{"id":12745,"library":"node-xmllint","title":"XML Validation with xmllint (libxml2)","description":"node-xmllint is an Emscripten port of libxml2's `xmllint` utility, enabling XML and XSD schema validation directly within Node.js environments and web browsers. It provides a synchronous `validateXML` function that returns an object containing an `errors` array (or null if no errors). As of version 1.0.0, the package has not seen updates in approximately 8 years, indicating it is an abandoned project. Its key differentiator was bringing the battle-tested libxml2 C validation engine to JavaScript runtimes, supporting complex XML Schema Definitions directly, unlike simpler regex-based or DOM-parser-based validation methods available at the time. It was designed to integrate with older frontend bundling tools like Browserify via `browserify-shim` for browser usage. Newer, actively maintained alternatives exist that leverage WebAssembly for better performance and modern API design.","status":"abandoned","version":"1.0.0","language":"javascript","source_language":"en","source_url":"https://github.com/tib-tib/xml.js","tags":["javascript"],"install":[{"cmd":"npm install node-xmllint","lang":"bash","label":"npm"},{"cmd":"yarn add node-xmllint","lang":"bash","label":"yarn"},{"cmd":"pnpm add node-xmllint","lang":"bash","label":"pnpm"}],"dependencies":[],"imports":[{"note":"This package primarily targets CommonJS environments. While some bundlers might handle `require` for ESM projects, native ESM `import` syntax might not work directly without transpilation or specific bundler configuration.","wrong":"import xmllint from 'node-xmllint';","symbol":"xmllint","correct":"const xmllint = require('node-xmllint');"},{"note":"The `xmllint` object is the main export, with `validateXML` as its method. Direct named ESM import is not supported. Access it as `xmllint.validateXML` after requiring the module.","wrong":"import { validateXML } from 'node-xmllint';","symbol":"validateXML","correct":"const { validateXML } = require('node-xmllint'); // Direct destructuring, assuming it's an object property\n// Or, more accurately based on docs: \nconst xmllint = require('node-xmllint');\nxmllint.validateXML(...);"}],"quickstart":{"code":"const xmllint = require('node-xmllint');\n\nconst xmlValid = `<root><item id=\"1\"/></root>`;\nconst xmlInvalid = `<root><item></wrong></item></root>`;\nconst schemaValid = `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\\n<xs:schema xmlns:xs=\"http://www.w3.org/2001/XMLSchema\">\\n  <xs:element name=\"root\">\\n    <xs:complexType>\\n      <xs:sequence>\\n        <xs:element name=\"item\" minOccurs=\"0\" maxOccurs=\"unbounded\">\\n          <xs:complexType>\\n            <xs:attribute name=\"id\" type=\"xs:integer\" use=\"optional\"/>\\n          </xs:complexType>\\n        </xs:element>\\n      </xs:sequence>\\n    </xs:complexType>\\n  </xs:element>\\n</xs:schema>`;\n\n// Validate valid XML without schema\nlet result = xmllint.validateXML({ xml: xmlValid });\nif (result.errors) {\n  console.error('Valid XML (no schema) validation errors:', result.errors);\n} else {\n  console.log('Valid XML (no schema) is well-formed.');\n}\n\n// Validate invalid XML without schema\nresult = xmllint.validateXML({ xml: xmlInvalid });\nif (result.errors) {\n  console.error('Invalid XML (no schema) validation errors:', result.errors);\n} else {\n  console.log('Invalid XML (no schema) is well-formed.');\n}\n\n// Validate valid XML against a schema\nresult = xmllint.validateXML({ xml: xmlValid, schema: schemaValid });\nif (result.errors) {\n  console.error('Valid XML (with schema) validation errors:', result.errors);\n} else {\n  console.log('Valid XML (with schema) is valid.');\n}\n\n// Validate invalid XML against a schema (e.g., missing 'id' attribute if required)\nconst xmlSchemaInvalid = `<root><item/></root>`;\nresult = xmllint.validateXML({ xml: xmlSchemaInvalid, schema: schemaValid });\nif (result.errors) {\n  console.error('Invalid XML (with schema) validation errors:', result.errors);\n} else {\n  console.log('Invalid XML (with schema) is valid.');\n}","lang":"javascript","description":"This quickstart demonstrates how to use `node-xmllint` to validate XML strings, both for well-formedness and against an XML Schema Definition (XSD). It shows cases for valid and invalid XML with and without schema validation."