[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
lxml (source, changelog)	==6.0.2 → ==6.1.3

---

Release Notes

lxml/lxml (lxml)

v6.1.3

Compare Source

==================

Bugs fixed

• LP#2165901: External parameter entity parsing was allowed by default
  (with resolve_entities="internal").
  Issue found by Tomer Fichman.

v6.1.2

Compare Source

==================

• GH#526: Some build files were missing in the sdist.
  Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

v6.1.1

Compare Source

==================

Bugs fixed

• The known link attributes in lxml.html.defs.link_attrs were missing xlink:href,
  which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
  GHSA-4jhm-jv67-739f

• The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.

• The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

v6.1.0

Compare Source

==================

This release fixes a possible external entity injection (XXE) vulnerability in
iterparse() and the ETCompatXMLParser.

Features added

• GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes
  in lxml.html.defs. This allows lxml_html_clean to pass them through.
  Patch by oomsveta.

• The default chunk size for reading from file-likes in iterparse() is now configurable
  with a new chunk_size argument.

Bugs fixed

• LP#2146291: The resolve_entities option was still set to True for
  iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)
  when using these parsers without setting this option explicitly.
  The default was now changed to 'internal' only (as for the normal XML and HTML parsers
  since lxml 5.0).
  Issue found by Sihao Qiu as CVE-2026-41066.

v6.0.4

Compare Source

==================

Bugs fixed

• LP#2148019: Spurious MemoryError during namespace cleanup.

v6.0.3

Compare Source

==================

Bugs fixed

• Several out of memory error cases now raise MemoryError that were not handled before.

• Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

• LP#2125399: Some failing tests were fixed or disabled in PyPy.

• LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

• Memory leak in case of a memory allocation failure when copying document subtrees.

• When mapping an XPath result to Python failed, the result memory could leak.

• When preparing an XSLT transform failed, the XSLT parameter memory could leak.

Other changes

• Built using Cython 3.2.4.

• Binary wheels use zlib 1.3.2.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.