Skip to content

chore(deps):(deps): Bump xmlschema from 3.4.5 to 4.3.2 - #210

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/xmlschema-4.3.2
Closed

chore(deps):(deps): Bump xmlschema from 3.4.5 to 4.3.2#210
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/xmlschema-4.3.2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor

Bumps xmlschema from 3.4.5 to 4.3.2.

Release notes

Sourced from xmlschema's releases.

v4.3.2 (2026-06-30)

v4.3.1 (2026-01-17)

  • normalize_url(): workaround for issue #467 (UNC paths with Python < 3.12.5)
  • META_SCHEMA and BASE_SCHEMA paths converted to 'file' URL scheme
  • Clean optional dependencies

v4.3.0 (2026-01-06)

  • Add arguments validation for schemas and validation methods (by validation contexts)
  • Add custom XPath parser for find/findall/iterfind APIs on schemas for match singleton sequence also if position is a number greater than 1 in predicate expression (issue #468)
  • Improve build of XSD elements and groups, using a three-state built flag for components
  • Extend and fix memory tests (Python 3.14+ seems to consume more memory)
  • Drop support for Python 3.9 and add development support for Python 3.15

v4.2.0 (2025-10-14)

  • Add arguments validation for schemas and validation methods (by validation contexts)
  • Add SchemaSettings dataclass for storing read-only settings for schema instances and for managing package default settings
  • Add block argument to XMLResource class (issue #464)
  • Add MAX_SCHEMA_SOURCES package limit (1000, applied to XsdGlobals global maps instances)
  • Add MAX_XML_ELEMENTS package limit (1,000,000, applied to non-lazy XMLResource instances)
  • Reduce MAX_XML_DEPTH limit to 1000 and apply it to all XMLResource instances
  • Fix for substitute match in case of unexpected child (issue #461)

v4.1.0 (2025-06-05)

  • Add XPath selectors: ElementSelector and ElementPathSelectors
  • Add selector argument to XMLResource and iterparse filters
  • Fix element substitution (issue #452)
  • Restore v3.4.5 builder methods as helpers (issue #451)
  • Add overall_min_occurs and overall_max_occurs helpers to XsdElement (issue #449)
  • Extend error message for XML syntax errors (issue #448)
  • Fix query/fragment like for filenames (issue #447)

v4.0.1 (2025-04-13)

  • Fix XSD identity update with xsi:type substitution (issue #446)

v4.0.0 (2025-04-11)

  • Extend support of lxml.etree through iterparse optional argument
  • Rework internal decoding/encoding methods, replacing generators with normal functions
  • Replace kwargs with a validation context (DecodeContext and EncodeContext)
  • Add SchemaLoader class and variants (related to #419)
  • Slicing of XsdGlobals with parent maps
  • Fix XsdUnion validation performance issue (related to #442)
  • Drop support for Python 3.8
Changelog

Sourced from xmlschema's changelog.

v4.3.2_ (2026-06-30)

v4.3.1_ (2026-01-17)

  • normalize_url(): workaround for issue #467 (UNC paths with Python < 3.12.5)
  • META_SCHEMA and BASE_SCHEMA paths converted to 'file' URL scheme
  • Clean optional dependencies

v4.3.0_ (2026-01-03)

  • Add arguments validation for schemas and validation methods (by validation contexts)
  • Add custom XPath parser for find/findall/iterfind APIs on schemas for match singleton sequence also if position is a number greater than 1 in predicate expression (issue #468)
  • Improve build of XSD elements and groups, using a three-state built flag for components
  • Extend and fix memory tests (Python 3.14+ seems to consume more memory)
  • Drop support for Python 3.9 and add development support for Python 3.15

v4.2.0_ (2025-10-14)

  • Add arguments validation for schemas and validation methods (by validation contexts)
  • Add SchemaSettings dataclass for storing read-only settings for schema instances and for managing package default settings
  • Add block argument to XMLResource class (issue #464)
  • Add MAX_SCHEMA_SOURCES package limit (1000, applied to XsdGlobals global maps instances)
  • Add MAX_XML_ELEMENTS package limit (1,000,000, applied to non-lazy XMLResource instances)
  • Reduce MAX_XML_DEPTH limit to 1000 and apply it to all XMLResource instances
  • Fix for substitute match in case of unexpected child (issue #461)

v4.1.0_ (2025-06-05)

