Lxml

Latest version: v5.3.1

Safety actively analyzes 714815 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 21 of 28

2.1.3

Not secure
==================

Features added
--------------

Bugs fixed
----------

* Ref-count leaks when lxml enters a try-except statement while an
outside exception lives in sys.exc_*(). This was due to a problem in
Cython, not lxml itself.

* Parser Unicode decoding errors could get swallowed by other
exceptions.

* Name/import errors in some Python modules.

* Internal DTD subsets that did not specify a system or public ID were
not serialised and did not appear in the docinfo property of
ElementTrees.

* Fix a pre-Py3k warning when parsing from a gzip file in Py2.6.

* Test suite fixes for libxml2 2.7.

* Resolver.resolve_string() did not work for non-ASCII byte strings.

* Resolver.resolve_file() was broken.

* Overriding the parser encoding didn't work for many encodings.

Other changes
-------------

2.1.2

Not secure
==================

Features added
--------------

* lxml.etree now tries to find the absolute path name of files when
parsing from a file-like object. This helps custom resolvers when
resolving relative URLs, as lixbml2 can prepend them with the path
of the source document.

Bugs fixed
----------

* Memory problem when passing documents between threads.

* Target parser did not honour the ``recover`` option and raised an
exception instead of calling ``.close()`` on the target.

Other changes
-------------

2.1.1

Not secure
==================

Features added
--------------

Bugs fixed
----------

* Crash when parsing XSLT stylesheets in a thread and using them in
another.

* Encoding problem when including text with ElementInclude under
Python 3.

Other changes
-------------

2.1

Not secure
================

Features added
--------------

* Smart strings can be switched off in XPath (``smart_strings``
keyword option).

* ``lxml.html.rewrite_links()`` strips links to work around documents
with whitespace in URL attributes.

Bugs fixed
----------

* Custom resolvers were not used for XMLSchema includes/imports and
XInclude processing.

* CSS selector parser dropped remaining expression after a function
with parameters.

Other changes
-------------

* ``objectify.enableRecursiveStr()`` was removed, use
``objectify.enable_recursive_str()`` instead

* Speed-up when running XSLTs on documents from other threads

2.1beta3

=====================

Features added
--------------

* Major overhaul of ``tools/xpathgrep.py`` script.

* Pickling ``ElementTree`` objects in lxml.objectify.

* Support for parsing from file-like objects that return unicode
strings.

* New function ``etree.cleanup_namespaces(el)`` that removes unused
namespace declarations from a (sub)tree (experimental).

* XSLT results support the buffer protocol in Python 3.

* Polymorphic functions in ``lxml.html`` that accept either a tree or
a parsable string will return either a UTF-8 encoded byte string, a
unicode string or a tree, based on the type of the input.
Previously, the result was always a byte string or a tree.

* Support for Python 2.6 and 3.0 beta.

* File name handling now uses a heuristic to convert between byte
strings (usually filenames) and unicode strings (usually URLs).

* Parsing from a plain file object frees the GIL under Python 2.x.

* Running ``iterparse()`` on a plain file (or filename) frees the GIL
on reading under Python 2.x.

* Conversion functions ``html_to_xhtml()`` and ``xhtml_to_html()`` in
lxml.html (experimental).

* Most features in lxml.html work for XHTML namespaced tag names
(experimental).

Bugs fixed
----------

* ``ElementTree.parse()`` didn't handle target parser result.

* Crash in Element class lookup classes when the __init__() method of
the super class is not called from Python subclasses.

* A number of problems related to unicode/byte string conversion of
filenames and error messages were fixed.

* Building on MacOS-X now passes the "flat_namespace" option to the C
compiler, which reportedly prevents build quirks and crashes on this
platform.

* Windows build was broken.

* Rare crash when serialising to a file object with certain encodings.

Other changes
-------------

* Non-ASCII characters in attribute values are no longer escaped on
serialisation.

* Passing non-ASCII byte strings or invalid unicode strings as .tag,
namespaces, etc. will result in a ValueError instead of an
AssertionError (just like the tag well-formedness check).

* Up to several times faster attribute access (i.e. tree traversal) in
lxml.objectify.

2.1beta2

=====================

Features added
--------------

* All parse functions in lxml.html take a ``parser`` keyword argument.

* lxml.html has a new parser class ``XHTMLParser`` and a module
attribute ``xhtml_parser`` that provide XML parsers that are
pre-configured for the lxml.html package.

Bugs fixed
----------

* Moving a subtree from a document created in one thread into a
document of another thread could crash when the rest of the source
document is deleted while the subtree is still in use.

* Passing an nsmap when creating an Element will no longer strip
redundantly defined namespace URIs. This prevented the definition
of more than one prefix for a namespace on the same Element.

Other changes
-------------

* If the default namespace is redundantly defined with a prefix on the
same Element, the prefix will now be preferred for subelements and
attributes. This allows users to work around a problem in libxml2
where attributes from the default namespace could serialise without
a prefix even when they appear on an Element with a different
namespace (i.e. they would end up in the wrong namespace).

Page 21 of 28

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.