npm / sitemap
sitemap
What changed in sitemap 7 to 9, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-18.
8 breaking11 security14 new APIs and options2 behavior and defaults2 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initsitemap 926 changes
Breaking changes 6
Rejects absolute paths to prevent arbitrary file writes.
Enforces a 50,000 URL hard limit in the parser.
Parser and stream inputs now receive security validation and resource limits; invalid data may be rejected, including disallowed URL protocols, overlong strings, and excessive sitemap resources.
Direct imports of library files from ESM contexts require .js extensions; TypeScript adds these automatically.
Node.js >=20.19.5 is now required; Node.js 14, 16, and 18 are no longer supported.
npm >=10.8.2 is now required.
Security 4
Caps the parser error array at 100 entries to prevent memory DoS.
Escapes xslUrl in the stylesheet processing instruction to prevent XML injection.
A public security limits object is available, covering maximum URL length and sitemap, video, news, and image constraints.
XML generation adds safe attribute and element generation and protection against XML injection attacks.
New APIs and options 13
A public constant provides the default items per sitemap file: 45,000.
An allow/deny type guard is now part of the public API.
A price type guard is now part of the public API.
A resolution type guard is now part of the public API.
A change frequency type guard is now part of the public API.
A yes/no type guard is now part of the public API.
The SimpleSitemapAndIndexOptions interface is now exported.
A limit validation function is now part of the public API.
A path validation function is now part of the public API.
A public base path validation function is now part of the public API.
A URL validation function is now part of the public API.
An XSL URL validation function is now part of the public API.
An object containing regex validators for all sitemap fields is now part of the public API.
Behavior and default changes 2
Destroys source and parser streams immediately when the maxEntries limit is exceeded.
The package now declares module type, with dual ESM/CJS output and conditional exports; both ESM and CommonJS imports continue to work.
Fixes and other changes 1
The CLI remains ESM-only at this path.
sitemap 89 changes
Breaking changes 1
The parser now stops emitting items and emits an error when the 50,000 URL hard limit is exceeded, rather than merely logging a warning.
Security 7
Hardens xmllint against command injection.
Adds resource limits to prevent memory exhaustion.
Adds comprehensive validation for user inputs.
Blocks .. sequences to prevent path traversal.
Blocks javascript:, data:, and file: URLs.
Enhanced escaping prevents XML injection and XSS.
Validates XSL URLs to prevent XSS.
Fixes and other changes 1
Custom namespace validation now accepts namespace-qualified attributes such as xsi:schemaLocation, in addition to xmlns:prefix="uri".
sitemap 72 changes
Breaking changes 1
Stops emitting items when the 50,000 URL hard limit is reached, rather than only logging a warning.
New APIs and options 1
Accepts a maxEntries limit, defaulting to 50,000, and destroys source and parser streams immediately when the limit is breached.