From 1495ed9a51368a966a7cab3f03e9f3e0efa5ec32 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 16 Dec 2025 23:04:23 +0000 Subject: [PATCH] deps(vulnshop): bump lxml from 4.4.0 to 6.0.2 in /vulnerable-app Bumps [lxml](https://github.com/lxml/lxml) from 4.4.0 to 6.0.2. - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](https://github.com/lxml/lxml/compare/lxml-4.4.0...lxml-6.0.2) --- updated-dependencies: - dependency-name: lxml dependency-version: 6.0.2 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- vulnerable-app/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vulnerable-app/requirements.txt b/vulnerable-app/requirements.txt index 2a4d9ce..72838bb 100644 --- a/vulnerable-app/requirements.txt +++ b/vulnerable-app/requirements.txt @@ -76,7 +76,7 @@ cryptography==2.3 # lxml 4.4.0 has: # - CVE-2020-27783 (XSS via clean function) # - CVE-2021-28957 (XSS via HTML5 parser) -lxml==4.4.0 +lxml==6.0.2 # defusedxml is safe, but we're not using it properly defusedxml>=0.7.0