v1.1.1

1.1.1 (2026-10-12)

Bug Fixes

• ci: align wheel publish workflow with PyPI trusted publisher config (release.yml) (#18) (3ec4c53)

v1.1.0

1.1.0 (2026-10-12)

Bug Fixes

• ci: make differential fuzz runner stdout ascii-safe for Windows console (7a9e41f)
• ci: make Rust extension import optional in common/init and build in rust-check job (cf9553c)
• test: bundle industrial XML instance payloads for cross-platform CI runner parity (707808f)

Features

• ci,docs: add banner, CI for Python 3.14/3.15, OSV metadata, and decouple compatibility tests (89f508d)
• dropin: add minidom and sax drop-in modules, XML 1.0 attribute normalization, hypothesis testing, and libFuzzer target (46689bf)
• industrial schema validation and adversarial payload hardening (#10) (#14) (7ef8f7a)
• security: add max_input_size and max_elements defenses, modularize PyO3 feature, and clean issue references (023a650)
• security: harden XML parser against audit findings A1-A12 and fix stdlib parity (#7) (7d68839)
• test: add automated differential fuzzing against stdlib and defusedxml (#8) (#12) (ed7c40a)
• W3C XML conformance manifest runner and parser compliance (#9) (#13) (47cea2a)

v1.0.1 - 100% Coverage, Modern XML Defenses & Concurrency Benchmarks

SafeXML 1.0.1 - The Memory-Safe, GIL-Free, Ultra-Fast Defused XML Parser

What's New in 1.0.1

• 100.00% Enforced Code Coverage: Every statement and branch is rigorously verified across Linux, macOS, and Windows. Strict 100% coverage is enforced directly in CI (pytest --cov-fail-under=100) and pre-push hooks.
• Modern XML Vulnerability Defenses (Beyond DefusedXML):
  • Attribute Flood / Attribute Hash DoS (CWE-400): Enforces max_attributes (default: 1,000) to defeat quadratic hash table collision and memory blowup attacks.
  • Giant Attribute Value Bombs (CWE-400): Enforces max_attribute_size (default: 10MB) to stop single-attribute memory exhaustion.
  • Comment Amplification Bombs: Enforces max_comment_size (default: 10MB) to block unbounded comment streaming.
  • Tag Name Memory Bombs: Enforces max_name_size (default: 1,024 chars) to prevent symbol table exhaustion.
  • Null Byte Injection Defense: Strictly rejects embedded \0 bytes in identifiers to prevent C-string truncation exploits in downstream databases and auth services.
  • Parameter Entity Protection: Full detection and rejection of <!ENTITY % pe ...> within internal/external DTD subsets.
• High-Performance Benchmarks vs DefusedXML:
  • Single-Threaded: SafeXML is 1.63x faster (+62.9% throughput) on standard workloads (67 µs vs 109 µs) and 1.23x faster on large 500KB documents (42 ms vs 52 ms).
  • Multi-Threaded Concurrency (GIL-Release): Under ThreadPoolExecutor simulating API concurrency, SafeXML achieves 1.42x - 1.43x higher throughput because Rust releases the GIL (py.detach(|| ...)), freeing CPU cores to process requests in parallel.
• Compelling Documentation: Complete attack surface comparison matrix comparing SafeXML vs defusedxml vs lxml vs stdlib, highlighting immunity to C libexpat memory corruption CVEs.

Installation

pip install safexml

PyPI: https://pypi.org/project/safexml/1.0.1/

v1.0.0 - Production Release

SafeXML 1.0.0 - Memory-Safe, Ultra-Fast Defused XML Parser

SafeXML is a high-performance, memory-safe, drop-in replacement for Python's defusedxml and xml.etree.ElementTree, backed by a streaming Rust engine (quick-xml and PyO3).

Highlights

• 100% Drop-in Parity: Drop-in compatible with defusedxml.ElementTree and xml.etree.ElementTree (fromstring, parse, iterparse, XML, tostring, indent, defuse_stdlib).
• Defusedxml Issue Fixes:
  • Resolves tiran/defusedxml#105: Exception args populated for Rich / IPython traceback formatters.
  • Resolves tiran/defusedxml#87: Full indent() support.
  • Resolves tiran/defusedxml#78: fromstring(..., parser=None) support.
  • Resolves tiran/defusedxml#79: register_namespace() alias.
  • Resolves tiran/defusedxml#80: Element & SubElement exports.
  • Resolves tiran/defusedxml#104: PEP 561 typing marker (py.typed).
• Multi-core Scaling: Releases Python GIL during Rust parsing via py.detach(|| ...).
• Target Platform: Exclusively Python >= 3.12. Prebuilt ABI3 wheels for Linux (x86_64, aarch64), macOS (arm64, x86_64), and Windows (x64).

Installation

pip install safexml

PyPI: https://pypi.org/project/safexml/1.0.0/