json2xml 6.5.0__tar.gz → 7.0.0__tar.gz

{json2xml-6.5.0 → json2xml-7.0.0}/CONTRIBUTING.rst

@@ -80,8 +80,7 @@ Ready to contribute? Here's how to set up `json2xml` for local development.
     $ cd json2xml/
     $ uv venv
     $ source .venv/bin/activate
-    $ uv pip install -r requirements-dev.txt
-    $ uv pip install -e .
+    $ uv pip install -e ".[dev]"
 
 4. Create a branch for local development::
 
@@ -96,7 +95,7 @@ Ready to contribute? Here's how to set up `json2xml` for local development.
     
     # Or individually:
     $ ruff check json2xml tests
-    $ mypy json2xml tests
+    $ uvx ty check json2xml tests
     $ pytest tests/
 
 6. Commit your changes and push your branch to GitHub::
@@ -140,7 +139,7 @@ Install Rust and maturin::
 
 ::
 
-    $ python benchmark_rust.py
+    $ python benchmarks/benchmark_rust.py
 
 **Rust Code Structure**
 
@@ -182,12 +181,9 @@ To run a subset of tests::
 Deploying
 ---------
 
-A reminder for the maintainers on how to deploy.
-Make sure all your changes are committed (including an entry in HISTORY.rst).
-Then run::
-
-Update the version in pyproject.toml and json2xml/__init__.py
-$ git push
-$ git push --tags
+A reminder for maintainers on how to deploy:
 
-Travis will then deploy to PyPI if tests pass.
+#. Update the version in ``pyproject.toml`` and ``json2xml/__init__.py``.
+#. Add the release notes to ``HISTORY.rst``.
+#. Run ``make test-all`` and ``make dist``.
+#. Publish the verified artifacts with ``uv publish dist/*``.

{json2xml-6.5.0 → json2xml-7.0.0}/HISTORY.rst

@@ -1,4 +1,36 @@
 
+7.0.0 / 2026-08-23
+==================
+
+  * breaking: make compact UTF-8 ``bytes`` the default public and CLI output; callers that require pretty Unicode text must pass ``pretty=True`` or ``--pretty``
+  * fix: normalize the parent name a ``list_headers`` dict member borrows, so a rootless list of dictionaries no longer emits the malformed empty tag ``<>``
+  * fix: make the optional Rust backend byte-identical to the Python serializer for every payload it accepts, correcting CDATA on numbers, nested list shapes, list member tag names, ``type="dict"`` under ``list_headers``, and names beginning with ``xml``
+  * fix: keep payloads the Rust backend cannot reproduce exactly -- non-JSON-native values, parser-resolved key names, and normalized root names -- on the Python serializer
+  * perf: run the Rust backend's payload gate natively, cutting a 1,000-record conversion from 1.51 ms to 0.49 ms
+  * fix: enforce conversion output limits from generated UTF-8 bytes instead of rejecting valid payloads with a conservative estimate
+  * fix: reject unsupported falsy objects consistently instead of serializing them as null
+  * fix: keep public scalar converter attribute dictionaries unchanged
+  * perf: validate common ASCII XML attribute names without constructing a DOM
+  * fix: serialize date-like values consistently at the root, which previously rejected ``datetime.time`` while accepting it inside dicts and lists
+  * refactor: dispatch every element writer through a single type classifier
+  * docs: record the string-returning public converters as a retained compatibility surface
+  * perf: indent pretty output while serializing instead of re-tokenizing generated XML, roughly halving pretty conversion time and removing the last XML parsing path from the library
+  * chore: release ``json2xml-rs`` 0.5.0 first and require it from ``json2xml[fast]`` for parity-safe accelerated installs
+  * chore: align local pytest, pre-commit, release, and Rust CI configuration with the supported toolchain
+  * chore: move benchmark scripts under ``benchmarks/`` and make ``pyproject.toml`` plus ``uv.lock`` the only dependency declaration
+
+
+6.5.1 / 2026-08-05
+==================
+
+  * security: pin URL connections to validated DNS addresses to prevent DNS-rebinding bypasses of private-network blocking
+  * security: bound encoded and decoded compressed responses to prevent gzip and deflate resource-exhaustion attacks
+  * fix: reject XML 1.0-forbidden characters consistently across Python and Rust serializers instead of emitting invalid XML
+  * fix: require an actual boolean for ``allow_private_networks`` and normalize malformed-hostname failures as ``URLReadError``
+  * chore: release ``json2xml-rs`` 0.4.3 first and require it from ``json2xml[fast]`` for XML-safe accelerated installs
+  * docs: document URL safety controls, XML validation behavior, migration guidance, and the Rust-first release sequence
+
+
 6.5.0 / 2026-07-15
 ==================
 

