Security: Further harden XML injection prevention during unparse (follow-up to
v0.15.0). In addition to '<'/'>' rejection, now also reject element and
attribute names (including @xmlns prefixes) that:
Security: Prevent XML injection (CVE-2025-9375) by rejecting '<'/'>' in
element and attribute names (including @xmlns prefixes) during unparse.
This limits validation to avoiding tag-context escapes; attribute values
continue to be escaped by the SAX XMLGenerator.
Advisory: https://fluidattacks.com/advisories/mono
This PR contains the following updates:
| Package | Update | Change |
|---|---|---|
| [xmltodict](https://github.com/martinblech/xmltodict) | major | `==0.12.0` → `==1.0.4` |
---
> ⚠️ **Warning**
>
> Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/3) for more information.
---
### Release Notes
<details>
<summary>martinblech/xmltodict (xmltodict)</summary>
### [`v1.0.4`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#104-2026-02-22)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v1.0.3...v1.0.4)
##### Bug Fixes
- **unparse:** add bytes\_errors policy and handle bytes scalars consistently ([ed70434](https://github.com/martinblech/xmltodict/commit/ed704344226ed6451f6735811c695fb5004df44d))
### [`v1.0.3`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#103-2026-02-15)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v1.0.2...v1.0.3)
##### Bug Fixes
- **unparse:** serialize None text/attrs as empty values (fixes [#​401](https://github.com/martinblech/xmltodict/issues/401)) ([aa16511](https://github.com/martinblech/xmltodict/commit/aa165113bef2b3a1a822209863343b9dc9ffe43a))
##### Documentation
- **readme:** fix Fedora and Arch package links ([fd6a73b](https://github.com/martinblech/xmltodict/commit/fd6a73bf606c3932bcc82bf559a70867a1dd75cd))
### [`v1.0.2`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#102-2025-09-17)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v1.0.1...v1.0.2)
##### Bug Fixes
- allow DOCTYPE with disable\_entities=True (default) ([25b61a4](https://github.com/martinblech/xmltodict/commit/25b61a41f580cfc211df07c5fbbf603bd8eb5a5f))
### [`v1.0.1`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#101-2025-09-17)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v1.0.0...v1.0.1)
##### Bug Fixes
- fail closed when entities disabled ([c986d2d](https://github.com/martinblech/xmltodict/commit/c986d2d37a93d45fcc059b09063d9d9c45a655ec))
- validate XML comments ([3d4d2d3](https://github.com/martinblech/xmltodict/commit/3d4d2d3a4cd0f68d1211dba549010261fa87b969))
##### Documentation
- add SECURITY.md ([6413023](https://github.com/martinblech/xmltodict/commit/64130233c8fea272a5f82f2f585e1593523ec1b1))
- clarify behavior for empty lists ([2025b5c](https://github.com/martinblech/xmltodict/commit/2025b5cb5e64fc9c4d54b8644187a0a193bdd0ed))
- clarify process\_comments docs ([6b464fc](https://github.com/martinblech/xmltodict/commit/6b464fce284a93dbb292f3d063c9f310a478a014))
- clarify strip whitespace comment behavior ([b3e2203](https://github.com/martinblech/xmltodict/commit/b3e22032d21cc387d6cecf3930116e8fdc3151cf))
- create AGENTS.md for coding agents ([0da66ee](https://github.com/martinblech/xmltodict/commit/0da66ee797ced7479312aecef92c6a25e235007c))
- replace travis with actions badge ([2576b94](https://github.com/martinblech/xmltodict/commit/2576b94c918fbd154489a95dbbb3feda8bd3cbd8))
- update CONTRIBUTING.md ([db39180](https://github.com/martinblech/xmltodict/commit/db3918057cf125af989a1263d52df8df5ef8c642))
### [`v1.0.0`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#100-2025-09-12)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.15.1...v1.0.0)
##### ⚠ BREAKING CHANGES
- modernize for Python 3.9+; drop legacy compat paths
##### Features
- **unparse:** add limited XML comment round-trip; unify `_emit` behavior ([e43537e](https://github.com/martinblech/xmltodict/commit/e43537eee61c20ef50f0e4242eb9223de7a6aefd))
- **unparse:** add selective `force_cdata` support (bool/tuple/callable) ([a497fed](https://github.com/martinblech/xmltodict/commit/a497fedb7d6103d68af155543ac3337a73778b19)), closes [#​375](https://github.com/martinblech/xmltodict/issues/375)
##### Bug Fixes
- **namespaces:** attach `[@xmlns](https://github.com/xmlns)` to declaring element when process\_namespaces=True ([f0322e5](https://github.com/martinblech/xmltodict/commit/f0322e578184421693434902547f330f4f0a44c3)), closes [#​163](https://github.com/martinblech/xmltodict/issues/163)
- **streaming:** avoid parent accumulation at item\_depth; add regression tests ([220240c](https://github.com/martinblech/xmltodict/commit/220240c5eb2d12b75adf26cc84ec9c803ce8bb2b))
- **unparse:** handle non-string `#text` with attributes; unify value conversion ([927a025](https://github.com/martinblech/xmltodict/commit/927a025ae8a62cbb542d5caff38b29161a2096fa)), closes [#​366](https://github.com/martinblech/xmltodict/issues/366)
- **unparse:** skip empty lists to keep pretty/compact outputs consistent ([ab4c86f](https://github.com/martinblech/xmltodict/commit/ab4c86fed24dc8ef0e932a524edfb01c6453ecf6))
##### Reverts
- remove initial Release Drafter config ([c0b74ed](https://github.com/martinblech/xmltodict/commit/c0b74ed58f933bffd160c60a58620f672710ff7c))
##### Documentation
- **readme:** add API reference for parse()/unparse() kwargs ([e5039ad](https://github.com/martinblech/xmltodict/commit/e5039ad3f5159cc45ac1d52c4aa901ca50d4c722))
- **readme:** mention types-xmltodict stub package ([58ec03e](https://github.com/martinblech/xmltodict/commit/58ec03e6d94f17ed359742d9ce2f99e796669694))
##### Code Refactoring
- modernize for Python 3.9+; drop legacy compat paths ([7364427](https://github.com/martinblech/xmltodict/commit/7364427c86c62f55ad4c2dce96df6761da69c354))
### [`v0.15.1`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0151)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.15.0...v0.15.1)
- Security: Further harden XML injection prevention during unparse (follow-up to
v0.15.0). In addition to '<'/'>' rejection, now also reject element and
attribute names (including `@xmlns` prefixes) that:
- start with '?' or '!'
- contain '/' or any whitespace
- contain quotes (' or ") or '='
- are non-strings (names must be `str`; no coercion)
### [`v0.15.0`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0150)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.14.2...v0.15.0)
- Security: Prevent XML injection (CVE-2025-9375) by rejecting '<'/'>' in
element and attribute names (including `@xmlns` prefixes) during unparse.
This limits validation to avoiding tag-context escapes; attribute values
continue to be escaped by the SAX `XMLGenerator`.
Advisory: <https://fluidattacks.com/advisories/mono>
### [`v0.14.2`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0142)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.14.1...v0.14.2)
- Revert "Ensure significant whitespace is not trimmed"
- This changed was backwards incompatible and caused downstream issues.
### [`v0.14.1`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0141)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.14.0...v0.14.1)
- Drop support for Python older than 3.6
- Additional ruff/Pyflakes/codespell fixes.
- Thanks [@​DimitriPapadopoulos](https://github.com/DimitriPapadopoulos)!
### [`v0.14.0`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0140)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.13.0...v0.14.0)
- Drop old Python 2 support leftover code and apply several RUFF code health fixes.
- Thanks, [@​DimitriPapadopoulos](https://github.com/DimitriPapadopoulos)!
- Add Python 3.11, 3.12 and 3.13 support and tests.
- Thanks, [@​angvp](https://github.com/angvp)!
- Tests in gh-action.
- Thanks, [@​almaz](https://github.com/almaz).kun!
- Remove defusedexpat import.
- Thanks, [@​hanno](https://github.com/hanno)!
- Replace deprecated BadZipfile with BadZipFile.
- Thanks, [@​hugovk](https://github.com/hugovk)!
- Support indent using integer format, enable `python -m unittest tests/*.py`.
- Thanks, [@​hiiwave](https://github.com/hiiwave)!
- Ensure significant whitespace is not trimmed
- Thanks, [@​trey](https://github.com/trey).franklin!
- added conda installation command
- Thanks, [@​sugatoray](https://github.com/sugatoray)!
- fix attributes not appearing in streaming mode
- Thanks, [@​timnguyen001](https://github.com/timnguyen001)!
- Fix Travis CI status badge URL
- Update push\_release.sh to use twine.
### [`v0.13.0`](https://github.com/martinblech/xmltodict/blob/HEAD/CHANGELOG.md#v0130)
[Compare Source](https://github.com/martinblech/xmltodict/compare/v0.12.0...v0.13.0)
- Add install info to readme for openSUSE. ([#​205](https://github.com/martinblech/xmltodict/issues/205))
- Thanks, [@​smarlowucf](https://github.com/smarlowucf)!
- Support defaultdict for namespace mapping ([#​211](https://github.com/martinblech/xmltodict/issues/211))
- Thanks, [@​nathanalderson](https://github.com/nathanalderson)!
- parse(generator) is now possible ([#​212](https://github.com/martinblech/xmltodict/issues/212))
- Thanks, [@​xandey](https://github.com/xandey)!
- Processing comments on parsing from xml to dict (connected to [#​109](https://github.com/martinblech/xmltodict/issues/109)) ([#​221](https://github.com/martinblech/xmltodict/issues/221))
- Thanks, [@​svetazol](https://github.com/svetazol)!
- Add expand\_iter kw to unparse to expand iterables ([#​213](https://github.com/martinblech/xmltodict/issues/213))
- Thanks, [@​claweyenuk](https://github.com/claweyenuk)!
- Fixed some typos
- Thanks, [@​timgates42](https://github.com/timgates42) and [@​kianmeng](https://github.com/kianmeng)!
- Add support for python3.8
- Thanks, [@​t0b3](https://github.com/t0b3)!
- Drop Jython/Python 2 and add Python 3.9/3.10.
- Drop OrderedDict in Python >= 3.7
- Do not use len() to determine if a sequence is empty
- Thanks, [@​DimitriPapadopoulos](https://github.com/DimitriPapadopoulos)!
- Add more namespace attribute tests
- Thanks, [@​leogregianin](https://github.com/leogregianin)!
- Fix encoding issue in setup.py
- Thanks, [@​rjarry](https://github.com/rjarry)!
</details>
---
### Configuration
📅 **Schedule**: (UTC)
- Branch creation
- At any time (no schedule defined)
- Automerge
- At any time (no schedule defined)
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xOTUuMTIiLCJ1cGRhdGVkSW5WZXIiOiI0My4xOTUuMTIiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
This PR contains the following updates:
==0.12.0→==1.0.4Release Notes
martinblech/xmltodict (xmltodict)
v1.0.4Compare Source
Bug Fixes
v1.0.3Compare Source
Bug Fixes
Documentation
v1.0.2Compare Source
Bug Fixes
v1.0.1Compare Source
Bug Fixes
Documentation
v1.0.0Compare Source
⚠ BREAKING CHANGES
Features
_emitbehavior (e43537e)force_cdatasupport (bool/tuple/callable) (a497fed), closes #375Bug Fixes
[@xmlns](https://github.com/xmlns)to declaring element when process_namespaces=True (f0322e5), closes #163#textwith attributes; unify value conversion (927a025), closes #366Reverts
Documentation
Code Refactoring
v0.15.1Compare Source
v0.15.0). In addition to '<'/'>' rejection, now also reject element and
attribute names (including
@xmlnsprefixes) that:str; no coercion)v0.15.0Compare Source
element and attribute names (including
@xmlnsprefixes) during unparse.This limits validation to avoiding tag-context escapes; attribute values
continue to be escaped by the SAX
XMLGenerator.Advisory: https://fluidattacks.com/advisories/mono
v0.14.2Compare Source
v0.14.1Compare Source
v0.14.0Compare Source
python -m unittest tests/*.py.v0.13.0Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate.