python-docx-oss 0.1.1__tar.gz → 0.3.0__tar.gz

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/HISTORY.md

@@ -1,5 +1,24 @@
 ## Release History
 
+**Unreleased**
+
+**0.3.0 (2026-08-29)**
+
+- Added opt-in package-level document sanitization for personal metadata,
+  comments, web extensions, and formatting revision history.
+- Added structured sanitization reports and real Word comment round-trip coverage.
+
+**0.2.0 (2026-08-24)**
+
+- Added direct loading from raw DOCX bytes with ``Document(bytes)``.
+- Added ``Document.to_bytes()`` for in-memory export and ``Document.copy()``
+  for independent document snapshots.
+- Added safe removal of Custom XML parts, including their document and property
+  relationships.
+- Added real-document EMF round-trip coverage and corrected the EMF MIME type.
+- Documented the capability matrix, upstream maintenance policy, and
+  compatibility boundary with official ``python-docx``.
+
 **0.1.1 (2026-08-21)**
 
 - Added Python 3.14 support and CI coverage for Python 3.12 through 3.14.

{python_docx_oss-0.1.1/src/python_docx_oss.egg-info → python_docx_oss-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-docx-oss
-Version: 0.1.1
+Version: 0.3.0
 Summary: Create, read, and update Microsoft Word .docx files.
 Author: Ethan St Lee
 License-Expression: MIT
@@ -23,7 +23,7 @@ Classifier: Topic :: Software Development :: Libraries
 Requires-Python: >=3.12
 Description-Content-Type: text/markdown
 License-File: LICENSE
-Requires-Dist: lxml>=3.1.0
+Requires-Dist: lxml>=6.1.0
 Requires-Dist: typing_extensions>=4.9.0
 Dynamic: license-file
 
@@ -53,18 +53,20 @@ Use it when an application needs more than basic paragraphs and tables: custom d
 metadata, application-owned XML, vector images, floating pictures, East Asian fonts,
 or low-level package and relationship access.
 
-## Features
-
-| Capability | Support |
-| --- | --- |
-| Documents, paragraphs, runs, tables, styles, sections, headers, and footers | ✓ |
-| Custom document properties | ✓ |
-| Custom XML parts | ✓ |
-| SVG and EMF images | ✓ |
-| Inline and floating pictures | ✓ |
-| Independent ASCII, High ANSI, and East Asian font controls | ✓ |
-| Low-level OPC parts and relationships | ✓ |
-| File-path and in-memory stream processing | ✓ |
+## Capability Matrix
+
+| Capability | Status | Primary API |
+| --- | --- | --- |
+| Documents, paragraphs, tables, styles, sections, headers, and footers | Stable | `Document()` and document object APIs |
+| Custom document properties | Stable | `document.custom_properties` |
+| Custom XML lifecycle | Stable | `add_custom_xml_part()`, `delete_custom_xml_part()` |
+| SVG and EMF images | Stable | `add_picture()` |
+| Inline and floating pictures | Stable | `add_picture()`, `add_float_picture()` |
+| Latin and East Asian font controls | Stable | `run.font.name`, `run.font.hAnsi`, `run.font.eastAsia` |
+| Low-level OPC parts and relationships | Stable | `document.part.package`, `part.rels` |
+| In-memory read, export, and independent copies | Stable | `Document()`, `to_bytes()`, `copy()` |
+| Document sanitization | Development | `document.sanitize()` |
+| Package inspection and diff | Planned | — |
 
 ## Installation
 
@@ -170,6 +172,8 @@ available through `Document.add_float_picture()` and `Run.add_float_picture()`.
 - [API reference](docs/index.rst#api-documentation)
 - [Custom properties](docs/user/custom-properties.rst)
 - [Custom XML](docs/user/custom-xml.rst)
+- [python-docx compatibility](docs/user/compatibility.rst)
+- [Upstream maintenance](docs/dev/upstream-maintenance.rst)
 - [Release history](HISTORY.md)
 
 ## Quality and Testing

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/README.md

@@ -24,18 +24,20 @@ Use it when an application needs more than basic paragraphs and tables: custom d
 metadata, application-owned XML, vector images, floating pictures, East Asian fonts,
 or low-level package and relationship access.
 
