Skip to content

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 15, 2025

⚠️ Dependabot is rebasing this PR ⚠️

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.


Bumps xmltodict from 0.14.2 to 1.0.0.

Release notes

Sourced from xmltodict's releases.

v1.0.0

1.0.0 (2025-09-12)

⚠ BREAKING CHANGES

  • modernize for Python 3.9+; drop legacy compat paths

Features

  • unparse: add limited XML comment round-trip; unify _emit behavior (e43537e)
  • unparse: add selective force_cdata support (bool/tuple/callable) (a497fed), closes #375

Bug Fixes

  • namespaces: attach [@xmlns](https://github.com/xmlns) to declaring element when process_namespaces=True (f0322e5), closes #163
  • streaming: avoid parent accumulation at item_depth; add regression tests (220240c)
  • unparse: handle non-string #text with attributes; unify value conversion (927a025), closes #366
  • unparse: skip empty lists to keep pretty/compact outputs consistent (ab4c86f)

Reverts

  • remove initial Release Drafter config (c0b74ed)

Documentation

  • readme: add API reference for parse()/unparse() kwargs (e5039ad)
  • readme: mention types-xmltodict stub package (58ec03e)

Code Refactoring

  • modernize for Python 3.9+; drop legacy compat paths (7364427)

v0.15.1

Full Changelog: martinblech/xmltodict@v0.15.0...v0.15.1

Changelog

Sourced from xmltodict's changelog.

1.0.0 (2025-09-12)

⚠ BREAKING CHANGES

  • modernize for Python 3.9+; drop legacy compat paths

Features

  • unparse: add limited XML comment round-trip; unify _emit behavior (e43537e)
  • unparse: add selective force_cdata support (bool/tuple/callable) (a497fed), closes #375

Bug Fixes

  • namespaces: attach [@xmlns](https://github.com/xmlns) to declaring element when process_namespaces=True (f0322e5), closes #163
  • streaming: avoid parent accumulation at item_depth; add regression tests (220240c)
  • unparse: handle non-string #text with attributes; unify value conversion (927a025), closes #366
  • unparse: skip empty lists to keep pretty/compact outputs consistent (ab4c86f)

Reverts

  • remove initial Release Drafter config (c0b74ed)

Documentation

  • readme: add API reference for parse()/unparse() kwargs (e5039ad)
  • readme: mention types-xmltodict stub package (58ec03e)

Code Refactoring

  • modernize for Python 3.9+; drop legacy compat paths (7364427)

v0.15.1

  • Security: Further harden XML injection prevention during unparse (follow-up to v0.15.0). In addition to '<'/'>' rejection, now also reject element and attribute names (including @xmlns prefixes) that:
    • start with '?' or '!'
    • contain '/' or any whitespace
    • contain quotes (' or ") or '='
    • are non-strings (names must be str; no coercion)

v0.15.0

  • Security: Prevent XML injection (CVE-2025-9375) by rejecting '<'/'>' in element and attribute names (including @xmlns prefixes) during unparse. This limits validation to avoiding tag-context escapes; attribute values continue to be escaped by the SAX XMLGenerator.

... (truncated)

Commits
  • 873f46b chore(master): release 1.0.0
  • f29773c chore(ci): publish releases automatically to PyPI
  • 884e0c0 chore(ci): add twine check
  • 7c37896 chore: commit message checks
  • e996f4f chore(release-please): set bootstrap SHA
  • 015bd8c chore(changelog): switch to release-please template
  • 678c36f chore(release-please): set monorepo-tags=false and include-component-in-tag=f...
  • 07d5b58 chore(ci): fix release-please workflow configuration
  • c0b74ed revert: remove initial Release Drafter config
  • 58ec03e docs(readme): mention types-xmltodict stub package
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [xmltodict](https://github.com/martinblech/xmltodict) from 0.14.2 to 1.0.0.
- [Release notes](https://github.com/martinblech/xmltodict/releases)
- [Changelog](https://github.com/martinblech/xmltodict/blob/master/CHANGELOG.md)
- [Commits](martinblech/xmltodict@v0.14.2...v1.0.0)

---
updated-dependencies:
- dependency-name: xmltodict
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 15, 2025
@dependabot dependabot bot requested a review from hosssha as a code owner September 15, 2025 16:38
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Sep 15, 2025
@dependabot dependabot bot added the python Pull requests that update Python code label Sep 15, 2025
@github-actions github-actions bot enabled auto-merge September 15, 2025 16:38
@coveralls
Copy link

coveralls commented Sep 15, 2025

Coverage Status

coverage: 60.861%. remained the same
when pulling 463fe1f on dependabot/pip/xmltodict-1.0.0
into cf4ad29 on main.

Copy link
Contributor

@jmcrawford45 jmcrawford45 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Automated approval for Dependabot PR #5308

Copy link
Contributor Author

dependabot bot commented on behalf of github Sep 17, 2025

Dependabot can't parse your pyproject.toml. Because of this, Dependabot cannot update this pull request.

@jmcrawford45
Copy link
Contributor

@dependabot rebase

@github-actions github-actions bot merged commit 90164dc into main Sep 18, 2025
15 checks passed
@dependabot dependabot bot deleted the dependabot/pip/xmltodict-1.0.0 branch September 18, 2025 17:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants