Security: Further harden XML injection prevention during unparse (follow-up to
v0.15.0). In addition to '<'/'>' rejection, now also reject element and
attribute names (including @xmlns prefixes) that:
Security: Prevent XML injection (CVE-2025-9375) by rejecting '<'/'>' in
element and attribute names (including @xmlns prefixes) during unparse.
This limits validation to avoiding tag-context escapes; attribute values
continue to be escaped by the SAX XMLGenerator.
Advisory: https://fluidattacks.com/advisories/mono
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [xmltodict](https://github.com/martinblech/xmltodict) | minor | `==0.12.0` → `==0.15.1` |
---
> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/3) for more information.
---
### Release Notes
<details>
<summary>martinblech/xmltodict (xmltodict)</summary>
### [`v0.15.1`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0151)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.15.0...v0.15.1)
- Security: Further harden XML injection prevention during unparse (follow-up to
v0.15.0). In addition to '<'/'>' rejection, now also reject element and
attribute names (including `@xmlns` prefixes) that:
- start with '?' or '!'
- contain '/' or any whitespace
- contain quotes (' or ") or '='
- are non-strings (names must be `str`; no coercion)
### [`v0.15.0`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0150)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.14.2...v0.15.0)
- Security: Prevent XML injection (CVE-2025-9375) by rejecting '<'/'>' in
element and attribute names (including `@xmlns` prefixes) during unparse.
This limits validation to avoiding tag-context escapes; attribute values
continue to be escaped by the SAX `XMLGenerator`.
Advisory: <https://fluidattacks.com/advisories/mono>
### [`v0.14.2`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0142)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.14.1...v0.14.2)
- Revert "Ensure significant whitespace is not trimmed"
- This changed was backwards incompatible and caused downstream issues.
### [`v0.14.1`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0141)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.14.0...v0.14.1)
- Drop support for Python older than 3.6
- Additional ruff/Pyflakes/codespell fixes.
- Thanks [@​DimitriPapadopoulos](https://github.com/DimitriPapadopoulos)!
### [`v0.14.0`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0140)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.13.0...v0.14.0)
- Drop old Python 2 support leftover code and apply several RUFF code health fixes.
- Thanks, [@​DimitriPapadopoulos](https://github.com/DimitriPapadopoulos)!
- Add Python 3.11, 3.12 and 3.13 support and tests.
- Thanks, [@​angvp](https://github.com/angvp)!
- Tests in gh-action.
- Thanks, [@​almaz](https://github.com/almaz).kun!
- Remove defusedexpat import.
- Thanks, [@​hanno](https://github.com/hanno)!
- Replace deprecated BadZipfile with BadZipFile.
- Thanks, [@​hugovk](https://github.com/hugovk)!
- Support indent using integer format, enable `python -m unittest tests/*.py`.
- Thanks, [@​hiiwave](https://github.com/hiiwave)!
- Ensure significant whitespace is not trimmed
- Thanks, [@​trey](https://github.com/trey).franklin!
- added conda installation command
- Thanks, [@​sugatoray](https://github.com/sugatoray)!
- fix attributes not appearing in streaming mode
- Thanks, [@​timnguyen001](https://github.com/timnguyen001)!
- Fix Travis CI status badge URL
- Update push\_release.sh to use twine.
### [`v0.13.0`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0130)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.12.0...v0.13.0)
- Add install info to readme for openSUSE. ([#​205](https://github.com/martinblech/xmltodict/issues/205))
- Thanks, [@​smarlowucf](https://github.com/smarlowucf)!
- Support defaultdict for namespace mapping ([#​211](https://github.com/martinblech/xmltodict/issues/211))
- Thanks, [@​nathanalderson](https://github.com/nathanalderson)!
- parse(generator) is now possible ([#​212](https://github.com/martinblech/xmltodict/issues/212))
- Thanks, [@​xandey](https://github.com/xandey)!
- Processing comments on parsing from xml to dict (connected to [#​109](https://github.com/martinblech/xmltodict/issues/109)) ([#​221](https://github.com/martinblech/xmltodict/issues/221))
- Thanks, [@​svetazol](https://github.com/svetazol)!
- Add expand\_iter kw to unparse to expand iterables ([#​213](https://github.com/martinblech/xmltodict/issues/213))
- Thanks, [@​claweyenuk](https://github.com/claweyenuk)!
- Fixed some typos
- Thanks, [@​timgates42](https://github.com/timgates42) and [@​kianmeng](https://github.com/kianmeng)!
- Add support for python3.8
- Thanks, [@​t0b3](https://github.com/t0b3)!
- Drop Jython/Python 2 and add Python 3.9/3.10.
- Drop OrderedDict in Python >= 3.7
- Do not use len() to determine if a sequence is empty
- Thanks, [@​DimitriPapadopoulos](https://github.com/DimitriPapadopoulos)!
- Add more namespace attribute tests
- Thanks, [@​leogregianin](https://github.com/leogregianin)!
- Fix encoding issue in setup.py
- Thanks, [@​rjarry](https://github.com/rjarry)!
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMTIiLCJ1cGRhdGVkSW5WZXIiOiI0My4xOTUuMTIiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
==0.12.0→==0.15.1Release Notes
martinblech/xmltodict (xmltodict)
v0.15.1Compare Source
v0.15.0). In addition to '<'/'>' rejection, now also reject element and
attribute names (including
@xmlnsprefixes) that:str; no coercion)v0.15.0Compare Source
element and attribute names (including
@xmlnsprefixes) during unparse.This limits validation to avoiding tag-context escapes; attribute values
continue to be escaped by the SAX
XMLGenerator.Advisory: https://fluidattacks.com/advisories/mono
v0.14.2Compare Source
v0.14.1Compare Source
v0.14.0Compare Source
python -m unittest tests/*.py.v0.13.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.
Pull request closed