fix(deps): update dependency xmlsec to <1.3.18#211
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
fix(deps): update dependency xmlsec to <1.3.18#211renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
14 times, most recently
from
6e07d1a to
355f277
Compare
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
9 times, most recently
from
a49fb8a to
d720587
Compare
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
5 times, most recently
from
724954f to
1070b52
Compare
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
2 times, most recently
from
dd1fea8 to
68098e6
Compare
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
2 times, most recently
from
19f31e1 to
0e375f5
Compare
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
12 times, most recently
from
b888aef to
59b62af
Compare
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
11 times, most recently
from
43323a6 to
61fdcc8
Compare
renovate
Bot
force-pushed
the
renovate/xmlsec-1.x
branch
2 times, most recently
from
0417a29 to
f88cf8c
Compare
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
| touchstone = [ | ||
| 'python3-saml>=1.10.1; python_version < "3.13"', | ||
| 'xmlsec<1.3.15; python_version < "3.13"', | ||
| 'xmlsec<1.3.18; python_version < "3.13"', |
There was a problem hiding this comment.
Bug: The xmlsec upgrade conflicts with the pinned lxml version, which will break SAML authentication for deployments using the optional touchstone dependency.
Severity: HIGH
Suggested Fix
Update the lxml constraint in the root pyproject.toml to allow a version compatible with the new xmlsec requirement, such as lxml>=6.0.2. Alternatively, revert the xmlsec upgrade.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: src/authentication/pyproject.toml#L23
Potential issue: The upgrade of `xmlsec` to version `1.3.17` introduces a requirement
for `lxml >= 6.0.2`. However, the root `pyproject.toml` file pins `lxml` to version
`<=5.3.2`. This creates a dependency conflict. While `xmlsec` is part of an optional
dependency group (`touchstone`), any deployment that installs this group to enable SAML
authentication will experience a runtime failure. The conflict will break SAML
functionality when the code attempts to use both libraries together.
Did we get this right? 👍 / 👎 to inform future reviews.
| touchstone = [ | ||
| 'python3-saml>=1.10.1; python_version < "3.13"', | ||
| 'xmlsec<1.3.15; python_version < "3.13"', | ||
| 'xmlsec<1.3.18; python_version < "3.13"', |
There was a problem hiding this comment.
Bug: The updated xmlsec<1.3.18 constraint allows xmlsec==1.3.17, which is incompatible with lxml<6.0.2. The package doesn't enforce a compatible lxml version, risking runtime errors for consumers.
Severity: HIGH
Suggested Fix
Add a corresponding lxml>=6.0.2 constraint to the same optional dependency group (touchstone) where xmlsec<1.3.18 is specified. This ensures that any environment installing the touchstone extra will have compatible versions of both xmlsec and lxml.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: src/authentication/pyproject.toml#L23
Potential issue: The optional dependency `xmlsec` is updated to `<1.3.18`, which allows
version `1.3.17`. According to its release notes, `xmlsec==1.3.17` binary wheels are
incompatible with `lxml<6.0.2`. However, the `pyproject.toml` for
`mitol-django-authentication` does not enforce a minimum `lxml` version. Downstream
consumers installing the `touchstone` extra could resolve `xmlsec==1.3.17` alongside an
older, incompatible version of `lxml` (e.g., `5.x`), leading to a runtime crash with an
`lxml & xmlsec libxml2 library version mismatch` error when SAML authentication is used.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
<1.3.15→<1.3.18Release Notes
mehcode/python-xmlsec (xmlsec)
v1.3.17Compare Source
Release Date: 2025-11-11
Version: 1.3.17
Compatibility and Wheel Support
This release provides binary wheels that are fully compatible with lxml v6.0.2. The compatibility is ensured by using the same underlying
libxml2version in bothpython-xmlsecandlxml.Because of this strict requirement, the wheels cannot be used with versions of lxml lower than 6.0.2. Mixing versions will lead to runtime errors.
Common Error
If you see the following message:
it indicates that the version of
libxml2used to buildlxmldoes not match the version used to buildpython-xmlsec.Recommended Solutions
lxmlto v6.0.2, orlxmlandpython-xmlsecmanually from source using the samelibxml2versionWheel Build Configuration
Linux and macOS Wheels
These wheels are built against the following versions, which match those used in
lxml v6.0.2:libxml2v2.14.6libxsltv1.1.43xmlsec1v1.3.9zlibv1.3.1libiconvv1.18opensslv3.6.0Windows Binary Wheels
The Windows binary wheels were compiled using Visual Studio 2022 and include the following libraries:
iconvv1.18-1libxml2v2.11.9-3libxsltv1.1.39opensslv3.0.16.pl1xmlsecv1.3.7zlibv1.3.1These versions are compatible with those used in
lxml v6.0.2.Noticeable changes
Acknowledgements
Special thanks to
New Contributors
Full Changelog: xmlsec/python-xmlsec@1.3.16...1.3.17
v1.3.16Compare Source
Release Date: 2025-07-10
Version: 1.3.16
Compatibility and Wheel Support
This release provides binary wheels that are fully compatible with lxml v6.0.0. The compatibility is ensured by using the same underlying
libxml2version in bothpython-xmlsecandlxml.Because of this strict requirement, the wheels cannot be used with versions of lxml lower than 6.0.0. Mixing versions will lead to runtime errors.
Common Error
If you see the following message:
it indicates that the version of
libxml2used to buildlxmldoes not match the version used to buildpython-xmlsec.Recommended Solutions
lxmlto v6.0.0, orlxmlandpython-xmlsecmanually from source using the samelibxml2versionWheel Build Configuration
Linux and macOS Wheels
These wheels are built against the following versions, which match those used in
lxml v6.0.0:libxml2v2.14.4libxsltv1.1.43xmlsec1v1.3.7Windows Binary Wheels
The Windows binary wheels were compiled using Visual Studio 2022 and include the following libraries:
iconvv1.18-1libxml2v2.11.9-3libxsltv1.1.39opensslv3.0.16.pl1xmlsecv1.3.7zlibv1.3.1These versions are compatible with those used in
lxml v6.0.0.Acknowledgements
Special thanks to @TomiBelan for helping with the creation of binary wheels for this release.
v1.3.15Compare Source
What's Changed
New Contributors
Full Changelog: xmlsec/python-xmlsec@1.3.14...1.3.15
Configuration
📅 Schedule: Branch creation - "every weekend" in timezone US/Eastern, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.