# What changed in lxml

> 15 changes in lxml 5 to 6 from its official release notes, upgrade guides and advisories: 6 breaking, 1 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/pypi/lxml/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## lxml 6

### Security

- lxml: Default configuration of iterparse() and ETCompatXMLParser() allows XXE to local files (6.1.0) — [security advisory](https://github.com/advisories/GHSA-VFMQ-68HX-4JFW)

## lxml 5

### Breaking changes

- The new element is inserted without moving existing tail text; each sibling's tail text stays with that element. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- The long-deprecated xslt_transform.apply() method was removed. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- The long-deprecated xpath.evaluate() method was removed. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- For documents parsed as HTML, element.find("part1:part2") now searches for the tag "part1:part2" instead of looking only for "part2". (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- External entities are no longer expanded by default; the new default is 'internal'. Set resolve_entities=True on a parser to enable the previous behavior. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- The long-deprecated parser.setElementClassLookup() method was removed. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)

### New APIs and options

- This module constant detects whether schema-file validation is available. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- Schema-file validation can be disabled with validate_schema=False; it is enabled by default if available and disabled otherwise. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)

### Performance

- Character escaping in C14N2 serialisation now uses a single pass over the text. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)

### Fixes and other changes

- TreeBuilder.close() no longer fails with a TypeError after parsing incorrect input. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- With with_tail=False, itertext() no longer returns the tail text of comments and processing instructions. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- A crash with recent libxml2 2.11.x versions was resolved. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- A compile problem with recent libxml2 2.12.x versions was resolved. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)
- Early support for Python 3.13a2 was added. (5.0.0) — [release notes](https://github.com/lxml/lxml/blob/HEAD/CHANGES.txt)