glpi-python-client 0.6.0__tar.gz → 0.6.1__tar.gz

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/CHANGELOG.md

@@ -4,6 +4,134 @@ All notable changes to this project are documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## 0.6.1 — 2026-10-02
+
+The reader now gives the same Markdown as `easyvista-python-client` 0.4.1,
+whose converter is this package's 0.6.0 converter plus fifteen fixes and a
+correction to one of them. This release ports those fixes and the
+correction, with their tests. The two conversion modules now differ only in
+names, error messages, docstrings and that package's optional-dependency
+import guard. The converter's writing (`to_transport`) is unchanged; a
+write model now sends a lone surrogate as U+FFFD.
+
+### Fixed
+
+- **Image alt text lost its escapes**: `a_b_c.png` read back as `abc.png`.
+  Escapes and character references in alt text are kept.
+- **A line opening with `~~~` became a code fence** that swallowed the rest
+  of the body. It reads as `\~~~`.
+- **A `!` right before a link turned the link into an image**
+  (`Attention!` then a link). It reads as `\!`.
+- **An image whose alt text starts with `^` stopped being an image** once
+  rendered, since cmark-gfm never opens one on `![^`. The `^` is escaped.
+- **`<<a@example.org>` became an autolink** behind an escaped `<`. The second
+  `<` is escaped too.
+- **A line break inside inline code showed as a literal backslash.**
+  `<code>`, `<kbd>` and `<samp>` holding a `<br>` become one span per line;
+  a `|` in `<kbd>` or `<samp>` in a table cell no longer splits the row.
+- **A table inside a heading or a link showed its pipes as text**, and
+  inside a link did not read back as itself. It is written as its cells'
+  text, as a table inside a cell already was.
+- **A block inside such a flattened table broke its holder's line.** It
+  stays on that line.
+- **Bold ending in punctuation at a flattened cell's edge came back as raw
+  `<strong>`**, which read back as `**`. It stays Markdown bold.
+- **Two `<center>` blocks ran together.** `<center>` is a block, as `<div>`
+  is, except inside `<pre>`.
+- **Underline, highlight and inserted text lost their formatting.** `<u>`,
+  `<mark>` and `<ins>` are kept as raw tags, as `<s>` already was. Round a
+  block (a table, a list, a heading, a quote, a code block, a rule or
+  paragraphs) the tag is dropped and the blocks read as 0.6.0 read them.
+  Markdown has no inline tag round blocks: `easyvista-python-client` 0.4.0,
+  which kept it, showed a table as pipe text and a list or a heading as its
+  Markdown source, and round a `<pre>` left a fence open to the end of the
+  body. Inside a table cell or a heading, whose blocks are one line, the tag
+  stays.
+- **A long ordered list was quadratic to read**: 5,000 items took 3.1 s,
+  and take 0.6 s now (CPython 3.12.3). An `<ol start>` such as `²` or `½`
+  counts from 1, as a browser counts a start holding no digit, instead of
+  failing the body.
+- **A run of spaces or line breaks at the edge of bold, italic or a link was
+  quadratic to read.** It is linear.
+- **A `colspan` or `start` markdownify cannot read as a number raised
+  `GlpiContentError`** from `.content` (`colspan="²"`, or 5,000 digits). The
+  body degrades to its text instead, every word kept. Any other
+  `ValueError` raised while converting takes the same path.
+- **A lone surrogate in a write model's Markdown failed the whole write**
+  with `GlpiContentError`: cmark-gfm renders UTF-8, which cannot encode
+  one. Each lone surrogate is written as U+FFFD instead, as CommonMark
+  replaces a NUL, and the rest of the body keeps its Markdown. Calling
+  `GlpiContentConverter.to_transport` directly still raises, as
+  `easyvista-python-client`'s converter does.
+- **A run of unfinished tags at the end of a body was quadratic to read** on
+  CPython before 3.11.14, 3.12.12 and 3.13.6 (CVE-2025-6069). Every `<`
