Generated sitemap is not escaped and is invalid if a URL has the character `&`

Why this is a good first issue

The issue involves escaping special characters in sitemap URLs to ensure valid XML output.

AI Summary

The problem is that special characters in sitemap URLs are not escaped, leading to invalid XML. The solution requires proper XML escaping of these characters. A PR is already in progress to address this.

Issue Description

Link to the code that reproduces this issue

https://github.com/joulev/debug/tree/nextjs-sitemap-escape-ampersand

To Reproduce

// app/sitemap.ts
import type { MetadataRoute } from 'next';

export default async function sitemap(): Promise<MetadataRoute.Sitemap> {
    return [
        {
            url: 'https://example.com?a=b&c=d',
            changeFrequency: 'never',
        },      
    ]
}

Current vs. Expected behavior

Current: The & is not escaped, causing the sitemap file to be invalid.

Expected: The URL should be properly escaped. Right now a workaround is required with .replaceAll('&', '&'). But, if this issue is fixed, it will break this workaround, so not even sure if that fix should belong to a new major or not.

Provide environment information

Operating System:
  Platform: linux
  Arch: x64
  Version: #25~22.04.1-Ubuntu SMP Thu Jan 16 21:37:09 UTC 2025
  Available memory (MB): 7939
  Available CPU cores: 2
Binaries:
  Node: 18.20.7
  npm: 10.8.2
  Yarn: 1.22.22
  pnpm: 10.6.4
Relevant Packages:
  next: 15.3.0-canary.15 // Latest available version is detected (15.3.0-canary.15).
  eslint-config-next: N/A
  react: 19.0.0
  react-dom: 19.0.0
  typescript: 5.8.2
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Metadata

Which stage(s) are affected? (Select all that apply)

next dev (local), next build (local), next start (local), Vercel (Deployed), Other (Deployed)

Additional context

No response

GitHub Labels

Metadatalinear: next