{json2xml-6.5.0 → json2xml-7.0.0}/MANIFEST.in

@@ -3,7 +3,7 @@ include CONTRIBUTING.rst
 include HISTORY.rst
 include LICENSE
 include README.rst
-include requirements.in
+include pyproject.toml
 recursive-include tests *
 recursive-exclude * __pycache__
 recursive-exclude * *.py[co]

{json2xml-6.5.0 → json2xml-7.0.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: json2xml
-Version: 6.5.0
+Version: 7.0.0
 Summary: Simple Python Library to convert JSON to XML
 Author-email: Vinit Kumar <mail@vinitkumar.me>
 License: Apache Software License 2.0
@@ -26,13 +26,15 @@ Requires-Dist: defusedxml
 Requires-Dist: urllib3>=2.7.0
 Provides-Extra: dev
 Requires-Dist: pytest>=8.4.1; extra == "dev"
-Requires-Dist: pytest-cov; extra == "dev"
-Requires-Dist: coverage; extra == "dev"
-Requires-Dist: setuptools; extra == "dev"
+Requires-Dist: pytest-cov>=7.1.0; extra == "dev"
+Requires-Dist: pytest-xdist>=3.8.0; extra == "dev"
+Requires-Dist: coverage>=7.15.4; extra == "dev"
+Requires-Dist: ruff>=0.16.3; extra == "dev"
+Requires-Dist: setuptools>=80.9.0; extra == "dev"
 Requires-Dist: pygments>=2.20.0; extra == "dev"
-Requires-Dist: xmltodict>=0.12.0; extra == "dev"
+Requires-Dist: xmltodict>=0.14.2; extra == "dev"
 Provides-Extra: fast
-Requires-Dist: json2xml-rs>=0.4.2; extra == "fast"
+Requires-Dist: json2xml-rs>=0.5.0; extra == "fast"
 Dynamic: license-file
 
 .. image:: ./json2xml-hero.png
@@ -276,11 +278,30 @@ You can use the json2xml library in the following ways:
     data = readfromjson("examples/licht.json")
     print(json2xml.Json2xml(data).to_xml())
 
+URL reads accept only credential-free HTTP(S), reject redirects and non-public
+destinations by default, pin public connections to their validated DNS address,
+and stop after 10 MiB of encoded or decoded content. Gzip and deflate responses
+honor ``Content-Length`` and are decoded incrementally; other content encodings
+are rejected. Trusted library callers can opt into a private endpoint with the
+boolean ``True`` or choose a smaller limit:
+
+.. code-block:: python
+
+    data = readfromurl(
+        "http://127.0.0.1:8000/data.json",
+        allow_private_networks=True,
+        max_response_bytes=1024 * 1024,
+    )
+
 
 Custom Wrappers and Indentation
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-By default, a wrapper `all` and pretty `True` is set. However, you can easily change this in your code like this:
+By default, a wrapper `all` and compact output (``pretty=False``) are set. Pretty printing can be enabled explicitly:
+
+Conversions also default to a nesting limit of 100, an item limit of 100,000,
+and a 10 MiB XML output limit. Pass ``max_depth``, ``max_items``, or
+``max_output_bytes`` to choose smaller budgets for untrusted workloads.
 
 .. code-block:: python
 
@@ -434,8 +455,7 @@ This project uses modern Python development practices. Here's how to set up a de
     source .venv/bin/activate  # On Windows: .venv\Scripts\activate
     
     # Install dependencies
-    uv pip install -r requirements-dev.txt
-    uv pip install -e .
+    uv pip install -e ".[dev]"
 
 **Running Tests and Checks**
 
@@ -447,25 +467,16 @@ Using Make (recommended):
 
     make test          # Run tests with coverage
     make lint          # Run linting with ruff
-    make typecheck     # Run type checking with mypy
+    make typecheck     # Run type checking with ty
     make check-all     # Run all checks (lint, typecheck, test)
 
-Using the development script:
-
- .. code-block:: console
-
-    python dev.py          # Run all checks
-    python dev.py test     # Run tests only
-    python dev.py lint     # Run linting only
-    python dev.py typecheck # Run type checking only
-
 Using tools directly:
 
  .. code-block:: console
 
     pytest --cov=json2xml --cov-report=term -xvs tests -n auto
     ruff check json2xml tests
-    mypy json2xml tests
+    uvx ty check json2xml tests
 
 **Rust Extension Development**
 
@@ -500,7 +511,7 @@ Running Rust benchmarks:
  .. code-block:: console
 
     # After building the extension
-    python benchmark_rust.py
+    python benchmarks/benchmark_rust.py
 
 The Rust code is in ``rust/src/lib.rs`` and uses PyO3 for Python bindings.
 