+  after the body's last `>` is read as text, so `x <a b` at the very end
+  reads as `x \<a b` on every interpreter, where a patched one dropped it.
+
+### Changed
+
+- **`.content` changes once** for a body holding any shape above, so stored
+  digests of such bodies change once.
+- **Deeply nested HTML degrades to text sooner.** The reader spends one more
+  stack frame per level: from a shallow stack, the deepest `<div>` document
+  read with its structure went from about 490 levels to about 326 (CPython
+  3.12.3 and 3.13.14, default recursion limit). `<blockquote>` stays at
+  about 194. The words are kept either way.
+- **Dependency bounds** are now those of `easyvista-python-client[content]`
+  0.4.0, so the two packages resolve to the same libraries side by side:
+  `markdown-it-py>=3.0,<4` (the alt-text fix relies on 3.x's `text_special`
+  tokens, and `mdformat` 0.7.22 requires `<4` anyway),
+  `markdownify>=1.2.3,<1.3` and `mdformat-tables>=1.0,<1.1`.
+  `mdformat>=0.7.22,<0.8` is unchanged. The reader overrides private
+  surfaces of `markdownify` and `mdformat`; `pyproject.toml` gives the
+  reason for each bound.
+
+### Documentation
+
+- The user guide's rich-text section now says what each element becomes,
+  that neither direction sanitises, what survives a round trip, and the
+  known holes, all reproduced on 2026-10-02. Its claim that a read always
+  displays the same and reads back as itself is now stated as the aim it
+  is, as in the API reference and the module docstring.
+- The deep-nesting note gives the measured depths, and that a read started
+  within about 30 frames of the recursion limit can still raise.
+- `GlpiContentError`'s docstring named python-markdown as the writer; it is
+  cmark-gfm.
+- The `glpi-ticket-timeline`, `glpi-ticket-workflow` and
+  `glpi-knowledge-base` skills describe raw `<u>`, `<mark>`, `<ins>` and
+  `<s>`, the write-model rule exactly, and the new depth.
+- Corrected after review: a write model keeps the caller's Markdown
+  stripped at both ends, not verbatim; the `glpi-knowledge-base` and
+  `glpi-plugin-fields` skills no longer say a deep body never raises; any
+  `ValueError` degrades to text, not only a `colspan` or `start`; a
+  `start` counts as a browser counts it only when it holds no digit; and
+  the CVE-2025-6069 note says that everything after a body's last `>`,
+  an unterminated comment or a cut-short closing tag included, is shown.
+
+### Tests
+
+- `content/tests/test_fixes.py` pins each of the fifteen fixes; run against
+  0.6.0, 36 of the 54 tests first ported fail on CPython 3.12.3 and 37 on
+  3.13.14, the rest being controls and pins. Section 11 also pins the
+  correction to fix 11 with 42 tests, 40 of which fail on
+  `easyvista-python-client` 0.4.0's converter. Reverting any one fix alone fails at least
+  one test of the content suite on both.
+- `content/tests/test_properties.py` holds seeded generators to three
+  properties: a body displays what its HTML displayed, is a fixed point,
+  and keeps its words in order. Against 0.6.0 all 16 tests fail.
+- `content/tests/test_cost.py` replaces the 20-second budgets on long bodies
+  with growth tests, `time(4n) / time(n) < 8`, which a quadratic pass fails
+  at a few thousand items.
+- Four guards that no test caught are pinned, each by a test that fails
+  without it: a second `<` before a space keeps one escape, a header cell
+  escapes a `|` in `<kbd>` or `<samp>` and splits a line break in inline
+  code, a table inside an `<a>` without `href` stays a table, and an ordered
+  item numbered 10 or more indents its content by its bullet's width. A
+  count pins that the walk finding blocks inside `<u>`, `<mark>` and `<ins>`
+  checks each tag about once.
+- The display oracle treats a flattened cell's edge as a word boundary, as a
+  browser does, and reads `start` with `isdecimal`.
+
 ## 0.6.0 — 2026-10-01
 
 ### Changed (breaking)

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: glpi-python-client
-Version: 0.6.0
+Version: 0.6.1
 Summary: A typed Python client for GLPI ITSM APIs.
 Project-URL: Homepage, https://github.com/baraline/glpi_python_client
 Project-URL: Documentation, https://glpi-python-client.readthedocs.io/en/latest/
@@ -27,9 +27,9 @@ Requires-Dist: beautifulsoup4>=4.15
 Requires-Dist: cmarkgfm>=2025.10
 Requires-Dist: httpx>=0.28
 Requires-Dist: lxml>=4.9
-Requires-Dist: markdown-it-py>=3.0
-Requires-Dist: markdownify>=1.2
-Requires-Dist: mdformat-tables>=1.0
+Requires-Dist: markdown-it-py<4,>=3.0
+Requires-Dist: markdownify<1.3,>=1.2.3
+Requires-Dist: mdformat-tables<1.1,>=1.0
 Requires-Dist: mdformat<0.8,>=0.7.22
 Requires-Dist: pydantic>=2.8
 Requires-Dist: sniffio>=1.3

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/docs/api_reference.rst

@@ -115,17 +115,23 @@ its page being read.
 
 The Markdown is CommonMark with GFM tables, rendered by cmark-gfm. It
 spells a body's text as literal text -- ``\_\_init\_\_``, ``\\\serveur``,
-``\# pas un titre`` -- so rendering it displays what GLPI displayed and
-reading that back gives the same Markdown. A write model keeps the caller's
-Markdown verbatim unless it starts with an HTML tag. See
-:ref:`content-conversion`.
+``\# pas un titre`` -- so that rendering it displays what GLPI displayed and
+reading that back gives the same Markdown. That is the aim; the user guide
+lists the shapes where it falls short. Underline, highlight and struck text
+stay as raw ``<u>``, ``<mark>``, ``<ins>`` and ``<s>``. Neither direction
+sanitises: raw HTML and ``javascript:`` links pass through. A write model
+keeps the caller's Markdown as written, stripped at both ends, unless it
+starts with ``<`` and holds an HTML element, and sends a lone surrogate as
+U+FFFD. See :ref:`content-conversion`.
 
 Very deeply nested HTML is the case worth knowing about.
 ``markdownify`` walks the document recursively and runs out of stack at
 a few hundred levels of nesting. The converter attempts the conversion
 and, if the walk does not fit, reads the body's text instead, a line per
-block: the words survive, the structure does not. Anything else that goes
-wrong in either direction raises :class:`GlpiContentError`.
+block: the words survive, the structure does not. Any ``ValueError`` from
+the conversion degrades the same way: markdownify raises one for a
+``colspan`` or ``start`` it cannot read as a number. Anything else that
+goes wrong in either direction raises :class:`GlpiContentError`.
 
 Because the conversion is cached on first read, a read model should be
 treated as immutable afterwards: assigning to ``content_html``, or

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/docs/development.md

@@ -86,13 +86,17 @@ python -m pytest
   articles (`content` and `description`) and article revisions. It is
   wired into the models by `models/api_schema/_content.py`, eagerly on
   the write models and through a cached property on the read ones.
-  Inbound HTML too deep for `markdownify` to walk is tag-stripped
+  Inbound HTML too deep for `markdownify` to walk, or on which it
+  raises `ValueError` (a `colspan` or `start` it cannot read as a
+  number, among others), is tag-stripped
   rather than parsed. The depth is not predicted: the conversion is
   attempted and the `RecursionError` answered, because the budget is the
   caller's remaining stack and no bound computed in advance can know it.
-  The module docstring carries the derivation and the rejected
+  The 0.5.0 changelog entry carries the derivation and the rejected
   alternatives (`sys.setrecursionlimit`, and a thread with a larger
-  stack, which needs the same global). The prohibition is enforced by
+  stack, which needs the same global). The reader is kept identical, but
+  for names, messages, docstrings and an import guard, to
+  `easyvista-python-client`'s; change the two together. The prohibition is enforced by
   `testing/tests/test_raise_site_audit.py`, not just written down.
 - `glpi_python_client.testing` exposes `make_client` and
   `make_async_client` factories that produce in-memory clients with no

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/docs/installation.rst

@@ -6,7 +6,12 @@ Requirements
 
 ``glpi-python-client`` supports Python 3.11 and newer. Runtime dependencies are installed
 from the package metadata and include ``httpx``, ``tenacity``,
-``beautifulsoup4``, ``lxml``, and ``pydantic``.
+``beautifulsoup4``, ``lxml``, and ``pydantic``, plus the libraries the
+rich-text converter is built on: ``markdownify``, ``mdformat``,
+``mdformat-tables`` and ``markdown-it-py`` to read, and ``cmarkgfm`` to
+write. The reader overrides private surfaces of ``markdownify`` and
+``mdformat``, so those four carry upper bounds; ``pyproject.toml`` gives the
+reason for each.
 
