[guocn]

Purpose / Goal

Fixes #892. XML numeric character references are part of XML independently of HTML named entities. Enable numeric decoding in the default entity decoder without enabling names such as ©. processEntities: false and custom decoders remain respected.

Tests cover decimal/hex references in text and attributes, supplementary Unicode, HTML named-entity opt-in, single-pass decoding (A stays A), disabled processing, and XML 1.1 control references. Two old expectations that retained numeric-reference spellings are updated to decoded content.

Type

• Bug Fix
• Refactoring / Technology upgrade
• New Feature

Read docs/CONTRIBUTING.md. Changelog/version/browser-bundle updates are left to maintainers as requested there.

Local Linux / Node 24.21.0 results:

• Source regression fails before the fix; complete Jasmine suite passes after: 334 specs, 0 failures, 2 pre-existing pending specs. Baseline: 332 specs, 0 failures, 2 pending.
• TypeScript public-API tests and all five webpack build targets passed. Generated bundles are not included.
• Changed test file passes ESLint. Repository source lint is already blocked by ecmaVersion: 6 on existing object spread; with a modern parser, the same two unused-variable errors occur on baseline and patch. No clean full-lint claim.
• Required node benchmark/XmlParser.mjs before/after (ops/s): fxp 48,938 → 42,732; preserve-order 56,851 → 60,942. These single runs are noisy (other libraries also moved). Six interleaved, fresh-process 20,000-parse samples on the same fixture had median 386ms baseline / 394ms patch (~2% slower), with overlapping ranges 368–402ms / 357–407ms. This is not a performance guarantee or a CI/platform-matrix result.

Prepared with AI assistance.