Update lxml requirement from ~=6.0.2 to ~=6.1.2

[dependabot]

Updates the requirements on lxml to permit the latest version.

Changelog

Sourced from lxml's changelog.

6.1.2 (2026-08-18)

• GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

6.1.1 (2026-05-18)

Bugs fixed

• The known link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. GHSA-4jhm-jv67-739f

• The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.

• The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

• GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

• The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

• LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)

... (truncated)

Commits

• f2874e9 Update release date.
• 687a295 Build: Exclude Py3.8 from windows-arm builds.
• acadc56 Build: Remove outdated build target.
• 59f93eb Build: Split old-Linux and other-Py3.8 builds.
• 923df83 Build: Fix manylinux2014 build.
• 975cc83 Build: Fix Px3.8 build setup.
• 09e5d3e Build: Fix cibuildwheel version.
• 998cf50 Build: Build Py3.8 wheels only once, not in every build job.
• 5567037 Build: Exclude Py3.15 from 32bit builds.
• 904db40 Build: Update cibuildwheel to include Py3.15.
• Additional commits viewable in compare view

[villelaitila]

Reviewed the diff — this is a one-line dependency version bump (lxml~=6.0.2 → lxml~=6.1.2) in requirements.txt, no code changes. No logical issues or weaknesses found.

Worth noting: the ~=6.1.2 range picks up two security-relevant fixes from lxml's changelog:

• 6.1.0 fixed an XXE (external entity injection) vulnerability in iterparse() and ETCompatXMLParser (resolve_entities was incorrectly True).
• 6.1.1 fixed a URL-bypass issue in lxml.html.defs.link_attrs (missing xlink:href) and bundled patched libxslt fixing CVE-2025-7424 and CVE-2025-11731.

This repo doesn't appear to use iterparse() or lxml.html cleaning directly based on a quick check, but taking the upgrade is still a reasonable, low-risk move. No objections to merging.

---

Generated by Claude Code