 Install from PyPI
 -----------------

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/docs/user_guide.rst

@@ -1758,11 +1758,13 @@ The whole page is built in one pass, so a single unconvertible record used
 to make its page-mates unreadable too. The failure is now scoped to the
 record whose body you actually read.
 
-The Markdown is CommonMark with GFM tables. Rendering it -- as the package
-does on the way back to GLPI, with cmark-gfm -- displays what GLPI
-displayed, and reading that rendering back gives the same Markdown. Text in
-a body is literal: Markdown has one spelling for ``__init__`` typed by a
-user and for bold ``init``, so text that would read as syntax is escaped:
+The Markdown is CommonMark with GFM tables. The aim is that rendering it --
+as the package does on the way back to GLPI, with cmark-gfm -- displays what
+GLPI displayed, and that reading that rendering back gives the same
+Markdown. It is an aim, not a guarantee for every body: `What survives a
+round trip`_ lists where it falls short. Text in a body is literal: Markdown
+has one spelling for ``__init__`` typed by a user and for bold ``init``, so
+text that would read as syntax is escaped:
 
 .. code-block:: python
 
@@ -1781,28 +1783,106 @@ back as ``\`` and a newline, a nested list is indented by its bullet's width,
 and a table comes back unpadded. A body with no HTML element is plain text
 and is read as GLPI shows it, its lines as lines.
 