  • Add XPath selectors: ElementSelector and ElementPathSelectors
  • Add selector argument to XMLResource and iterparse filters
  • Fix element substitution (issue #452)
  • Restore v3.4.5 builder methods as helpers (issue #451)
  • Add overall_min_occurs and overall_max_occurs helpers to XsdElement (issue #449)
  • Extend error message for XML syntax errors (issue #448)
  • Fix query/fragment like for filenames (issue #447)

v4.0.1_ (2025-04-12)

  • Fix XSD identity update with xsi:type substitution (issue #446)

v4.0.0_ (2025-04-11)

  • Extend support of lxml.etree through iterparse optional argument

... (truncated)

Commits
  • 627c179 Merge PR #476 - Add Georgian language
  • b3bfc1d Bump bugfix release and update CI tests
  • de42603 Add contribution policy
  • 08e1c27 Fix for issues #474 and #475
  • c10df34 Fix for issue #473: use of 'fixed' with 'prohibited'
  • 8a4f3a1 Add test for issue #474
  • b1e2c5f Merge pull request #476 from EkaterinePapava/master
  • cfd594e po: Add Georgian language
  • 64b103f Add a test for meta-schema URLs and relax memory test for Python 3.14
  • 508d1a2 Update bugfix release information and clean deps of pyproject.toml
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 13, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Aug 13, 2026
@codecov

codecov Bot commented Aug 13, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (f6a8e77) to head (9b975ad).
⚠️ Report is 204 commits behind head on main.

Additional details and impacted files
@@             Coverage Diff             @@
##             main      #210      +/-   ##
===========================================
+ Coverage   98.27%   100.00%   +1.72%     
===========================================
  Files          28        79      +51     
  Lines         638      3854    +3216     
  Branches       87       467     +380     
===========================================
+ Hits          627      3854    +3227     
+ Misses          4         0       -4     
+ Partials        7         0       -7     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@dependabot
dependabot Bot force-pushed the dependabot/pip/xmlschema-4.3.2 branch 3 times, most recently from 32ee4da to ad6d8b7 Compare August 13, 2026 17:54
Bumps [xmlschema](https://github.com/sissaschool/xmlschema) from 3.4.5 to 4.3.2.
- [Release notes](https://github.com/sissaschool/xmlschema/releases)
- [Changelog](https://github.com/sissaschool/xmlschema/blob/master/CHANGELOG.rst)
- [Commits](sissaschool/xmlschema@v3.4.5...v4.3.2)

---
updated-dependencies:
- dependency-name: xmlschema
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/xmlschema-4.3.2 branch from ad6d8b7 to 168c28e Compare August 13, 2026 18:05
sebastienrousseau added a commit that referenced this pull request Aug 13, 2026
Consolidates four Dependabot pull requests that could not be merged
individually. Each rewrites poetry.lock, so merging any one of them made
the other three conflict — the queue never converged. They are applied
here as one manifest change and one lock regeneration.

    xmlschema   >=3.4.0,<4.0.0  ->  >=4.3.2,<5.0.0
    bandit      ^1.7.0          ->  ^1.9.4
    diff-cover  ^8.0.0          ->  ^10.5.0
    ruff        ^0.15.0         ->  ^0.16.2   (resolves 0.16.3)

xmlschema is a major bump and this project validates ISO 20022 messages
against XSDs, so it was checked beyond the suite passing: 6 of the 34
bundled schemas were loaded directly under 4.3.2, and the xml- and
validation-tagged tests were run as their own groups.

ruff 0.15 -> 0.16 can introduce new rules; `ruff check` and
`ruff format --check` were run at the exact resolved version rather
than assumed.

    pytest                  1468 passed, 9 skipped
    ruff check .            exit 0
    ruff format --check .   223 files already formatted
    poetry check --lock     exit 0

Authorship note: these could not be cherry-picked — every one conflicts
on the lock — so the manifest edits were reapplied by hand. Credit for
the bumps belongs to Dependabot (#210, #212, #213, #215).

Signed-off-by: Sebastien Rousseau <sebastian.rousseau@gmail.com>

Assisted-by: Claude:claude-opus-4-7
@sebastienrousseau

Copy link
Copy Markdown
Owner

Superseded by #220, which lands this together with the other three dependency bumps.

These could not be merged one at a time: each rewrites poetry.lock, so merging any one made the rest conflict and the queue never converged. #220 applies all four as a single manifest change plus one lock regeneration.

Because every one of them conflicts on the lock, the commits could not be cherry-picked and the manifest edits were reapplied by hand — the bump is yours, the mechanics are not.

@sebastienrousseau
sebastienrousseau deleted the dependabot/pip/xmlschema-4.3.2 branch August 13, 2026 19:22
@dependabot @github

dependabot Bot commented on behalf of github Aug 13, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant