# What changed in sitemap

> 37 changes in sitemap 7 to 9 from its official release notes, upgrade guides and advisories: 8 breaking, 11 security, 14 new APIs and options. Each one cited. Sources checked 2026-10-18. HTML: https://unstale.sh/npm/sitemap/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## sitemap 9

### Breaking changes

- Rejects absolute paths to prevent arbitrary file writes. (7.1.3, 8.0.3, 9.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.1), [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.3), [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/7.1.3)
- Enforces a 50,000 URL hard limit in the parser. (9.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.1)
- Parser and stream inputs now receive security validation and resource limits; invalid data may be rejected, including disallowed URL protocols, overlong strings, and excessive sitemap resources. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- Direct imports of library files from ESM contexts require .js extensions; TypeScript adds these automatically. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- Node.js >=20.19.5 is now required; Node.js 14, 16, and 18 are no longer supported. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- npm >=10.8.2 is now required. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)

### Security

- Caps the parser error array at 100 entries to prevent memory DoS. (8.0.3, 9.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.1), [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.3)
- Escapes xslUrl in the stylesheet processing instruction to prevent XML injection. (7.1.3, 8.0.3, 9.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.1), [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.3), [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/7.1.3)
- A public security limits object is available, covering maximum URL length and sitemap, video, news, and image constraints. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- XML generation adds safe attribute and element generation and protection against XML injection attacks. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)

### New APIs and options

- A public constant provides the default items per sitemap file: 45,000. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- An allow/deny type guard is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A price type guard is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A resolution type guard is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A change frequency type guard is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A yes/no type guard is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- The SimpleSitemapAndIndexOptions interface is now exported. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A limit validation function is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A path validation function is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A public base path validation function is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- A URL validation function is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- An XSL URL validation function is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)
- An object containing regex validators for all sitemap fields is now part of the public API. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)

### Behavior and default changes

- Destroys source and parser streams immediately when the maxEntries limit is exceeded. (8.0.3, 9.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.1), [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.3)
- The package now declares module type, with dual ESM/CJS output and conditional exports; both ESM and CommonJS imports continue to work. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)

### Fixes and other changes

- The CLI remains ESM-only at this path. (9.0.0) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/9.0.0)

## sitemap 8

### Breaking changes

- The parser now stops emitting items and emits an error when the 50,000 URL hard limit is exceeded, rather than merely logging a warning. (8.0.3) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.3)

### Security

- Hardens xmllint against command injection. (8.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.1)
- Adds resource limits to prevent memory exhaustion. (8.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.1)
- Adds comprehensive validation for user inputs. (8.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.1)
- Blocks .. sequences to prevent path traversal. (8.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.1)
- Blocks javascript:, data:, and file: URLs. (8.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.1)
- Enhanced escaping prevents XML injection and XSS. (8.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.1)
- Validates XSL URLs to prevent XSS. (8.0.1) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.1)

### Fixes and other changes

- Custom namespace validation now accepts namespace-qualified attributes such as xsi:schemaLocation, in addition to xmlns:prefix="uri". (8.0.2) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/8.0.2)

## sitemap 7

### Breaking changes

- Stops emitting items when the 50,000 URL hard limit is reached, rather than only logging a warning. (7.1.3) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/7.1.3)

### New APIs and options

- Accepts a maxEntries limit, defaulting to 50,000, and destroys source and parser streams immediately when the limit is breached. (7.1.3) — [release notes](https://github.com/ekalinin/sitemap.js/releases/tag/7.1.3)