') + ')', 'gi'); if (regex.test(text)) { found = true; var frag = document.createDocumentFragment(); var parts = text.split(regex); parts.forEach(function(part, i) { if (i % 2 === 0) { frag.appendChild(document.createTextNode(part)); } else { var span = document.createElement('span'); span.className = 'userscript-highlight'; span.textContent = part; frag.appendChild(span); } }); node.parentNode.replaceChild(frag, node); } }); } else if (node.nodeType === 1 && node.childNodes) { // element var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT']; if (!skipTags.includes(node.tagName)) { Array.from(node.childNodes).forEach(highlight); } } } highlight(document.body); // Re-highlight on dynamic content var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1 || node.nodeType === 3) highlight(node); }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Strip utm_, fbclid, gclid, etc. from all links on page (function() { var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid', 'ref', 'ref_src', 'source', 'medium', 'campaign']; function cleanUrl(url) { try { var u = new URL(url, window.location.origin); var changed = false; trackingParams.forEach(function(p) { if (u.searchParams.has(p)) { u.searchParams.delete(p); changed = true; } }); return changed ? u.toString() : url; } catch (e) { return url; } } function cleanLinks() { document.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } cleanLinks(); var observer = new MutationObserver(function(mutations) { mutations.forEach(function(m) { m.addedNodes.forEach(function(node) { if (node.nodeType === 1) { if (node.tagName === 'A') cleanLinks(); node.querySelectorAll('a[href]').forEach(function(a) { var clean = cleanUrl(a.href); if (clean !== a.href) a.href = clean; }); } }); }); }); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); } })(); (function(){ try { var __m = "youtube.com"; var __re = new RegExp('^' + "youtube\\.com" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Auto-enable theater mode on YouTube (function() { function tryTheater() { var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]'); if (btn && !btn.classList.contains('activated')) { btn.click(); } } // Try immediately tryTheater(); // Try after navigation (SPA) var lastUrl = location.href; setInterval(function() { if (location.href !== lastUrl) { lastUrl = location.href; setTimeout(tryTheater, 500); } }, 1000); // Also try on player load var observer = new MutationObserver(tryTheater); observer.observe(document.body, { childList: true, subtree: true }); })(); } } catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); } })(); (function(){ try { var __m = "*"; var __re = new RegExp('^' + ".*" + ', 'i'); if (__m === '*' || __re.test(location.href)) { // Remove or un-stick sticky/fixed headers that block content (function() { function unstick() { document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) { if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') { el.style.position = 'static'; el.style.top = 'auto'; el.style.zIndex = 'auto'; } }); } unstick(); var observer = new MutationObserver(unstick); observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] }); })(); } } catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); } })(); })(); Update dependency lxml to v6.1.0 by mend-for-github-com[bot] · Pull Request #72 · opensearch-project/sql-cli · GitHub
Skip to content

Update dependency lxml to v6.1.0 - #72

Open
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/lxml-6.x
Open

Update dependency lxml to v6.1.0#72
mend-for-github-com[bot] wants to merge 1 commit into
mainfrom
whitesource-remediate/lxml-6.x

Conversation

@mend-for-github-com

@mend-for-github-commend-for-github-comBot commented May 27, 2026•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

PackageUpdateChange
lxml (source, changelog)minor==6.0.0 → ==6.1.0

By merging this PR, the issue #65 will be automatically resolved and closed:

Severity CVSS ScoreVulnerability
High High7.5CVE-2026-41066

Release Notes

lxml/lxml (lxml)

v6.1.0

Compare Source

==================

This release fixes a possible external entity injection (XXE) vulnerability in
iterparse() and the ETCompatXMLParser.

Features added

  • GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes
    in lxml.html.defs. This allows lxml_html_clean to pass them through.
    Patch by oomsveta.

  • The default chunk size for reading from file-likes in iterparse() is now configurable
    with a new chunk_size argument.

Bugs fixed

  • LP#2146291: The resolve_entities option was still set to True for
    iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)
    when using these parsers without setting this option explicitly.
    The default was now changed to 'internal' only (as for the normal XML and HTML parsers
    since lxml 5.0).
    Issue found by Sihao Qiu as CVE-2026-41066.

v6.0.4

Compare Source

==================

Bugs fixed

  • LP#2148019: Spurious MemoryError during namespace cleanup.

v6.0.3

Compare Source

==================

Bugs fixed

  • Several out of memory error cases now raise MemoryError that were not handled before.

  • Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

  • LP#2125399: Some failing tests were fixed or disabled in PyPy.

  • LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

  • Memory leak in case of a memory allocation failure when copying document subtrees.

  • When mapping an XPath result to Python failed, the result memory could leak.

  • When preparing an XSLT transform failed, the XSLT parameter memory could leak.

Other changes

  • Built using Cython 3.2.4.

  • Binary wheels use zlib 1.3.2.

v6.0.2

Compare Source

==================

Bugs fixed

Other changes

  • Binary wheels for Py3.9-3.11 on the riscv64 architecture were added.

  • Error constants were updated to match libxml2 2.15.0.

  • Built using Cython 3.1.4.

v6.0.1

Compare Source

==================

Bugs fixed

  • LP#2116333: lxml.sax._getNsTag() could fail with an exception on malformed input.

  • GH#467: Some test adaptations were made for libxml2 2.15.
    Patch by Nick Wellnhofer.

  • LP2119510, GH#473: A Python compatibility test was fixed for Python 3.14+.
    Patch by Lumír Balhar.

  • GH#471: Wheels for "riscv64" on recent Python versions were added.
    Patch by ffgan.

  • GH#469: The wheel build no longer requires the wheel package unconditionally.
    Patch by Miro Hrončok.

  • Binary wheels use the library version libxml2 2.14.5.
    See https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.14.5

  • Windows binary wheels continue to use a security patched library version libxml2 2.11.9.

  • If you want to rebase/retry this PR, check this box

@mend-for-github-commend-for-github-comBot added the security fix Security fix generated by Mend label May 27, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ps48ps48Awaiting requested review from ps48ps48 is a code owner
@kavithacmkavithacmAwaiting requested review from kavithacmkavithacm is a code owner
@derek-hoderek-hoAwaiting requested review from derek-hoderek-ho is a code owner
@joshuali925joshuali925Awaiting requested review from joshuali925joshuali925 is a code owner
@dai-chendai-chenAwaiting requested review from dai-chendai-chen is a code owner
@YANG-DBYANG-DBAwaiting requested review from YANG-DBYANG-DB is a code owner
@mengweiericmengweiericAwaiting requested review from mengweiericmengweieric is a code owner
@SwiddisSwiddisAwaiting requested review from SwiddisSwiddis is a code owner
@penghuopenghuoAwaiting requested review from penghuopenghuo is a code owner
@seankao-azseankao-azAwaiting requested review from seankao-azseankao-az is a code owner
@MaxKsyunzMaxKsyunzAwaiting requested review from MaxKsyunzMaxKsyunz is a code owner
@Yury-FridlyandYury-FridlyandAwaiting requested review from Yury-FridlyandYury-Fridlyand is a code owner
@anirudhaanirudhaAwaiting requested review from anirudhaanirudha is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

security fixSecurity fix generated by Mend

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants