Skip to content

Conversation

pyup-bot
Copy link
Collaborator

This PR updates xmltodict from 0.8.7 to 1.0.0.

Changelog

0.15.1

* Security: Further harden XML injection prevention during unparse (follow-up to
v0.15.0). In addition to '<'/'>' rejection, now also reject element and
attribute names (including `xmlns` prefixes) that:
- start with '?' or '!'
- contain '/' or any whitespace
- contain quotes (' or ") or '='
- are non-strings (names must be `str`; no coercion)

0.15.0

* Security: Prevent XML injection (CVE-2025-9375) by rejecting '<'/'>' in
element and attribute names (including `xmlns` prefixes) during unparse.
This limits validation to avoiding tag-context escapes; attribute values
continue to be escaped by the SAX `XMLGenerator`.
Advisory: https://fluidattacks.com/advisories/mono

0.14.2

* Revert "Ensure significant whitespace is not trimmed"
* This changed was backwards incompatible and caused downstream issues.

0.14.1

* Drop support for Python older than 3.6
* Additional ruff/Pyflakes/codespell fixes.
* Thanks DimitriPapadopoulos!

0.14.0

* Drop old Python 2 support leftover code and apply several RUFF code health fixes.
* Thanks, DimitriPapadopoulos!
* Add Python 3.11, 3.12 and 3.13 support and tests.
* Thanks, angvp!
* Tests in gh-action.
* Thanks, almaz.kun!
* Remove defusedexpat import.
* Thanks, hanno!
* Replace deprecated BadZipfile with BadZipFile.
* Thanks, hugovk!
* Support indent using integer format, enable `python -m unittest tests/*.py`.
* Thanks, hiiwave!
* Ensure significant whitespace is not trimmed
* Thanks, trey.franklin!
* added conda installation command
* Thanks, sugatoray!
* fix attributes not appearing in streaming mode
* Thanks, timnguyen001!
* Fix Travis CI status badge URL
* Update push_release.sh to use twine.

0.13.0

* Add install info to readme for openSUSE. (205)
* Thanks, smarlowucf!
* Support defaultdict for namespace mapping (211)
* Thanks, nathanalderson!
* parse(generator) is now possible (212)
* Thanks, xandey!
* Processing comments on parsing from xml to dict (connected to 109) (221)
* Thanks, svetazol!
* Add expand_iter kw to unparse to expand iterables (213)
* Thanks, claweyenuk!
* Fixed some typos
* Thanks, timgates42 and kianmeng!
* Add support for python3.8
* Thanks, t0b3!
* Drop Jython/Python 2 and add Python 3.9/3.10.
* Drop OrderedDict in Python >= 3.7
* Do not use len() to determine if a sequence is empty
* Thanks, DimitriPapadopoulos!
* Add more namespace attribute tests
* Thanks, leogregianin!
* Fix encoding issue in setup.py
* Thanks, rjarry!

0.12.0

* Allow force_commits=True for getting all keys as lists (204)
* README.md: fix useless uses of cat (200)
* Add FreeBSD install instructions (199)
* Fix and simplify travis config (192)
* Add support for Python 3.7 (189)
* Drop support for EOL Python (191)
* Use Markdown long_description on PyPI (190)
* correct spelling mistake (165)
* correctly unparse booleans (180)
* Updates README.md with svg badge

0.11.0

* Determine fileness by checking for `read` attr
* Thanks, jwodder!
* Add support for Python 3.6.
* Thanks, cclauss!
* Release as a universal wheel.
* Thanks, adamchainz!
* Updated docs examples to use print function.
* Thanks, cdeil!
* unparse: pass short_empty_elements to XMLGenerator
* Thanks, zhanglei002!
* Added namespace support when unparsing.
* Thanks, imiric!

0.10.2

* Fixed defusedexpat expat import.
* Thanks, fiebiga!

0.10.1

* Use defusedexpat if available.
* Allow non-string attributes in unparse.
* Add postprocessor support for attributes.
* Make command line interface Python 3-compatible.

0.10.0

* Add force_list feature.
* Thanks, guewen and jonlooney!
* Add support for Python 3.4 and 3.5.
* Performance optimization: use list instead of string for CDATA.
* Thanks, bharel!
* Include Arch Linux package instructions in README.
* Thanks, felixonmars!
* Improved documentation.
* Thanks, ubershmekel!
* Allow any iterable in unparse, not just lists.
* Thanks, bzamecnik!
* Bugfix: Process namespaces in attributes too.
* Better testing under Python 2.6.
* Thanks, TyMaszWeb!

0.9.2

* Fix multiroot check for list values (edge case reported by JKillian)

0.9.1

* Only check single root when full_document=True (Thanks JKillian!)

0.9.0

* Added CHANGELOG.md
* Avoid ternary operator in call to ParserCreate().
* Adding Python 3.4 to Tox test environment.
* Added full_document flag to unparse (default=True).
Links

@pyup-bot
Copy link
Collaborator Author

Closing this in favor of #1345

@pyup-bot pyup-bot closed this Sep 17, 2025
@cclauss cclauss deleted the pyup-update-xmltodict-0.8.7-to-1.0.0 branch September 17, 2025 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant