# What changed in xmlsec

> 13 changes in xmlsec 1 from its official release notes, upgrade guides and advisories: 8 breaking, 1 security, 2 new APIs and options. Each one cited. Sources checked 2026-10-29. HTML: https://unstale.sh/pypi/xmlsec/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## xmlsec 1

### Breaking changes

- External URIs are rejected for CipherReference decryption and KeyInfo RetrievalMethod and KeyInfoReference processing; there is no setting to widen this. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- The default EncryptedKey nesting limit of 1 now also counts DerivedKey, AgreementMethod, and EncapsulationMechanism. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- Iteration counts above 1,000,000 are rejected. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- Python 3.10 is now the minimum supported version; Python 3.9 support is dropped. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- Signing and verification now allow only empty and same-document reference URIs by default; other URIs raise xmlsec.Error. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- Handling bugs were fixed, so OOXML / OPC signature digests can differ from those produced by older versions. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- Shutdown is process-final; calling xmlsec.init() afterward in the same process is no longer supported. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- All binary wheels now bundle xmlsec1 1.3.13 and follow its stricter defaults and other backward-incompatible behavior changes. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)

### Security

- A padding length of zero is now rejected as invalid padding. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)

### New APIs and options

- Adds a property for enabling selected reference URI types when signing or verifying. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- Adds a constant for configuring which reference URI types are enabled. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)

### Fixes and other changes

- New binary wheels are provided for Python 3.15. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)
- Fixes template.create() raising SystemError because of a wrong argument parser signature. (1.3.18) — [release notes](https://github.com/xmlsec/python-xmlsec/releases/tag/1.3.18)