+More of what GLPI displays, and the Markdown it reads as:
+
+.. code-block:: text
+
+   GLPI displays                 Markdown
+   ----------------------------  ----------------------------
+   __init__                      \_\_init\_\_
+   *important*                   \*important\*
+   # 4521 (at a line start)      \# 4521
+   1. pas une liste              1\. pas une liste
+   - pas une liste               \- pas une liste
+   > pas une citation            \> pas une citation
+   [lien](x)                     \[lien\](x)
+   <Entrée>                      \<Entrée>
+   ~~~ (at a line start)         \~~~
+   Attention!  then a link       Attention\![lien](https://example.org)
+
+Text GLPI displays as markup is read back as that text, so ``&lt;b&gt;``
+reads as ``\<b>``, never as a live ``<b>``. What each kind of element
+becomes:
+
+* **Bold and italic** become ``**`` and ``*``, or raw ``<strong>`` and
+  ``<em>`` where CommonMark would not close the markers, for example bold
+  that ends in punctuation directly followed by a letter:
+  ``prix:<b>(10)</b>euros`` reads as ``prix:<strong>(10)</strong>euros``.
+* **Underline, highlight and inserted text** (``<u>``, ``<mark>``,
+  ``<ins>``) stay as those raw tags, and **struck text** (``<s>``,
+  ``<del>``, ``<strike>``) as a raw ``<s>``. CommonMark has no spelling for
+  any of them, and writing passes the tags through, so the formatting
+  survives. The cost is raw HTML in the Markdown. Markdown has no inline tag
+  round blocks, so a ``<u>``, ``<mark>`` or ``<ins>`` holding a table, a
+  list, a heading, a quote, a ``<pre>``, a rule or paragraphs is dropped and
+  its blocks kept; inside a table cell or a heading, which hold one line, it
+  stays.
+* **Links** become ``[text](https://... "title")``, and a link whose text is
+  its own URL, a pasted link, becomes the autolink ``<https://...>``. No
+  link target is filtered, ``javascript:`` included (see `It is not a
+  sanitiser`_). An **image** becomes ``![alt](src "title")``, its alt text
+  escaped like any other text.
+* **Lists** nest and keep their numbers, including an ``<ol start>``. A
+  ``start`` that is not a decimal number counts from 1, as a browser counts
+  one holding no digit, such as ``²``; a browser reads ``" 3"``, ``"+3"``
+  or ``"3abc"`` as 3. **Tables** become GFM tables, and a ``<br>`` inside a cell
+  stays a raw ``<br>``, since a GFM cell is one line. A table inside a cell,
+  a heading or a link is written as its cells' text, spaced apart.
+* **Preformatted blocks** become fences that keep the ``language-`` class
+  cmark-gfm writes, with a fence longer than any run of backticks in the
+  code. **Inline code** holding a line break becomes one code span per line.
+* ``<div>`` and ``<center>`` are blocks. ``<head>``, ``<script>``,
+  ``<style>``, ``<template>`` and ``<title>`` are dropped, as a browser does
+  not display them. Styling such as ``<font>`` colours or ``<span style>``
+  keeps its text and loses the style.
+
 Writing, your Markdown is rendered by cmark-gfm. A newline is a line break,
 GFM tables work, and raw HTML passes through, so put a placeholder such as
-``<login>`` in backticks. A write model keeps your Markdown verbatim unless
-it starts with an HTML tag, in which case it is read as HTML. A Markdown
-table needs a header row, so a header-less HTML table reads back with an
-empty one, and struck-through text stays as raw ``<s>``.
+``<login>`` in backticks. A write model keeps your Markdown as written,
+stripped at both ends, unless it starts with ``<`` and holds an HTML
+element anywhere, in which case it is read as HTML. Stripping unindents the
+first line of a body that opens with an indented code block, which then
+reads as a paragraph, so open such a body with a fence. Read as HTML,
+Markdown that opens with an autolink and carries an inline ``<br>`` further
+on loses that autolink, so start such a value with something else. A
+Markdown table needs a header row, so a header-less HTML table reads back
+with an empty one, and struck-through text stays as raw ``<s>``. A lone
+UTF-16 surrogate in a write model's Markdown, which UTF-8 cannot encode, is
+sent as U+FFFD; ``GlpiContentConverter.to_transport`` called directly raises
+on one.
 
 .. note::
 
    Deeply nested HTML is the case worth knowing about. The HTML-to-Markdown
-   converter walks the document recursively and exhausts the interpreter's
-   stack at around 494 levels of nesting. ``.content`` does not try to
-   predict that -- it attempts the conversion and, when the walk does not
-   fit, strips the tags instead. **It degrades, it never truncates, and it
-   does not raise**: every character the normal rendering would have
-   produced still appears, so a body never says less because of how deeply
-   it happened to nest. What you lose is structure,
-   not words — link targets and image alt text, code-block fencing and
-   ``<pre>`` indentation, and ``&nbsp;``-padded alignment. Anything else
-   that goes wrong raises
+   converter walks the document recursively, so a deeply nested body can
+   exhaust the interpreter's stack. From a shallow stack, the deepest
