[fonttools/fonttools] b282ed: [misc.etree] don't resolve entities on lxml >= 5.0...

[Cosimo Lupo]

Branch: refs/heads/etree-no-param-entities
Home: https://github.com/fonttools/fonttools
Commit: b282ed9626d1baddb74fbed4a32136fb51a3e4ac
https://github.com/fonttools/fonttools/commit/b282ed9626d1baddb74fbed4a32136fb51a3e4ac
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-09-18 (Fri, 18 Sep 2026)

Changed paths:
M Lib/fontTools/misc/etree.py
M Tests/misc/etree_test.py

Log Message:
-----------
[misc.etree] don't resolve entities on lxml >= 5.0 either

lxml 5.0 to 6.1.2 still fetch external parameter entities with the default
resolve_entities="internal", so an external DTD fragment can declare a general
entity holding the contents of a local file. Drop the LXML_VERSION guard and
always default to resolve_entities=False; lxml 6.1.3 fixed the parameter entity
case upstream, but we support older versions.



To unsubscribe from these emails, change your notification settings at https://github.com/fonttools/fonttools/settings/notifications

[Cosimo Lupo]

Branch: refs/heads/main

Home: https://github.com/fonttools/fonttools
Commit: b282ed9626d1baddb74fbed4a32136fb51a3e4ac
https://github.com/fonttools/fonttools/commit/b282ed9626d1baddb74fbed4a32136fb51a3e4ac
Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-09-18 (Fri, 18 Sep 2026)

Changed paths:
M Lib/fontTools/misc/etree.py
M Tests/misc/etree_test.py

Log Message:
-----------
[misc.etree] don't resolve entities on lxml >= 5.0 either

lxml 5.0 to 6.1.2 still fetch external parameter entities with the default
resolve_entities="internal", so an external DTD fragment can declare a general
entity holding the contents of a local file. Drop the LXML_VERSION guard and
always default to resolve_entities=False; lxml 6.1.3 fixed the parameter entity
case upstream, but we support older versions.

Commit: 1c02fb7394d385ae7a5d9d2309169c728d5aa4ff
https://github.com/fonttools/fonttools/commit/1c02fb7394d385ae7a5d9d2309169c728d5aa4ff

Author: Cosimo Lupo <cos...@anthrotype.com>
Date: 2026-09-18 (Fri, 18 Sep 2026)

Changed paths:
M Lib/fontTools/misc/etree.py
M Tests/misc/etree_test.py

Log Message:
-----------

Merge pull request #4195 from fonttools/etree-no-param-entities

[misc.etree] don't rely on lxml's resolve_entities="internal"


Compare: https://github.com/fonttools/fonttools/compare/d1963634e5b3...1c02fb7394d3