Tags: lxml/lxml
Tags
7.0.0b1 (2026-08-22) ==================== Bugs fixed ---------- * LP#2143321: A ``NameError`` in ``doctestcompare`` when the doctests are processed by a non-standard module. Original patch by Rahul Kumar. * GH#492: Failures in ``htmldiff()`` to string-join the diff result are now propagated instead of silently returning an empty result. Patch by Juan Carlos Carvajal B. Other changes ------------- * Built using Cython 3.3.0.
7.0.0b1 (2026-08-22) ==================== Bugs fixed ---------- * LP#2143321: A ``NameError`` in ``doctestcompare`` when the doctests are processed by a non-standard module. Original patch by Rahul Kumar. * GH#492: Failures in ``htmldiff()`` to string-join the diff result are now propagated instead of silently returning an empty result. Patch by Juan Carlos Carvajal B. Other changes ------------- * Built using Cython 3.3.0.
6.1.2 (2026-08-18) ================== Bugs fixed ---------- * GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo. * Some minor corrections for error handling cases. Other changes ------------- * Built with Cython 3.2.9.
6.1.2 (2026-08-18) ================== Bugs fixed ---------- * GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo. * Some minor corrections for error handling cases. Other changes ------------- * Built with Cython 3.2.9.
7.0.0a3 (2026-06-16) ==================== Features added -------------- * ``.find()`` and ``.findall()`` now take advantage of their read-locked tree to skip tree modification checks, making them visibly faster. * Python Element proxy instantiation was tuned another bit to shave off more of the performance disadvantages added by tree locking. * The path compilation cache used by ElementPath uses an LRU eviction scheme. It previously just cleared the whole cache when overflowing. Bugs fixed ---------- * Attribute iteration now remembers a safe integer index instead of a tree attribute pointer that is potentially subject of user side modifications. This may make attribute iteration slightly slower for long sequences of attributes but allows for attribute manipulation between iteration steps, giving similar iteration+manipulation semantics as Python lists. * Several issues (race conditions, memory leaks on error handling, crashes) were found via an automated review and subsequently resolved. Review contributed by devdanzin.
7.0.0a2 (2026-06-09) ==================== Features added -------------- * GH#511: The ElementPath implementation (``.find()`` etc) was rewritten based on native traversal of the libxml2 tree instead of passing through Element proxy objects. This makes some path operations like child steps or predicate evaluation several times faster. Indexing can be more than 100x faster. Note that some operations are also slower due to the new lock usages in lxml 7.0. Usually, the more selective the path, the faster it runs. Original idea and implementation by mahomaho.
7.0.0a1 (2026-05-29) ==================== Features added -------------- * GH#477,LP#2111289: Experimental support for freethreading Python is enabled in Python 3.14t and later. * GH#466: The shared parser name dict is now local to a parser (as opposed to global), which allows to control its lifetime and cross-document usage more easily. It is now also unbounded in size if the ``huge_tree=True`` option is provided. * The default chunk size for reading from file-likes in ``iterparse()`` was increased from 32 KiB to 64 KiB and is now configurable with a new ``chunk_size`` argument. * Writing to Python file objects minimises data copying by passing buffers around. * GH#502: Predicate evaluation in ``ElementPath`` (``.find*()``) is faster. * HTML diffing is faster, following optimisations in CPython 3.15. * If multiple Python exceptions get raised from within an lxml operation, they no longer overwrite old ones but get stacked in the exception context of the latest exception. Bugs fixed ---------- * Reading from file-like objects that start with a UTF-32 BOM failed to detect the BOM. Other changes ------------- * Support for Python 3.8 was removed. Python 3.9 will continue to be supported for several years due to its usage in LTS Linux distributions. * Usage on PyPy can currently crash due to the Freethreading Python changes. This is expected to get fixed in the further releases towards 7.0 final. * Some internal adaptations were made for libxml2 2.14.x and 2.15.x. * The ``xmlDict...`` C functions of libxml2 are now declared in ``tree.pxd``. They remain in ``xmlparser.pxd`` for legacy reasons but Cython code that uses them should migrate the import to ``tree.pxd``. * The list of software licenses in LICENSES.txt was clarified and updated to match the actual set of software being shipped. * Built using Cython 3.2.5.
6.1.1 (2026-05-18) ================== Bugs fixed ---------- * The known link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. GHSA-4jhm-jv67-739f * The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731. * The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.
6.1.0 (2026-04-17) ================== This release fixes a possible external entity injection (XXE) vulnerability in ``iterparse()`` and the ``ETCompatXMLParser``. Features added -------------- * GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in ``lxml.html.defs``. This allows ``lxml_html_clean`` to pass them through. Patch by oomsveta. * The default chunk size for reading from file-likes in ``iterparse()`` is now configurable with a new ``chunk_size`` argument. Bugs fixed ---------- * LP#2146291: The ``resolve_entities`` option was still set to ``True`` for ``iterparse`` and ``ETCompatXMLParser``, allowing for external entity injection (XXE) when using these parsers without setting this option explicitly. The default was now changed to ``'internal'`` only (as for the normal XML and HTML parsers since lxml 5.0). Issue found by Sihao Qiu as CVE-2026-41066.
6.0.4 (2026-04-12) ================== Bugs fixed ---------- * LP#2148019: Spurious MemoryError during namespace cleanup.
PreviousNext