From 3567d5f05698e2b5b96f1be4040a85658bb27d65 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 24 Jul 2026 05:44:31 +0000 Subject: [PATCH] chore(deps): Update defusedxml requirement in /services/data Updates the requirements on [defusedxml](https://github.com/tiran/defusedxml) to permit the latest version. - [Release notes](https://github.com/tiran/defusedxml/releases) - [Changelog](https://github.com/tiran/defusedxml/blob/main/CHANGES.txt) - [Commits](https://github.com/tiran/defusedxml/compare/v0.7.0...v0.7.1) --- updated-dependencies: - dependency-name: defusedxml dependency-version: 0.7.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] --- services/data/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/services/data/requirements.txt b/services/data/requirements.txt index 3d5aab0d..10593a43 100644 --- a/services/data/requirements.txt +++ b/services/data/requirements.txt @@ -10,6 +10,6 @@ networkx>=3.0 # trimesh path traversal (section drawings) shapely>=2.1.2 # trimesh planar paths reportlab>=4.0 # PDF sheet composition pillow>=12.3.0 # reportlab's image dep — floor over 8 CVEs in 12.2.x (PYSEC-2026-2253..3453) -defusedxml>=0.7 # XXE-safe parser for untrusted P6 (PMXML) schedule uploads — schedule.py +defusedxml>=0.7.1 # XXE-safe parser for untrusted P6 (PMXML) schedule uploads — schedule.py # svglib (SVG→PNG for docs gallery) is a dev-only tool — it pulls pycairo/cairo and is not # needed at runtime (the API serves SVG directly). Install ad hoc when regenerating docs/img.