character, we now do a few lookups in a hash table.

I first looked into cuckoo hashing around 2015, and again when I adopted the trie approach that @​inikulin had pioneered for parse5, but could never make it work. This was a fun problem to throw AI models at for some time, but now Fable solved it quite well.

This feels like the last big speed boost for entities decoding in JS.

Breaking changes

  • Streaming decoders no longer take a decode table: new EntityDecoder(htmlDecodeTree, emit, errors) becomes new HtmlEntityDecoder(emit, errors), and XmlEntityDecoder replaces the XML variant. The htmlDecodeTree, xmlDecodeTree and determineBranch exports are removed. Synchronous decoding APIs are unchanged. #2336
  • Encoding emits decimal numeric references and the shortest named aliases: encodeXML("ü") yields &[#252](https://github.com/fb55/entities/issues/252); instead of ü, and encodeHTML("ℵ") yields ℵ instead of ℵ. #2355
  • escapeAttribute and EncodingMode.Attribute also escape < and >, matching the latest HTML spec. By @​ybai08 in #2398
  • The deprecated getCodePoint export of entities/escape is removed; use String.prototype.codePointAt instead. #2355

Improvements

  • HTML decoding: common named references 1.15–1.23×, a dense sweep of all 2,125 names 1.24–1.33×, attribute-heavy HTML 1.06–1.18× as fast. XML decoding with mixed named and numeric references is 1.06–1.09× as fast. #2336
  • Smaller decoders: the HTML bundle shrinks from 15.54 to 13.42 kB gzipped, the XML-only bundle from 0.92 to 0.84 kB gzipped, and 29–32 kB less memory is retained after import. #2336
  • The readme now compares entities with popular alternatives across a range of inputs. #2407

Compared with v8.1.0; ranges span Node 26.8 and Node 24.19 on a Ryzen 7 5800X3D. Results vary with input.

Full Changelog: fb55/entities@v8.1.0...v9.0.0

Commits
  • a007e72 9.0.0
  • 3e8e364 build(benchmark): compare popular libraries across inputs, update readme (#2407)
  • d1158bf feat(decode)!: hash-table decoder replacing the binary trie (#2336)
  • 914e397 fix(escape): escape \< and > in attribute values (#2398)
  • 12d4f06 build: bump the codeql group with 2 updates (#2405)
  • 0a6de5c build: bump markdown-it from 14.3.2 to 14.3.3 (#2402)
  • 9659d80 build: bump the codeql group with 2 updates (#2401)
  • 858a16b build: bump vitest from 5.0.4 to 5.0.5 (#2400)
  • 52cbad3 build: bump eslint from 10.12.0 to 10.13.0 (#2399)
  • ff0bad1 build: bump typescript-eslint from 8.71.1 to 8.71.2 (#2396)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Nov 2, 2026
@coderabbitai

coderabbitai Bot commented Nov 2, 2026 •

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: da153a93-37c5-4ca7-8a2d-7fbc4680b06f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

@greptile-apps

greptile-apps Bot commented Nov 2, 2026

Copy link
Copy Markdown

PR author is in the excluded authors list.

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/entities-9.0.0 branch 5 times, most recently from a5fdcbf to e235c0c Compare November 4, 2026 16:48
Bumps [entities](https://github.com/fb55/entities) from 8.1.0 to 9.0.0.
- [Release notes](https://github.com/fb55/entities/releases)
- [Commits](fb55/entities@v8.1.0...v9.0.0)

---
updated-dependencies:
- dependency-name: entities
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/entities-9.0.0 branch from e235c0c to a4e0682 Compare November 5, 2026 07:29
@unbraind
unbraind enabled auto-merge (squash) November 6, 2026 04:36
@github-actions
github-actions Bot disabled auto-merge November 6, 2026 04:39
@unbraind
unbraind enabled auto-merge (squash) November 6, 2026 04:39
@unbraind
unbraind merged commit 03c3059 into main Nov 6, 2026
12 checks passed
@unbraind
unbraind deleted the dependabot/npm_and_yarn/entities-9.0.0 branch November 6, 2026 05:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant