Lxml

Latest version: v5.3.1

Safety actively analyzes 706267 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 11 of 28

3.5.0b1

====================

Features added
--------------

* ``cleanup_namespaces()`` accepts a new argument ``keep_ns_prefixes``
that does not remove definitions of the provided prefix-namespace
mapping from the tree.

* ``cleanup_namespaces()`` accepts a new argument ``top_nsmap`` that
moves definitions of the provided prefix-namespace mapping to the
top of the tree.

* LP1490451: ``Element`` objects gained a ``cssselect()`` method as
known from ``lxml.html``. Patch by Simon Sapin.

* API functions and methods behave and look more like Python functions,
which allows introspection on them etc. One side effect to be aware of
is that the functions now bind as methods when assigned to a class
variable. A quick fix is to wrap them in ``staticmethod()`` (as for
normal Python functions).

* ISO-Schematron support gained an option ``error_finder`` that allows
passing a filter function for picking validation errors from reports.

* LP1243600: Elements in ``lxml.html`` gained a ``classes`` property
that provides a set-like interface to the ``class`` attribute.
Original patch by masklinn.

* LP1341964: The soupparser now handles DOCTYPE declarations, comments
and processing instructions outside of the root element.
Patch by Olli Pottonen.

* LP1421512: The ``docinfo`` of a tree was made editable to allow
setting and removing the public ID and system ID of the DOCTYPE.
Patch by Olli Pottonen.

* LP1442427: More work-arounds for quirks and bugs in pypy and pypy3.

* ``lxml.html.soupparser`` now uses BeautifulSoup version 4 instead
of version 3 if available.

Bugs fixed
----------

* Memory errors that occur during tree adaptations (e.g. moving subtrees
to foreign documents) could leave the tree in a crash prone state.

* Calling ``process_children()`` in an XSLT extension element without
an ``output_parent`` argument failed with a ``TypeError``.
Fix by Jens Tröger.

* GH162: Image data in HTML ``data`` URLs is considered safe and
no longer removed by ``lxml.html.clean`` JavaScript cleaner.

* GH166: Static build could link libraries in wrong order.

* GH172: Rely a bit more on libxml2 for encoding detection rather than
rolling our own in some cases. Patch by Olli Pottonen.

* GH159: Validity checks for names and string content were tightened
to detect the use of illegal characters early. Patch by Olli Pottonen.

* LP1421921: Comments/PIs before the DOCTYPE declaration were not
serialised. Patch by Olli Pottonen.

* LP659367: Some HTML DOCTYPE declarations were not serialised.
Patch by Olli Pottonen.

* LP1238503: lxml.doctestcompare is now consistent with stdlib's doctest
in how it uses ``+`` and ``-`` to refer to unexpected and missing output.

* Empty prefixes are explicitly rejected when a namespace mapping is used
with ElementPath to avoid hiding bugs in user code.

* Several problems with PyPy were fixed by switching to Cython 0.23.

3.4.4

Not secure
==================

Bugs fixed
----------

* An ElementTree compatibility test added in lxml 3.4.3 that failed in
Python 3.4+ was removed again.

3.4.3

Not secure
==================

Bugs fixed
----------

* Expression cache in ElementPath was ignored. Fix by Changaco.

* LP1426868: Passing a default namespace and a prefixed namespace mapping
as nsmap into ``xmlfile.element()`` raised a ``TypeError``.

* LP1421927: DOCTYPE system URLs were incorrectly quoted when containing
double quotes. Patch by Olli Pottonen.

* LP1419354: meta-redirect URLs were incorrectly processed by
``iterlinks()`` if preceded by whitespace.

3.4.2

Not secure
==================

Bugs fixed
----------

* LP1415907: Crash when creating an XMLSchema from a non-root element
of an XML document.

* LP1369362: HTML cleaning failed when hitting processing instructions
with pseudo-attributes.

* ``CDATA()`` wrapped content was rejected for tail text.

* CDATA sections were not serialised as tail text of the top-level element.

3.4.1

Not secure
==================

Features added
--------------

* New ``htmlfile`` HTML generator to accompany the incremental ``xmlfile``
serialisation API. Patch by Burak Arslan.

Bugs fixed
----------

* ``lxml.sax.ElementTreeContentHandler`` did not initialise its superclass.

3.4.0

Not secure
==================

Features added
--------------

* ``xmlfile(buffered=False)`` disables output buffering and flushes the
content after each API operation (starting/ending element blocks or writes).
A new method ``xf.flush()`` can alternatively be used to explicitly flush
the output.

* ``lxml.html.document_fromstring`` has a new option ``ensure_head_body=True``
which will add an empty head and/or body element to the result document if
missing.

* ``lxml.html.iterlinks`` now returns links inside meta refresh tags.

* New ``XMLParser`` option ``collect_ids=False`` to disable ID hash table
creation. This can substantially speed up parsing of documents with many
different IDs that are not used.

* The parser uses per-document hash tables for XML IDs. This reduces the
load of the global parser dict and speeds up parsing for documents with
many different IDs.

* ``ElementTree.getelementpath(element)`` returns a structural ElementPath
expression for the given element, which can be used for lookups later.

* ``xmlfile()`` accepts a new argument ``close=True`` to close file(-like)
objects after writing to them. Before, ``xmlfile()`` only closed the file
if it had opened it internally.

* Allow "bytearray" type for ASCII text input.

Bugs fixed
----------

Other changes
-------------

* LP400588: decoding errors have become hard errors even in recovery mode.
Previously, they could lead to an internal tree representation in a mixed
encoding state, which lead to very late errors or even silently incorrect
behaviour during tree traversal or serialisation.

* Requires Python 2.6, 2.7, 3.2 or later. No longer supports
Python 2.4, 2.5 and 3.1, use lxml 3.3.x for those.

* Requires libxml2 2.7.0 or later and libxslt 1.1.23 or later,
use lxml 3.3.x with older versions.

Page 11 of 28

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.