},"warnings":[{"fix":"Migrate to `xmllint-wasm` or a similar actively maintained library, which often uses WebAssembly and offers async validation. Example: `npm install xmllint-wasm` and adjust import/usage to its API.","message":"The package `node-xmllint` is deprecated and has not been updated in approximately 8 years, making it effectively abandoned. It may contain unpatched security vulnerabilities or not be compatible with modern Node.js or browser environments. Consider using actively maintained forks like `xmllint-wasm` which provide WASM builds, updated libxml2 versions, and modern async APIs.","severity":"breaking","affected_versions":">=1.0.0"},{"fix":"For large XML payloads, process validation in a Node.js worker thread or switch to an asynchronous library (e.g., `xmllint-wasm`) if available. In browsers, consider a Web Worker.","message":"The `validateXML` function is synchronous. For very large XML documents, this can block the Node.js event loop or freeze the browser UI, leading to poor user experience or server unresponsiveness. The underlying Emscripten port was not designed with asynchronous execution in mind for this API.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"If targeting browsers, consider if client-side validation is strictly necessary. If so, investigate more lightweight XML parsers or newer WASM-based solutions like `xmllint-wasm` that often have optimized sizes. Server-side validation is generally preferred for performance and security.","message":"The Emscripten-compiled `libxml2` library can result in a significant bundle size for browser applications (over 4MB for `xmllint.js`). This can negatively impact page load times, especially on slower networks.","severity":"gotcha","affected_versions":">=1.0.0"},{"fix":"For ESM projects, use `import xmllint from 'node-xmllint';` with a compatible bundler/transpiler, or prefer an ESM-first alternative. Otherwise, ensure your project is configured for CommonJS or that your bundler correctly handles CJS modules.","message":"The package primarily exports a CommonJS module. Using it in modern Node.js ESM projects or with bundlers expecting ESM might require additional configuration (`\"type\": \"module\"` in package.json combined with `require()` is an anti-pattern and often problematic, or bundler-specific settings like `browserify-shim` mentioned in the README).","severity":"gotcha","affected_versions":">=1.0.0"}],"env_vars":null,"last_verified":"2026-04-19T00:00:00.000Z","next_check":"2026-07-18T00:00:00.000Z","problems":[{"fix":"Ensure you are using `const xmllint = require('node-xmllint');` and then calling `xmllint.validateXML(...)`. Verify the module is installed correctly (`npm install node-xmllint`).","cause":"The `xmllint` object was either not correctly imported/required, or the `validateXML` method is being called on an undefined variable.","error":"TypeError: xmllint.validateXML is not a function"},{"fix":"For browser use, ensure you are bundling with a tool like Browserify (with `browserify-shim` as suggested in the README). For Node.js ESM, consider an ESM-compatible alternative or refactor to use CommonJS modules if feasible.","cause":"Attempting to use `require` in a browser environment or in a Node.js ESM module without proper bundling or transpilation.","error":"ReferenceError: require is not defined"},{"fix":"Check your browser's Content-Security-Policy (CSP) headers; you might need to add `script-src 'unsafe-eval'` or `wasm-eval` directives. Ensure the WASM file is served with the correct MIME type (`application/wasm`). Consider using a library that employs asynchronous WASM loading (e.g., `xmllint-wasm`).","cause":"This error typically occurs in browser environments due to Content-Security-Policy restrictions preventing WASM execution, or due to synchronous loading of large WASM binaries that exceed browser limits, or if the WASM file itself is corrupted or not served correctly.","error":"Error: WebAssembly.instantiateStreaming(): Wasm code is not valid or exceeds the maximum size for synchronous compilation"}],"ecosystem":"npm"}