Skip to content

build(deps): bump lxml from 6.0.2 to 6.1.0#1848

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/lxml-6.1.0
Open

build(deps): bump lxml from 6.0.2 to 6.1.0#1848
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/lxml-6.1.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 21, 2026 •
edited
Loading

Bumps lxml from 6.0.2 to 6.1.0.

Changelog

Sourced from lxml's changelog.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

  • GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

  • The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

  • LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE) when using these parsers without setting this option explicitly. The default was now changed to 'internal' only (as for the normal XML and HTML parsers since lxml 5.0). Issue found by Sihao Qiu as CVE-2026-41066.

6.0.4 (2026-04-12)

Bugs fixed

  • LP#2148019: Spurious MemoryError during namespace cleanup.

6.0.3 (2026-04-09)

Bugs fixed

  • Several out of memory error cases now raise MemoryError that were not handled before.

  • Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

  • LP#2125399: Some failing tests were fixed or disabled in PyPy.

  • LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

... (truncated)

Commits
  • 43722f4 Update changelog.
  • 8747040 Name version of option change in docstring.
  • 6c36e6c Fix pypistats URL in download statistics script.
  • c7d76d6 Change security policy to point to Github security advisories.
  • 378ccf8 Update project income report.
  • 315270b Docs: Reduce TOC depth of package pages and move module contents first.
  • 6dbba7f Docs: Show current year in copyright line.
  • e4385bf Update project income report.
  • 5bed1e1 Validate file hashes in release download script.
  • c13ee10 Prepare release of 6.1.0.
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Apr 21, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 21, 2026 22:58
@copy-pr-bot
Copy link
Copy Markdown

copy-pr-bot Bot commented Apr 21, 2026

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@dependabot dependabot Bot force-pushed the dependabot/uv/lxml-6.1.0 branch 3 times, most recently from 548ba77 to f37361b Compare April 24, 2026 05:46
@ayushdg
Copy link
Copy Markdown
Contributor

ayushdg commented Apr 24, 2026

@dependabot rebase

@ayushdg ayushdg added the r1.2.0 Pick this label for auto cherry-picking into r1.2.0 label Apr 24, 2026
@dependabot dependabot Bot force-pushed the dependabot/uv/lxml-6.1.0 branch 5 times, most recently from 174016f to 7ccd62c Compare April 29, 2026 20:59
@ayushdg
Copy link
Copy Markdown
Contributor

ayushdg commented Apr 29, 2026

/ok to test 7ccd62c

@ayushdg
Copy link
Copy Markdown
Contributor

ayushdg commented Apr 30, 2026

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 30, 2026

Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request.

@ayushdg
Copy link
Copy Markdown
Contributor

ayushdg commented Apr 30, 2026

@dependabot recreate

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 30, 2026

Dependabot can't resolve your Python dependency files. Because of this, Dependabot cannot update this pull request.

@ayushdg
Copy link
Copy Markdown
Contributor

ayushdg commented May 1, 2026

@dependabot rebase

@dependabot dependabot Bot force-pushed the dependabot/uv/lxml-6.1.0 branch 2 times, most recently from 4fa96a6 to 3585b5c Compare May 4, 2026 18:50
@dependabot
build(deps): bump lxml from 6.0.2 to 6.1.0
d86c72e 
Bumps [lxml](https://github.com/lxml/lxml) from 6.0.2 to 6.1.0.
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-6.0.2...lxml-6.1.0)

---
updated-dependencies:
- dependency-name: lxml
  dependency-version: 6.1.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/uv/lxml-6.1.0 branch from 3585b5c to d86c72e Compare May 6, 2026 22:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ayushdg ayushdg ayushdg approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code r1.2.0 Pick this label for auto cherry-picking into r1.2.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ayushdg