pypi / lxml
lxml
What changed in lxml 5 to 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-24.
6 breaking1 security2 new APIs and options1 performance5 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initlxml 61 changes
Security 1
lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files
lxml 514 changes
Breaking changes 6
The new element is inserted without moving existing tail text; each sibling's tail text stays with that element.
The long-deprecated xslt_transform.apply() method was removed.
The long-deprecated xpath.evaluate() method was removed.
For documents parsed as HTML, element.find("part1:part2") now searches for the tag "part1:part2" instead of looking only for "part2".
External entities are no longer expanded by default; the new default is 'internal'. Set resolve_entities=True on a parser to enable the previous behavior.
The long-deprecated parser.setElementClassLookup() method was removed.
New APIs and options 2
This module constant detects whether schema-file validation is available.
Schema-file validation can be disabled with validate_schema=False; it is enabled by default if available and disabled otherwise.
Performance 1
Character escaping in C14N2 serialisation now uses a single pass over the text.
Fixes and other changes 5
TreeBuilder.close() no longer fails with a TypeError after parsing incorrect input.
With with_tail=False, itertext() no longer returns the tail text of comments and processing instructions.
A crash with recent libxml2 2.11.x versions was resolved.
A compile problem with recent libxml2 2.12.x versions was resolved.
Early support for Python 3.13a2 was added.