PyPI · #143 most downloaded on PyPI

defusedxml

0.7.1198M downloads/motiran/defusedxml ↗New releases in your daily digest, changelog included.

XML bomb protection for Python stdlib modules

Last release 3 years ago
no release in 18 months
Release timing varies
gaps range from 2 weeks to 3.8 years
Nearly every release is documented
notes for 6 of 6 stable releases
1 version withdrawn
withdrawn after publishing
14 years old
13 releases · first in 2013

Release timeline

13 releases since 2013

2013201520172019

Releases

0.8.0rc229 Sept 2023pre-releaseDeprecated
Silence deprecation warning in defuse_stdlib.
Release date: 29-Sep-2023

Silence deprecation warning in defuse_stdlib.

Update lxml safety information
Open source →
0.8.0rc128 Sept 2023pre-releaseSecurity
Update *vulnerabilities and features* table in README.
Release date: 26-Sep-2023

Drop support for Python 2.7, 3.4, and 3.5.

Test on 3.10, 3.11, and 3.12.

Add defusedxml.ElementTree.fromstringlist()

Update vulnerabilities and features table in README.

Pending removal The defusedxml.lxml module has been unmaintained and deprecated since 2019. The module will be removed in the next version.

Pending removal The defusedxml.cElementTree will be removed in the next version. Please use defusedxml.ElementTree instead.

0.7.18 Mar 2021

Fix regression defusedxml.ElementTree.ParseError ( #63 ). The ParseError exception is now the same class object as xml.etree.ElementTree.ParseError ag

Fix regression defusedxml.ElementTree.ParseError (#63). The ParseError exception is now the same class object as xml.etree.ElementTree.ParseError again.

Open source →

Additional notes

Release date: 08-Mar-2021

Fix regression defusedxml.ElementTree.ParseError (#63) The ParseError exception is now the same class object as xml.etree.ElementTree.ParseError again.

Open source →

0.7.04 Mar 2021Deprecated

Python 2 is deprecate. Support for Python 2 will be removed in 0.8.0.

Python 2 is deprecate. Support for Python 2 will be removed in 0.8.0.
Deprecate defusedxml.cElementTree
Use GitHub Actions instead of TravisCI
Restore ElementTree attribute of xml.etree module after patching

Open source →

Additional notes

Release date: 4-Mar-2021

No changes

Open source →

0.7.0rc212 Jan 2021pre-releaseDeprecated

Re-add and deprecate defusedxml.cElementTree

Re-add and deprecate defusedxml.cElementTree
Use GitHub Actions instead of TravisCI
Restore ElementTree attribute of xml.etree module after patching

Open source →

Additional notes

Release date: 12-Jan-2021

Re-add and deprecate defusedxml.cElementTree
Use GitHub Actions instead of TravisCI
Restore ElementTree attribute of xml.etree module after patching

Open source →

0.7.0rc14 May 2020pre-releaseDeprecated

Python 2 is deprecate. Support for Python 2 will be removed in 0.8.0.

Add support for Python 3.9
defusedxml.cElementTree is not available with Python 3.9.
Python 2 is deprecate. Support for Python 2 will be removed in 0.8.0.

Open source →

Additional notes

Release date: 04-May-2020

Add support for Python 3.9
defusedxml.cElementTree is not available with Python 3.9.
Python 2 is deprecate. Support for Python 2 will be removed in 0.8.0.

Open source →

0.6.017 Apr 2019Deprecated

No longer pass *html* argument to XMLParse. It has been deprecated and ignored for a long time. The DefusedXMLParser still takes a html argument. A de…

Release date: 17-Apr-2019

Test on Python 3.7 stable and 3.8-dev
Drop support for Python 3.4
No longer pass html argument to XMLParse. It has been deprecated and ignored for a long time. The DefusedXMLParser still takes a html argument. A deprecation warning is issued when the argument is False and a TypeError when it's True.
defusedxml now fails early when pyexpat stdlib module is not available or broken.
defusedxml.ElementTree.all now lists ParseError as public attribute.
The defusedxml.ElementTree and defusedxml.cElementTree modules had a typo and used XMLParse instead of XMLParser as an alias for DefusedXMLParser. Both the old and fixed name are now available.
Increase test coverage.
Add badges to README.

Open source →

Additional notes

Release date: 17-Apr-2019

Increase test coverage.
Add badges to README.

Open source →

0.6.0rc114 Apr 2019pre-releaseDeprecated

No longer pass *html* argument to XMLParse. It has been deprecated and ignored for a long time. The DefusedXMLParser still takes a html argument. A de…

Release date: 14-Apr-2019

Test on Python 3.7 stable and 3.8-dev
Drop support for Python 3.4
No longer pass html argument to XMLParse. It has been deprecated and ignored for a long time. The DefusedXMLParser still takes a html argument. A deprecation warning is issued when the argument is False and a TypeError when it's True.
defusedxml now fails early when pyexpat stdlib module is not available or broken.
defusedxml.ElementTree.all now lists ParseError as public attribute.
The defusedxml.ElementTree and defusedxml.cElementTree modules had a typo and used XMLParse instead of XMLParser as an alias for DefusedXMLParser. Both the old and fixed name are now available.

Open source →

0.425 Feb 2013Security

As per http://seclists.org/oss-sec/2013/q1/340 please REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280 and use CVE-2013-1664, CVE-2013-1665 for O…

Release date: 25-Feb-2013

As per http://seclists.org/oss-sec/2013/q1/340 please REJECT CVE-2013-0278, CVE-2013-0279 and CVE-2013-0280 and use CVE-2013-1664, CVE-2013-1665 for OpenStack/etc.
Add missing parser_list argument to sax.make_parser(). The argument is ignored, though. (thanks to Florian Apolloner)
Add demo exploit for external entity attack on Python's SAX parser, XML-RPC and WebDAV.

Open source →