@@ -550,7 +561,7 @@ The ``json2xml-py`` command-line tool provides an easy way to convert JSON to XM
     Conversion Options:
       -w, --wrapper string    Wrapper element name (default "all")
       -r, --root              Include root element (default true)
-      -p, --pretty            Pretty print output (default true)
+      -p, --pretty            Pretty print output (default false)
       -t, --type              Include type attributes (default true)
       -i, --item-wrap         Wrap list items in <item> elements (default true)
       -x, --xpath             Use XPath 3.1 json-to-xml format

{json2xml-6.5.0 → json2xml-7.0.0}/README.rst

@@ -239,11 +239,30 @@ You can use the json2xml library in the following ways:
     data = readfromjson("examples/licht.json")
     print(json2xml.Json2xml(data).to_xml())
 
+URL reads accept only credential-free HTTP(S), reject redirects and non-public
+destinations by default, pin public connections to their validated DNS address,
+and stop after 10 MiB of encoded or decoded content. Gzip and deflate responses
+honor ``Content-Length`` and are decoded incrementally; other content encodings
+are rejected. Trusted library callers can opt into a private endpoint with the
+boolean ``True`` or choose a smaller limit:
+
+.. code-block:: python
+
+    data = readfromurl(
+        "http://127.0.0.1:8000/data.json",
+        allow_private_networks=True,
+        max_response_bytes=1024 * 1024,
+    )
+
 
 Custom Wrappers and Indentation
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 
-By default, a wrapper `all` and pretty `True` is set. However, you can easily change this in your code like this:
+By default, a wrapper `all` and compact output (``pretty=False``) are set. Pretty printing can be enabled explicitly:
+
+Conversions also default to a nesting limit of 100, an item limit of 100,000,
+and a 10 MiB XML output limit. Pass ``max_depth``, ``max_items``, or
+``max_output_bytes`` to choose smaller budgets for untrusted workloads.
 
 .. code-block:: python
 
@@ -397,8 +416,7 @@ This project uses modern Python development practices. Here's how to set up a de
     source .venv/bin/activate  # On Windows: .venv\Scripts\activate
     
     # Install dependencies
-    uv pip install -r requirements-dev.txt
-    uv pip install -e .
+    uv pip install -e ".[dev]"
 
 **Running Tests and Checks**
 
@@ -410,25 +428,16 @@ Using Make (recommended):
 
     make test          # Run tests with coverage
     make lint          # Run linting with ruff
-    make typecheck     # Run type checking with mypy
+    make typecheck     # Run type checking with ty
     make check-all     # Run all checks (lint, typecheck, test)
 
-Using the development script:
-
- .. code-block:: console
-
-    python dev.py          # Run all checks
-    python dev.py test     # Run tests only
-    python dev.py lint     # Run linting only
-    python dev.py typecheck # Run type checking only
-
 Using tools directly:
 
  .. code-block:: console
 
     pytest --cov=json2xml --cov-report=term -xvs tests -n auto
     ruff check json2xml tests
-    mypy json2xml tests
+    uvx ty check json2xml tests
 
 **Rust Extension Development**
 
@@ -463,7 +472,7 @@ Running Rust benchmarks:
  .. code-block:: console
 
     # After building the extension
-    python benchmark_rust.py
+    python benchmarks/benchmark_rust.py
 
 The Rust code is in ``rust/src/lib.rs`` and uses PyO3 for Python bindings.
 
@@ -513,7 +522,7 @@ The ``json2xml-py`` command-line tool provides an easy way to convert JSON to XM
     Conversion Options:
       -w, --wrapper string    Wrapper element name (default "all")
       -r, --root              Include root element (default true)
-      -p, --pretty            Pretty print output (default true)
+      -p, --pretty            Pretty print output (default false)
       -t, --type              Include type attributes (default true)
       -i, --item-wrap         Wrap list items in <item> elements (default true)
       -x, --xpath             Use XPath 3.1 json-to-xml format