Bump lxml from 5.3.0 to 6.1.0 in /requirements

[dependabot]

Bumps lxml from 5.3.0 to 6.1.0.

Release notes

Sourced from lxml's releases.

lxml-6.1.0

No release notes provided.

lxml-6.0.4

No release notes provided.

lxml-6.0.3

No release notes provided.

lxml-6.0.2

No release notes provided.

lxml-6.0.1

No release notes provided.

lxml-6.0.0

No release notes provided.

lxml-5.4.0

5.4.0 (2025-04-22)

Bugs fixed

• LP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs. (Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.) Issue found by Anatoly Katyushin, see https://bugs.launchpad.net/lxml/+bug/2107279

lxml-5.3.2

No release notes provided.

lxml-5.3.1

No release notes provided.

Changelog

Sourced from lxml's changelog.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

• GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

• The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

• LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE) when using these parsers without setting this option explicitly. The default was now changed to 'internal' only (as for the normal XML and HTML parsers since lxml 5.0). Issue found by Sihao Qiu as CVE-2026-41066.

6.0.4 (2026-04-12)

Bugs fixed

• LP#2148019: Spurious MemoryError during namespace cleanup.

6.0.3 (2026-04-09)

Bugs fixed

• Several out of memory error cases now raise MemoryError that were not handled before.

• Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

• LP#2125399: Some failing tests were fixed or disabled in PyPy.

• LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

... (truncated)

Commits

• 43722f4 Update changelog.
• 8747040 Name version of option change in docstring.
• 6c36e6c Fix pypistats URL in download statistics script.
• c7d76d6 Change security policy to point to Github security advisories.
• 378ccf8 Update project income report.
• 315270b Docs: Reduce TOC depth of package pages and move module contents first.
• 6dbba7f Docs: Show current year in copyright line.
• e4385bf Update project income report.
• 5bed1e1 Validate file hashes in release download script.
• c13ee10 Prepare release of 6.1.0.
• Additional commits viewable in compare view

[entelligence-ai-pr-reviews]

EntelligenceAI PR Summary

This PR updates the lxml dependency in the knowledge base requirements to its latest major release 6.1.0.

• Bumped lxml from 5.3.0 to 6.1.0 in requirements/requirements-kb.txt
• Major version increment may include breaking changes requiring compatibility validation
• Brings potential security fixes, performance improvements, and new features from the lxml 6.x release line

---

Confidence Score: 3/5 - Review Recommended

Likely safe but review recommended — this PR bumps lxml from 5.3.0 to 6.1.0 in requirements/requirements-kb.txt, which is a major version increment that warrants compatibility validation before merging. The change itself is a single-line dependency update and no review comments were raised, but major version bumps in parsing/XML libraries like lxml can introduce breaking API changes, removed deprecated features, or altered behavior in edge cases that could silently affect knowledge base processing. Before merging, the team should verify that all code paths consuming lxml in the knowledge base module have been tested against the 6.x release line, particularly any usage of deprecated APIs removed in 6.0.

Key Findings:

• Major version jump from 5.3.0 to 6.1.0 in lxml may include breaking changes — lxml 6.x dropped Python 2 remnants, changed some internal APIs, and altered behavior for malformed XML handling, any of which could affect knowledge base parsing logic without raising obvious errors.
• No automated test coverage evidence is visible for the knowledge base requirements path, meaning regressions in XML/HTML parsing behavior (e.g., namespace handling, entity resolution, XPath compatibility) might not be caught until runtime.
• The PR correctly scopes the change to only requirements/requirements-kb.txt rather than a global requirements file, which limits blast radius, but also means the isolated dependency could diverge from other parts of the codebase that may pin to a different lxml version.
• No security advisories or CVEs appear to be the driver for this upgrade based on the summary, so the urgency is low — this gives sufficient time to validate compatibility thoroughly before merging.

Files requiring special attention

• requirements/requirements-kb.txt