Lxml

Latest version: v5.3.1

Safety actively analyzes 706267 Python packages for vulnerabilities to keep your Python projects secure.

Scan your dependencies

Page 8 of 28

4.2.2

Not secure
==================

Bugs fixed
----------

* GH266: Fix sporadic crash during GC when parse-time schema validation is used
and the parser participates in a reference cycle.
Original patch by Julien Greard.

* GH265: lxml no longer links against zlib as a shared library, only on static builds.
Patch by Nehal J Wani.

4.2.1

Not secure
==================

Bugs fixed
----------

* LP1755825: ``iterwalk()`` failed to return the 'start' event for the initial
element if a tag selector is used.

* LP1756314: Failure to import 4.2.0 into PyPy due to a missing library symbol.

* LP1727864, GH258: Add "-isysroot" linker option on MacOS as needed by XCode 9.

4.2.0

Not secure
==================

Features added
--------------

* GH255: ``SelectElement.value`` returns more standard-compliant and
browser-like defaults for non-multi-selects. If no option is selected, the
value of the first option is returned (instead of None). If multiple options
are selected, the value of the last one is returned (instead of that of the
first one). If no options are present (not standard-compliant)
``SelectElement.value`` still returns ``None``.

* GH261: The ``HTMLParser()`` now supports the ``huge_tree`` option.
Patch by stranac.

Bugs fixed
----------

* LP1551797: Some XSLT messages were not captured by the transform error log.

* LP1737825: Crash at shutdown after an interrupted iterparse run with XMLSchema
validation.

Other changes
-------------

4.1.1

Not secure
==================

* Rebuild with Cython 0.27.3 to improve support for Py3.7.

4.1.0

Not secure
==================

Features added
--------------

* ElementPath supports text predicates for current node, like "[.='text']".

* ElementPath allows spaces in predicates.

* Custom Element classes and XPath functions can now be registered with a
decorator rather than explicit dict assignments.

* Static Linux wheels are now built with link time optimisation (LTO) enabled.
This should have a beneficial impact on the overall performance by providing
a tighter compiler integration between lxml and libxml2/libxslt.

Bugs fixed
----------

* LP1722776: Requesting non-Element objects like comments from a document with
``PythonElementClassLookup`` could fail with a TypeError.

4.0.0

Not secure
==================

Features added
--------------

* The ElementPath implementation is now compiled using Cython,
which speeds up the ``.find*()`` methods quite significantly.

* The modules ``lxml.builder``, ``lxml.html.diff`` and ``lxml.html.clean``
are also compiled using Cython in order to speed them up.

* ``xmlfile()`` supports async coroutines using ``async with`` and ``await``.

* ``iterwalk()`` has a new method ``skip_subtree()`` that prevents walking into
the descendants of the current element.

* ``RelaxNG.from_rnc_string()`` accepts a ``base_url`` argument to
allow relative resource lookups.

* The XSLT result object has a new method ``.write_output(file)`` that serialises
output data into a file according to the ``<xsl:output>`` configuration.

Bugs fixed
----------

* GH251: HTML comments were handled incorrectly by the soupparser.
Patch by mozbugbox.

* LP1654544: The html5parser no longer passes the ``useChardet`` option
if the input is a Unicode string, unless explicitly requested. When parsing
files, the default is to enable it when a URL or file path is passed (because
the file is then opened in binary mode), and to disable it when reading from
a file(-like) object.

Note: This is a backwards incompatible change of the default configuration.
If your code parses byte strings/streams and depends on character detection,
please pass the option ``guess_charset=True`` explicitly, which already worked
in older lxml versions.

* LP1703810: ``etree.fromstring()`` failed to parse UTF-32 data with BOM.

* LP1526522: Some RelaxNG errors were not reported in the error log.

* LP1567526: Empty and plain text input raised a TypeError in soupparser.

* LP1710429: Uninitialised variable usage in HTML diff.

* LP1415643: The closing tags context manager in ``xmlfile()`` could continue
to output end tags even after writing failed with an exception.

* LP1465357: ``xmlfile.write()`` now accepts and ignores None as input argument.

* Compilation under Py3.7-pre failed due to a modified function signature.

Other changes
-------------

* The main module source files were renamed from ``lxml.*.pyx`` to plain
``*.pyx`` (e.g. ``etree.pyx``) to simplify their handling in the build
process. Care was taken to keep the old header files as fallbacks for
code that compiles against the public C-API of lxml, but it might still
be worth validating that third-party code does not notice this change.

Page 8 of 28

© 2025 Safety CLI Cybersecurity Inc. All Rights Reserved.