unstale

pypi / xmlsec

xmlsec

What changed in xmlsec 1, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-29.

8 breaking1 security2 new APIs and options2 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.9 on npm

xmlsec 113 changes

Breaking changes 8

  • External URIs are rejected for CipherReference decryption and KeyInfo RetrievalMethod and KeyInfoReference processing; there is no setting to widen this.

    1.3.18release notes

  • The default EncryptedKey nesting limit of 1 now also counts DerivedKey, AgreementMethod, and EncapsulationMechanism.

    1.3.18release notes

  • Iteration counts above 1,000,000 are rejected.

    1.3.18release notes

  • Python 3.10 is now the minimum supported version; Python 3.9 support is dropped.

    1.3.18release notes

  • Signing and verification now allow only empty and same-document reference URIs by default; other URIs raise xmlsec.Error.

    1.3.18release notes

  • Handling bugs were fixed, so OOXML / OPC signature digests can differ from those produced by older versions.

    1.3.18release notes

  • Shutdown is process-final; calling xmlsec.init() afterward in the same process is no longer supported.

    1.3.18release notes

  • All binary wheels now bundle xmlsec1 1.3.13 and follow its stricter defaults and other backward-incompatible behavior changes.

    1.3.18release notes

Security 1

  • A padding length of zero is now rejected as invalid padding.

    1.3.18release notes

New APIs and options 2

  • Adds a property for enabling selected reference URI types when signing or verifying.

    1.3.18release notes

  • Adds a constant for configuring which reference URI types are enabled.

    1.3.18release notes

Fixes and other changes 2

  • New binary wheels are provided for Python 3.15.

    1.3.18release notes

  • Fixes template.create() raising SystemError because of a wrong argument parser signature.

    1.3.18release notes