Lxml

Latest version: v5.3.1

Safety actively analyzes 714815 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 19 of 28

2.2.4

Not secure
==================

Bugs fixed
----------

* Static build of libxml2/libxslt was broken.

2.2.3

Not secure
==================

Features added
--------------

Bugs fixed
----------

* The ``resolve_entities`` option did not work in the incremental feed
parser.

* Looking up and deleting attributes without a namespace could hit a
namespaced attribute of the same name instead.

* Late errors during calls to ``SubElement()`` (e.g. attribute related
ones) could leave a partially initialised element in the tree.

* Modifying trees that contain parsed entity references could result
in an infinite loop.

* ObjectifiedElement.__setattr__ created an empty-string child element when the
attribute value was rejected as a non-unicode/non-ascii string

* Syntax errors in ``lxml.cssselect`` could result in misleading error
messages.

* Invalid syntax in CSS expressions could lead to an infinite loop in
the parser of ``lxml.cssselect``.

* CSS special character escapes were not properly handled in
``lxml.cssselect``.

* CSS Unicode escapes were not properly decoded in ``lxml.cssselect``.

* Select options in HTML forms that had no explicit ``value``
attribute were not handled correctly. The HTML standard dictates
that their value is defined by their text content. This is now
supported by lxml.html.

* XPath raised a TypeError when finding CDATA sections. This is now
fully supported.

* Calling ``help(lxml.objectify)`` didn't work at the prompt.

* The ``ElementMaker`` in lxml.objectify no longer defines the default
namespaces when annotation is disabled.

* Feed parser failed to honour the 'recover' option on parse errors.

* Diverting the error logging to Python's logging system was broken.

Other changes
-------------

2.2.2

Not secure
==================

Features added
--------------

* New helper functions ``strip_attributes()``, ``strip_elements()``,
``strip_tags()`` in lxml.etree to remove attributes/subtrees/tags
from a subtree.

Bugs fixed
----------

* Namespace cleanup on subtree insertions could result in missing
namespace declarations (and potentially crashes) if the element
defining a namespace was deleted and the namespace was not used by
the top element of the inserted subtree but only in deeper subtrees.

* Raising an exception from a parser target callback didn't always
terminate the parser.

* Only {true, false, 1, 0} are accepted as the lexical representation for
BoolElement ({True, False, T, F, t, f} not any more), restoring lxml <= 2.0
behaviour.

Other changes
-------------

2.2.1

Not secure
==================

Features added
--------------

* Injecting default attributes into a document during XML Schema
validation (also at parse time).

* Pass ``huge_tree`` parser option to disable parser security
restrictions imposed by libxml2 2.7.

Bugs fixed
----------

* The script for statically building libxml2 and libxslt didn't work
in Py3.

* ``XMLSchema()`` also passes invalid schema documents on to libxml2
for parsing (which could lead to a crash before release 2.6.24).

Other changes
-------------

2.2

Not secure
================

Features added
--------------

* Support for ``standalone`` flag in XML declaration through
``tree.docinfo.standalone`` and by passing ``standalone=True/False``
on serialisation.

Bugs fixed
----------

* Crash when parsing an XML Schema with external imports from a
filename.

2.2beta4

=====================

Features added
--------------

* Support strings and instantiable Element classes as child arguments
to the constructor of custom Element classes.

* GZip compression support for serialisation to files and file-like
objects.

Bugs fixed
----------

* Deep-copying an ElementTree copied neither its sibling PIs and
comments nor its internal/external DTD subsets.

* Soupparser failed on broken attributes without values.

* Crash in XSLT when overwriting an already defined attribute using
``xsl:attribute``.

* Crash bug in exception handling code under Python 3. This was due
to a problem in Cython, not lxml itself.

* ``lxml.html.FormElement._name()`` failed for non top-level forms.

* ``TAG`` special attribute in constructor of custom Element classes
was evaluated incorrectly.

Other changes
-------------

* Official support for Python 3.0.1.

* ``Element.findtext()`` now returns an empty string instead of None
for Elements without text content.

Page 19 of 28

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.