Regression: Component conversion failed: Entity expansion limit exceeded (2.128.5)

[adam-randuska-tag]

Summary

After upgrading from @salesforce/cli version 2.126.4 to 2.128.5, deployments fail during the component conversion phase with the error: Entity expansion limit exceeded: 1015 > 1000.
I have confirmed this is a regression by downgrading back to 2.126.4, where the deployment succeeds with the exact same metadata.

Steps To Reproduce

1. Use @salesforce/cli version 2.128.5.
2. Run a deployment command: sf project deploy start.
3. The process fails during the "Converting" or "Component conversion" step.

Expected result

The CLI should convert source to metadata format without hitting internal XML entity expansion limits, as it did in version 2.126.4.

Actual result

Deployment fails with the following error:
"Component conversion failed: Entity expansion limit exceeded: 1015 > 1000"

Additional information

• This issue appears to be a regression in the underlying XML parsing logic introduced between these specific versions.
• The failure occurs during the local conversion phase before reaching the Salesforce Org.
• Our project contains metadata (likely large Custom Labels, Profiles, or Permission Sets) that triggers this limit in the newer version but was handled correctly in 2.126.4.

System Information

• SF CLI Version: 2.128.5
• OS: Ubuntu / macOS

{
  "name": "ConversionError",
  "message": "Component conversion failed: Entity expansion limit exceeded: 1015 > 1000",
  "exitCode": 1,
  "context": "DeployMetadata",
  "stack": "ConversionError: Component conversion failed: Entity expansion limit exceeded: 1015 > 1000\n    at SfCommandError.from (file:///usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/sf-plugins-core/lib/SfCommandError.js:48:16)\n    at DeployMetadata.catch (file:///usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/sf-plugins-core/lib/sfCommand.js:332:47)\n    at DeployMetadata.catch (file:///usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/plugin-deploy-retrieve/lib/commands/project/deploy/start.js:293:27)\n    at DeployMetadata._run (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@oclif/core/lib/command.js:186:29)\n    at async Config.runCommand (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@oclif/core/lib/config/config.js:446:25)\n    at async run (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@oclif/core/lib/main.js:97:16)\n    at async file:///usr/local/lib/node_modules/@salesforce/cli/bin/run.js:15:1",
  "cause": "Error: Entity expansion limit exceeded: 1015 > 1000\n    at B.K [as replaceEntitiesValue] (/usr/local/lib/node_modules/@salesforce/cli/node_modules/fast-xml-parser/lib/fxp.cjs:1:27694)\n    at B.Y [as parseTextData] (/usr/local/lib/node_modules/@salesforce/cli/node_modules/fast-xml-parser/lib/fxp.cjs:1:20545)\n    at B.Q [as saveTextToParentTag] (/usr/local/lib/node_modules/@salesforce/cli/node_modules/fast-xml-parser/lib/fxp.cjs:1:28366)\n    at B.Z [as parseXml] (/usr/local/lib/node_modules/@salesforce/cli/node_modules/fast-xml-parser/lib/fxp.cjs:1:22694)\n    at ft.parse (/usr/local/lib/node_modules/@salesforce/cli/node_modules/fast-xml-parser/lib/fxp.cjs:1:33651)\n    at SourceComponent.parse (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/source-deploy-retrieve/lib/src/resolve/sourceComponent.js:249:42)\n    at SourceComponent.parseAndValidateXML (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/source-deploy-retrieve/lib/src/resolve/sourceComponent.js:263:25)\n    at SourceComponent.parseXmlSync (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/source-deploy-retrieve/lib/src/resolve/sourceComponent.js:186:25)\n    at SourceComponent.getNonDecomposedChildren (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/source-deploy-retrieve/lib/src/resolve/sourceComponent.js:305:29)\n    at SourceComponent.getChildren (/usr/local/lib/node_modules/@salesforce/cli/node_modules/@salesforce/source-deploy-retrieve/lib/src/resolve/sourceComponent.js:148:93)",
  "warnings": [],
  "code": "ConversionError",
  "status": 1,
  "commandName": "DeployMetadata"
}

{
  "architecture": "darwin-arm64",
  "cliVersion": "@salesforce/cli/2.128.5",
  "nodeVersion": "node-v22.22.1",
  "osVersion": "Darwin 25.4.0",
  "rootPath": "/Users/adam.randuska/.local/share/sf/client/2.128.5-a46a541",
  "shell": "zsh",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 3.2.41 (core)",
    "@oclif/plugin-commands 4.1.40 (core)",
    "@oclif/plugin-help 6.2.38 (core)",
    "@oclif/plugin-not-found 3.2.75 (core)",
    "@oclif/plugin-plugins 5.4.58 (core)",
    "@oclif/plugin-search 1.2.39 (core)",
    "@oclif/plugin-update 4.7.23 (core)",
    "@oclif/plugin-version 2.2.38 (core)",
    "@oclif/plugin-warn-if-update-available 3.1.55 (core)",
    "@oclif/plugin-which 3.2.44 (core)",
    "@salesforce/cli 2.128.5 (core)",
    "agent 1.32.4 (core)",
    "apex 3.9.13 (core)",
    "api 1.3.11 (core)",
    "auth 4.3.1 (core)",
    "code-analyzer 5.11.0 (user) published 3 days ago (Mon Mar 23 2026)",
    "data 4.0.80 (core)",
    "deploy-retrieve 3.24.16 (core)",
    "flow 1.0.5 (user) published 113 days ago (Tue Dec 02 2025)",
    "info 3.4.111 (core)",
    "lightning-dev 6.2.16 (user) published 13 days ago (Thu Mar 12 2026)",
    "limits 3.3.80 (core)",
    "marketplace 1.3.10 (core)",
    "org 5.9.72 (core)",
    "packaging 2.25.10 (core)",
    "schema 3.3.98 (core)",
    "settings 2.4.60 (core)",
    "sobject 1.4.86 (core)",
    "telemetry 3.8.3 (core)",
    "templates 56.10.7 (core)",
    "trust 3.7.114 (core)",
    "user 3.7.1 (core)",
    "apex-code-coverage-transformer 2.18.0 (user) published 13 days ago (Thu Mar 12 2026)",
    "sfdx-plugin-source-read 1.5.6 (user) published 193 days ago (Sun Sep 14 2025)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[github-actions]

Hello @adam-randuska-tag 👋 It looks like you didn't include the full Salesforce CLI version information in your issue.
Please provide the output of version --verbose --json for the CLI you're using (sf or sfdx).

A few more things to check:

• Make sure you've provided detailed steps to reproduce your issue.
  • A repository that clearly demonstrates the bug is ideal.
• Make sure you've installed the latest version of Salesforce CLI. (docs)
  • Better yet, try the rc or nightly versions. (docs)
• Try running the doctor command to diagnose common issues.
• Search GitHub for existing related issues.

Thank you!

[RyanHipkiss]

Having the same issue going from 2.127.2 to 2.128.5

[adam-randuska-tag]

In the GitHub Release history version 2.128.5 is nightly (maybe wrongly tagged as latest)
When I try with latest-rc (2.129.8) seems working fine

[savelieffd]

Looks like this is an issue with fast-xml-parser. It was recently updated for security reasons but it doesn't seem to acknowledge the maxTotalExpansions attributre when set.

Can see in source-deploy-retreive where it references that expansion limit and sets the value

  processEntities: {
    enabled: true,
    maxTotalExpansions: 50_000,
  }

[EstebanRomero84]

Hi @adam-randuska-tag thanks for reporting this! I'm looking into it now and will update you as soon as I have more information.

[EstebanRomero84]

In latest version (2.128.5), fast-xml-parser version was bumped to 5.3.6, which introduced a default limit on max entity expansion (notes).
We detected the issue and increased the limit here. The RC version already includes this fix.

[EstebanRomero84]

Related work item: W-21670876

[iowillhoit]

Hey all, this was unfortunately a "breaking" change in a patch version of fast-xml-parser that dependabot brought in. As some of you have already discovered, we did add a much higher default (50,000) in several places in our codebase. These changes are in the latest-rc (or stable-rc) version of the CLI (2.129.8). Could folks please try that version and confirm it is working as expected?

I would really like to not patch latest if we don't have to. The rc version will be promoted to latest on the 1st.