CVS commit: pkgsrc/textproc/py-lxml

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue May 19 04:53:58 UTC 2026

Modified Files:
        pkgsrc/textproc/py-lxml: Makefile distinfo

Log Message:
py-lxml: updated to 6.1.1

6.1.1 (2026-05-18)

Bugs fixed

* The known link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``,
  which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
  https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f

* The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.

* The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.


To generate a diff of this commit:
cvs rdiff -u -r1.129 -r1.130 pkgsrc/textproc/py-lxml/Makefile
cvs rdiff -u -r1.85 -r1.86 pkgsrc/textproc/py-lxml/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/py-lxml/Makefile
diff -u pkgsrc/textproc/py-lxml/Makefile:1.129 pkgsrc/textproc/py-lxml/Makefile:1.130
--- pkgsrc/textproc/py-lxml/Makefile:1.129      Sun Apr 19 17:17:41 2026
+++ pkgsrc/textproc/py-lxml/Makefile    Tue May 19 04:53:58 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.129 2026/04/19 17:17:41 wiz Exp $
+# $NetBSD: Makefile,v 1.130 2026/05/19 04:53:58 adam Exp $
 
-DISTNAME=      lxml-6.1.0
+DISTNAME=      lxml-6.1.1
 PKGNAME=       ${PYPKGPREFIX}-${DISTNAME}
 CATEGORIES=    textproc python
 MASTER_SITES=  ${MASTER_SITE_PYPI:=l/lxml/}

Index: pkgsrc/textproc/py-lxml/distinfo
diff -u pkgsrc/textproc/py-lxml/distinfo:1.85 pkgsrc/textproc/py-lxml/distinfo:1.86
--- pkgsrc/textproc/py-lxml/distinfo:1.85       Sun Apr 19 17:17:41 2026
+++ pkgsrc/textproc/py-lxml/distinfo    Tue May 19 04:53:58 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.85 2026/04/19 17:17:41 wiz Exp $
+$NetBSD: distinfo,v 1.86 2026/05/19 04:53:58 adam Exp $
 
-BLAKE2s (lxml-6.1.0.tar.gz) = e0657a5563550cd53f109fafdf1f6810613bab22d42e3c30cb0dd09a02bd6325
-SHA512 (lxml-6.1.0.tar.gz) = 1226453e909ba1d455a3f0e6ebb33cc5b7309ea678b423768ebc0a7ea9e6e4993d17acbed6945cc0c90f1f52f70e4968934812f7c5b6ceaf6d63bf32ca53bd33
-Size (lxml-6.1.0.tar.gz) = 4197006 bytes
+BLAKE2s (lxml-6.1.1.tar.gz) = 36c52607308157d2d36b62befb7c206b4278f5791321b36c7883a827fab0bb92
+SHA512 (lxml-6.1.1.tar.gz) = 972956629ce8fca885fd2261e7d46d0954f851ab14557de2706cec8a68ac7f612052b0c9ec64477aecc9284d769bf3958d688c58beea876f311acc0c6d59ab8a
+Size (lxml-6.1.1.tar.gz) = 4197430 bytes
 SHA1 (patch-setupinfo.py) = 43ac54758b37c79329a4dabae1c3240661193885