+   ``<div>`` document that still converts with its structure is about 326
+   levels, and the deepest ``<blockquote>`` one about 194 (measured
+   2026-10-02 on CPython 3.12.3 and 3.13.14 with the default recursion
+   limit; 0.6.0 reached about 490 ``<div>`` levels, and 0.6.1's reader
+   spends one more frame per level). ``.content`` does not try to predict
+   that -- it attempts the conversion and, when the walk does not fit,
+   strips the tags instead. **It degrades and never truncates**: every
+   character the normal rendering would have produced still appears, so a
+   body never says less because of how deeply it happened to nest. What you
+   lose is structure, not words — link targets and image alt text,
+   code-block fencing and ``<pre>`` indentation, and ``&nbsp;``-padded
+   alignment. Any ``ValueError`` from the conversion takes the same path:
+   markdownify raises one for a ``colspan`` or ``start`` it cannot read as
+   a number, such as a ``colspan`` of ``"²"`` or a value of 5,000 digits.
+   So does a document ``html.parser`` refuses outright. Anything else that
+   goes wrong raises
    :class:`~glpi_python_client.GlpiContentError`.
 
+   Because the budget is whatever stack is left when the call starts, the
+   same body can convert from one call site and degrade from a deeper one,
+   and a caller already close to the recursion limit can get an error after
+   all. Measured 2026-10-02 with the default limit of 1000: an ordinary body
+   converted when read from up to about 969 frames deep and degraded to text
+   from about 970. From about 975 frames it raised
+   :class:`~glpi_python_client.GlpiContentError`, and from about 994 a bare
+   :class:`RecursionError` escaped.
+
    Because the result is cached on first read, treat a read model as
    immutable afterwards. Assigning to ``content_html`` -- or
    ``model_copy(update={"content_html": ...})`` -- leaves the cached
@@ -1815,6 +1895,138 @@ emits ``content_html`` holding HTML where it used to emit ``content``
 holding Markdown. Pass ``by_alias=True`` for a dump keyed the way GLPI
 keys it.
 
+**CVE-2025-6069.** CPython's ``html.parser`` before 3.11.14, 3.12.12 and
+3.13.6 takes quadratic time on some unfinished markup
+(`python/cpython#135462 <https://github.com/python/cpython/issues/135462>`_).
+Many unfinished tags after a body's last ``>`` is the shape that reaches the
+converter, and a body is outside data, so reading spells every ``<`` after
+the last ``>`` as ``&lt;`` before parsing: no ``<`` there can finish a tag.
+As a side effect, whatever follows the body's last ``>`` reads as text on
+every interpreter, where a patched CPython drops some of it: an unfinished
+tag at the very end, ``x <a``, reads as ``x \<a``; an unterminated
+comment, ``<!-- note``, as ``\<!-- note``; and a closing tag cut short
+inside a link, ``<a href="...">lien</a``, leaves ``\</a`` in the link's
+text.
+Prefer a patched interpreter anyway: the guard covers the converter's input,
+and the CPython fix covers the parser itself.
+
+It is not a sanitiser
+^^^^^^^^^^^^^^^^^^^^^
+
+Spelling literal text as text is not sanitising. Neither direction
+neutralises anything, by design: the Markdown is the caller's own, and
+cmark-gfm runs with its ``UNSAFE`` option, which is what lets ``<u>`` or a
+``<br>`` in a table cell through. So:
+
+* raw HTML in the Markdown is rendered verbatim, and
+  ``<script>alert(1)</script>`` goes out as a live ``<script>``;
+* a ``javascript:`` link target is rendered as a live ``href``;
+* ``<javascript:alert(1)>`` is a CommonMark autolink, which accepts any
+  scheme, so it too goes out as a live ``href``.
+
+Reading does not filter either: a body's ``javascript:`` link reads back as
+a ``javascript:`` link. What reading does guarantee is that text a body
+*displays* stays text: ``&lt;script&gt;`` reads back as ``\<script>``, and is
+written back as the same ``&lt;script&gt;``.
+
+A caller relaying Markdown it did not write must neutralise raw HTML and
+executable link schemes before writing it. A sync between two ITSMs is one
+such caller.
+
+What survives a round trip
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+**Markdown written and read back.** Paragraphs, ``*emphasis*`` and
+``**strong**``, ATX headings, nested lists, numbered lists, block quotes,
+fences with their language, links with titles, autolinks, raw ``<u>`` and
+``<s>`` spans, accents and escaped literal text all come back as they were
+written. Other spellings come back in mdformat's canonical form, and display
+the same:
+
+* ``_em_`` and ``__strong__`` as ``*em*`` and ``**strong**``;
+* ``+`` and ``*`` bullets as ``-``, ``1)`` as ``1.``, and repeated ``1.``
+  items numbered ``1.``, ``2.``, ``3.``;
+* a setext heading as an ATX one, and ``***`` as ``---``;
+* a table's delimiter row as ``| -- |``;
+* a lone newline, or two trailing spaces, as a backslash hard break;
+* a link target holding parentheses wrapped in ``<...>``;
+* runs of blank lines as one, and a character reference such as ``&copy;``
+  as the character.
+
+A few things do not come back:
+
+* text in angle brackets that is not a URL, ``use the <Enter> key``, is sent
