npm / plist
plist
What changed in plist 5, from its official release notes, upgrade guides and advisories. Also covers @types/plist. Sources checked 2026-11-06.
1 breaking1 security3 new APIs and options1 performance1 behavior and defaults1 tooling7 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initplist 515 changes
Breaking changes 1
build() now skips null values, matching undefined behavior and the Apple plist DTD; parsing <null/> remains supported for backwards compatibility.
Security 1
Prevents uncontrolled resource consumption by parsing multiply referenced objects only once, rejecting circular references, and validating trailer, offset table, and object references against input bounds.
New APIs and options 3
Adds an API for writing binary plists.
Adds an API for reading binary plists.
Adds support for parsing OpenStep/ASCII plists.
Performance 1
Bundlers supporting the browser export condition use browser-native parsing and XML-building implementations, reducing bundle size by eliminating @xmldom/xmldom and xmlbuilder.
Behavior and default changes 1
parse() now auto-detects XML, binary, and OpenStep plist formats.
Tooling 1
The project is rewritten in TypeScript and now provides full type declarations.
Fixes and other changes 7
Browser build() emits empty strings as <string/> to match Node build() output.
Browser build() escapes carriage returns so strings and keys containing CR survive a round-trip.
Fixes double indentation in browser build() output.
XML build() preserves sub-second precision when serializing Date values instead of silently dropping non-zero milliseconds.
XML build() emits integer-valued numbers with absolute values at least 1e21 as <real>, preventing corruption on a build-to-parse round-trip.
Adds a default condition to the exports map for VSCode compatibility.
Fixes exponential parse blowup on deeply nested plist files caused by eagerly evaluating dict-parser error message arguments.