chore(deps): update lxml requirement from >=6.1.1 to >=6.1.3

[dependabot]

Updates the requirements on lxml to permit the latest version.

Changelog

Sourced from lxml's changelog.

6.1.3 (2026-09-02)

Bugs fixed

• LP#2165901: External parameter entity parsing was allowed by default (with resolve_entities="internal"). Issue found by Tomer Fichman.

6.1.2 (2026-08-18)

• GH#526: Some build files were missing in the sdist. Patch by Nicola Soranzo.

• Some minor corrections for error handling cases.

Other changes

• Built with Cython 3.2.9.

6.1.1 (2026-05-18)

Bugs fixed

• The known link attributes in lxml.html.defs.link_attrs were missing xlink:href, which can be used for URL bypass attacks in embedded SVG/MathML/etc. content. GHSA-4jhm-jv67-739f

• The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.

• The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

• GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes

... (truncated)

Commits

• 3c1a4c7 Prepare release of 6.1.3.
• c1191fc Update changelog.
• 03ec312 Disable parameter entity parsing when internal-only entity parsing is requested.
• 11d03e9 Build: Prevent duplicate Py3.8 wheel builds.
• 9efc586 Build: Exclude musllinux-ARM from Py3.8 wheel building to prevent slow emulat...
• 9716fb1 Build: Include older PyPy versions.
• 0f3327d Build: Exclude Win-Aarch64 from wheel build.
• 6967c96 Build: Make all built wheels downloadable even if they don't pass the release...
• 061218d Build: Exclude Py3.15 i686 wheels from validation (because they are intention...
• ce9fe0d Build: Fix Py3.8 windows build.
• Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[cloudflare-workers-and-pages]

Deploying pdfapps with    Cloudflare Pages

Latest commit:	4aea864
Status:	✅  Deploy successful!
Preview URL:	https://71c23255.pdfapps.pages.dev
Branch Preview URL:	https://dependabot-pip-lxml-gte-6-1.pdfapps.pages.dev

View logs

[github-actions]

Python dependencies security check

pip-audit: requirements.txt

No known vulnerabilities.

pip-audit: flatpak/requirements-pinned.txt

No known vulnerabilities.

Outdated check (informational)

Package	Pin	Latest on PyPI	Status
PySide6	PySide6>=6.11.1	6.12.0	outdated
pypdf	pypdf>=6.19.0	6.20.0	outdated
cryptography	cryptography>=50.0.1	50.0.2	outdated
qtawesome	qtawesome>=1.4.2	1.4.2	up-to-date
pillow	pillow>=12.3.0	12.3.0	up-to-date
pymupdf	pymupdf>=1.28.0	1.28.2	outdated
pytesseract	pytesseract>=0.3.13	0.3.13	up-to-date
python-docx	python-docx>=1.2.0	1.2.0	up-to-date
python-pptx	python-pptx>=1.0.2	1.0.2	up-to-date
openpyxl	openpyxl>=3.1.5	3.1.5	up-to-date
beautifulsoup4	beautifulsoup4>=4.15.0	4.15.0	up-to-date
ebooklib	ebooklib>=0.20	0.20	up-to-date
lxml	lxml>=6.1.3	6.1.3	up-to-date
urllib3	urllib3>=2.8.0	2.8.0	up-to-date
idna	idna>=3.18	3.20	outdated
pyinstaller	pyinstaller>=6.22.3	6.22.3	up-to-date

Auto-generated by security-deps workflow. Merge is blocked only when pip-audit --strict reports vulnerabilities.

[nelsonduarte]

@dependabot rebase