+  as a live unknown tag, and the browser and the reader both drop it;
+* an e-mail autolink comes back as an inline ``mailto:`` link;
+* a ``[`` or ``]`` in a link target comes back percent-encoded, as ``%5B``
+  and ``%5D``;
+* a no-break space or hard break at the end of a paragraph is dropped;
+* a line holding only ``*`` is an empty list item in CommonMark, and reads
+  back as nothing.
+
+After that first cycle, a further one changes nothing more, with two
+exceptions found with generated Markdown (2026-10-02, 23 of 4,500 bodies):
+two adjacent lists with different bullets read as one loose list, then as
+one tight list; and a fence whose info string holds a character reference,
+such as ``&amp;amp;``, loses one level of it on each cycle.
+
+**A body read, written back and read again.** This direction is held to
+more. The aim is that what the Markdown displays is what GLPI displayed, and
+that the Markdown is a fixed point from the first read. The converter's
+tests check both, by comparing what the HTML and the rendered Markdown
+display, on realistic and generated bodies. It is an aim, not a guarantee
+for every body.
+
+A few structures have no Markdown spelling. They keep their words and lose
+only their shape:
+
+* **a table nested in a table** has its grid flattened: each inner cell
+  becomes text in the outer cell, spaced apart, with every word kept and in
+  order. E-mail signatures and notification templates are often laid out
+  so. A table inside a heading or a link is flattened the same way;
+* **a table without a header row** gains an empty one, because GFM requires
+  a header;
+* a table cell holds one line, so the paragraphs inside a cell join, while a
+  ``<br>`` in a cell is kept as a raw ``<br>``;
+* a heading holds one line, so a ``<br>`` in a heading becomes a space;
+* trailing spaces at the end of a ``<pre>`` are dropped;
+* underline, highlight, insertion and strike are kept only as raw ``<u>``,
+  ``<mark>``, ``<ins>`` and ``<s>``, so a renderer that drops raw HTML shows
+  their text without the formatting;
+* two code spans with nothing between them become one span, which shows the
+  two backticks that joined them.
+
+**Known holes.** These shapes lose words, or display other than GLPI did.
+Each was found with synthetic input and reproduced on 2026-10-02:
+
+* a table row with more cells than the table's first row loses the extra
+  cells, with their words, at the first read;
+* a ``|`` inside a ``<pre>``, a link target or a title in a table cell
+  splits the row: the rest of the cell is lost or shows as Markdown source;
+* a ``<caption>`` or ``<colgroup>`` directly inside a ``<table>``, with no
+  ``<tbody>``, turns the table into lines of literal pipes;
+* an image whose title holds a ``"`` is lost, and shows as its Markdown
+  source;
+* a list or an ``<hr>`` inside a table cell shows as ``-`` or ``---`` text;
+* a heading followed by text in the same cell, or text sitting directly in
+  a nested table after its rows, runs into the next word (``titresuite``);
+* a table whose ``<td>`` and ``<tr>`` are never closed folds into one cell,
+  keeping its words;
+* a definition list (``<dl>``) reads as a ``term`` line and a
+  ``: definition`` line, so its display gains the colon;
+* bold, italic or struck text (``<b>``, ``<em>``, ``<s>`` and their
+  synonyms) wrapped round blocks, other than a single paragraph, shows its
+  markers or its tag as text, and a list, a table or a heading inside it as
+  Markdown source; round a ``<pre>`` it leaves a fence open, so the rest of
+  the body shows as code. 0.6.0 read these the same way.
+
+Some shapes are not fixed points at the first read, and settle after one
+more cycle. Adjacent lists read as one loose list, then as one tight list. A
+definition list's newline becomes a hard break. Bold inside bold
+(``<b><b>gras</b></b>``) reads as ``****gras****``, then as ``**gras**``. A
+link or image title loses a backslash before punctuation. The caption,
+colgroup and image-title shapes above settle too, on what they already lost.
+
 Retry behaviour
 ~~~~~~~~~~~~~~~
 

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/glpi_python_client/__init__.py

@@ -131,7 +131,7 @@ from glpi_python_client.rsql import (
     date_window,
 )
 
-__version__ = "0.6.0"
+__version__ = "0.6.1"
 
 __all__ = [
     "AsyncGlpiClient",

{glpi_python_client-0.6.0 → glpi_python_client-0.6.1}/glpi_python_client/_errors.py

@@ -149,8 +149,8 @@ class GlpiContentError(GlpiError):
 
     This exists so that no failure of the content layer escapes the
     package's taxonomy. The conversion runs third-party parsers
-    (``markdownify`` inbound, ``markdown`` outbound), and a parser fault
-    used to reach the caller as a bare builtin — most visibly a
+    (``markdownify`` and ``mdformat`` inbound, ``cmark-gfm`` outbound), and a
+    parser fault used to reach the caller as a bare builtin — most visibly a
     ``RecursionError``, which ``except GlpiError`` does not catch and which
     a caller reading a ticket has no reason to expect from
     ``get_ticket``. Deeply nested HTML is caught and answered with the