django/django-project
django/django-project
Template
1
0
Fork 0
Code Issues Pull requests 10 Releases Wiki Activity Actions

Update dependency lxml to v6.1.3 #9

Open
bot.renovate wants to merge 1 commit from renovate/lxml-6.x into main
pull from: renovate/lxml-6.x
merge into: django:main
Conversation 0 Commits 1 Files changed 3 +3 -3
bot.renovate commented 2026-07-25 20:10:25 +02:00
Collaborator
Copy link

This PR contains the following updates:

Package Update Change
lxml (source, changelog) patch ==6.1.0 → ==6.1.3

Release Notes

lxml/lxml (lxml)

v6.1.3

Compare Source

==================

Bugs fixed

  • LP#2165901: External parameter entity parsing was allowed by default
    (with resolve_entities="internal").
    Issue found by Tomer Fichman.

v6.1.2

Compare Source

==================

  • GH#526: Some build files were missing in the sdist.
    Patch by Nicola Soranzo.

  • Some minor corrections for error handling cases.

Other changes

  • Built with Cython 3.2.9.

v6.1.1

Compare Source

==================

Bugs fixed

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [lxml](https://lxml.de/) ([source](https://github.com/lxml/lxml), [changelog](https://git.launchpad.net/lxml/plain/CHANGES.txt)) | patch | `==6.1.0` → `==6.1.3` | --- ### Release Notes <details> <summary>lxml/lxml (lxml)</summary> ### [`v6.1.3`](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt#613-2026-09-02) [Compare Source](https://github.com/lxml/lxml/compare/lxml-6.1.2...lxml-6.1.3) \================== ## Bugs fixed - [LP#2165901](https://github.com/LP/lxml/issues/2165901): External parameter entity parsing was allowed by default (with `resolve_entities="internal"`). Issue found by Tomer Fichman. ### [`v6.1.2`](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt#612-2026-08-18) [Compare Source](https://github.com/lxml/lxml/compare/lxml-6.1.1...lxml-6.1.2) \================== - [GH#526](https://github.com/GH/lxml/issues/526): Some build files were missing in the sdist. Patch by Nicola Soranzo. - Some minor corrections for error handling cases. ## Other changes - Built with Cython 3.2.9. ### [`v6.1.1`](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt#611-2026-05-18) [Compare Source](https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1) \================== ## Bugs fixed - The known link attributes in `lxml.html.defs.link_attrs` were missing `xlink:href`, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. <https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f> - The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731. - The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731. </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNjEuNCIsInVwZGF0ZWRJblZlciI6IjQzLjI2MS40IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119-->
bot.renovate changed title from Update dependency lxml to v6.1.1 to Update dependency lxml to v6.1.2 2026-08-19 12:10:29 +02:00
bot.renovate changed title from Update dependency lxml to v6.1.2 to Update dependency lxml to v6.1.3 2026-09-02 20:10:56 +02:00
This pull request is broken due to missing fork information.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin renovate/lxml-6.x:renovate/lxml-6.x
git switch renovate/lxml-6.x

Merge

Merge the changes and update on Forgejo.
git switch main
git merge --no-ff renovate/lxml-6.x
git switch renovate/lxml-6.x
git rebase main
git switch main
git merge --ff-only renovate/lxml-6.x
git switch renovate/lxml-6.x
git rebase main
git switch main
git merge --no-ff renovate/lxml-6.x
git switch main
git merge --squash renovate/lxml-6.x
git switch main
git merge --ff-only renovate/lxml-6.x
git switch main
git merge renovate/lxml-6.x
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
django/django-project!9
No description provided.