-## Features
-
-| Capability | Support |
-| --- | --- |
-| Documents, paragraphs, runs, tables, styles, sections, headers, and footers | ✓ |
-| Custom document properties | ✓ |
-| Custom XML parts | ✓ |
-| SVG and EMF images | ✓ |
-| Inline and floating pictures | ✓ |
-| Independent ASCII, High ANSI, and East Asian font controls | ✓ |
-| Low-level OPC parts and relationships | ✓ |
-| File-path and in-memory stream processing | ✓ |
+## Capability Matrix
+
+| Capability | Status | Primary API |
+| --- | --- | --- |
+| Documents, paragraphs, tables, styles, sections, headers, and footers | Stable | `Document()` and document object APIs |
+| Custom document properties | Stable | `document.custom_properties` |
+| Custom XML lifecycle | Stable | `add_custom_xml_part()`, `delete_custom_xml_part()` |
+| SVG and EMF images | Stable | `add_picture()` |
+| Inline and floating pictures | Stable | `add_picture()`, `add_float_picture()` |
+| Latin and East Asian font controls | Stable | `run.font.name`, `run.font.hAnsi`, `run.font.eastAsia` |
+| Low-level OPC parts and relationships | Stable | `document.part.package`, `part.rels` |
+| In-memory read, export, and independent copies | Stable | `Document()`, `to_bytes()`, `copy()` |
+| Document sanitization | Development | `document.sanitize()` |
+| Package inspection and diff | Planned | — |
 
 ## Installation
 
@@ -141,6 +143,8 @@ available through `Document.add_float_picture()` and `Run.add_float_picture()`.
 - [API reference](docs/index.rst#api-documentation)
 - [Custom properties](docs/user/custom-properties.rst)
 - [Custom XML](docs/user/custom-xml.rst)
+- [python-docx compatibility](docs/user/compatibility.rst)
+- [Upstream maintenance](docs/dev/upstream-maintenance.rst)
 - [Release history](HISTORY.md)
 
 ## Quality and Testing

python_docx_oss-0.3.0/docs/api/sanitize.rst

@@ -0,0 +1,60 @@
+.. _sanitize_api:
+
+Sanitization objects
+====================
+
+.. currentmodule:: docx.sanitize
+
+
+SanitizationReport objects
+--------------------------
+
+.. autoclass:: SanitizationReport
+   :members: changed
+
+   .. attribute:: scrubbed_properties
+
+      Names of core properties normalized during sanitization.
+
+   .. attribute:: removed_comment_markers
+
+      Number of outermost comment marker elements removed from Word story XML.
+
+   .. attribute:: removed_formatting_revisions
+
+      Number of outermost formatting revision elements removed.
+
+   .. attribute:: removed_parts
+
+      Package part names made unreachable by removed relationships.
+
+   .. attribute:: removed_relationships
+
+      :class:`RemovedRelationship` records for relationships removed from the
+      package graph.
+
+   .. attribute:: warnings
+
+      Non-fatal conditions encountered while sanitizing the package.
+
+
+RemovedRelationship objects
+---------------------------
+
+.. autoclass:: RemovedRelationship
+
+   .. attribute:: source
+
+      Part name of the relationship source, or ``/`` for the package itself.
+
+   .. attribute:: relationship_id
+
+      Relationship identifier used by the source.
+
+   .. attribute:: relationship_type
+
+      Full relationship type URI.
+
+   .. attribute:: target
+
+      Target part name or external target reference.

python_docx_oss-0.3.0/docs/dev/upstream-maintenance.rst

@@ -0,0 +1,95 @@
+Upstream maintenance
+====================
+
+``python-docx-oss`` evolves as an independent DOCX SDK. Its source, tests,
+versioning, and releases are authoritative in this repository. The official
+`python-docx repository <https://github.com/python-openxml/python-docx>`_ is an
+upstream source of compatible APIs, bug fixes, and OPC/WordprocessingML
+improvements; it is not the development repository for ``python-docx-oss``.
+
+Upstream baseline
+-----------------
+
+The current upstream baseline is ``python-docx v1.2.0`` at commit
+``e45454602b53e8e572b179ccf1c91093ec9f4ed7``.
+
+This baseline identifies the last official release whose changes have been
+evaluated as a whole. It does not imply compatibility with every private or
+internal upstream API.
+
+No local repository layout is required. A maintainer may obtain upstream source
+using a temporary clone, a read-only Git remote, a release archive, or another
+equivalent method. Maintenance instructions and project documentation must not
+depend on sibling directories, personal filesystem paths, or local-only
+branches.
+
+When to evaluate upstream
+-------------------------
+
+Evaluate upstream changes when:
+
+* ``python-docx`` publishes a release;
+* upstream fixes a security, data-loss, or document-compatibility issue;
+* a supported downstream workflow needs a new standard API; or
+* an upcoming ``python-docx-oss`` release needs a baseline refresh.
+
+Continuous synchronization with individual upstream commits is not required.
+
+Integration workflow
+--------------------
+
+#. Obtain the target upstream tag or commit and compare it with the recorded
+   baseline.
+#. Review release notes and classify changes to public APIs, OPC packaging,
+   XML handling, templates, schemas, tests, and documentation.
+#. Create a dedicated branch in ``python-docx-oss`` for the integration. The
+   branch name and the location used to obtain upstream source are not part of
+   the public maintenance contract.
+#. Integrate the relevant changes as a reviewable change set. Preserve upstream
+   history when practical, but prefer a clear, auditable result over a blind
+   merge.
+#. Resolve conflicts according to the compatibility rules below.
+#. Run the full verification gates and review the package artifacts.
+#. Update this baseline, compatibility notes, and ``HISTORY.md`` in the same
+   integration change.
+
+Compatibility and conflict rules
+--------------------------------
+
+Standard public ``python-docx`` behavior is preferred unless adopting it would
+break an API intentionally supported by ``python-docx-oss``. An upstream
+integration must preserve the supported capabilities documented in the
+Capability Matrix and covered by the regression test suite.
+
+Compatibility with upstream private APIs is not guaranteed. Intentional public
+API differences must be recorded in compatibility or divergence notes rather
+than hidden in conflict-resolution commits.
+
+Verification gates
+------------------
+
+An upstream integration is complete only when the repository CI passes. This
+includes:
+
+* unit, integration, and acceptance tests on all supported Python versions;
+* lint, formatting, and scoped type checks;
+* documentation and distribution builds; and
+* real-DOCX round trips required by the Capability Matrix and regression test
+  suite.
+
+The resulting wheel and source distribution must contain the expected package
+data and install without also installing the official ``python-docx``
+distribution, because both projects provide the ``docx`` import namespace.
+
+Recording the result
+--------------------
+
+For each completed baseline refresh, record:
+
+* the upstream tag and resolved commit;
+* the material APIs and fixes adopted;
+* intentionally omitted upstream changes and their rationale; and
+* any new compatibility boundary visible to users.
+
+Temporary comparison checkouts, remotes, and branches are local implementation
+details and are not part of the permanent project record.

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/docs/index.rst

@@ -22,7 +22,9 @@ supports capabilities needed by more demanding document workflows:
 * SVG and EMF vector images;
 * separate Latin and East Asian font settings;
 * document custom properties; and
-* multiple Custom XML parts that survive a load/save round trip.
+* multiple Custom XML parts that survive a load/save round trip; and
+* explicit package-level sanitization of metadata, comments, web extensions,
+  and formatting revision history.
 
 Here is a small example:
 
@@ -94,9 +96,11 @@ User Guide
    user/styles-understanding
    user/styles-using
    user/comments
+   user/sanitization
    user/shapes
    user/custom-properties
    user/custom-xml
+   user/compatibility
 
 
 API Documentation
@@ -112,16 +116,17 @@ API Documentation
    api/table
    api/section
    api/comments
+   api/sanitize
    api/shape
    api/dml
    api/shared
    api/enum/index
 
-
 Contributor Guide
 -----------------
 
 .. toctree::
    :maxdepth: 1
 
+   dev/upstream-maintenance
    dev/analysis/index

python_docx_oss-0.3.0/docs/user/compatibility.rst

@@ -0,0 +1,48 @@
+python-docx compatibility
+=========================
+
+``python-docx-oss`` and the official ``python-docx`` project share the
+``docx`` import namespace and a common code lineage. They are separate Python
+distributions with independent versions and release schedules.
+
+Compatibility target
+--------------------
+
+The current upstream baseline is ``python-docx v1.2.0`` at commit
+``e45454602b53e8e572b179ccf1c91093ec9f4ed7``.
+
+Public APIs inherited from that baseline are compatibility targets unless an
+intentional difference is documented. Compatibility with private modules,
+private attributes, undocumented XML internals, or implementation details is
+not guaranteed.
+
+Extensions provided by ``python-docx-oss`` are additive where practical. The
+project's current supported and planned features are maintained in the
+Capability Matrix rather than duplicated here.
+
+Distribution boundary
+---------------------
+
+Do not install ``python-docx`` and ``python-docx-oss`` into the same Python
+environment. Both distributions provide the ``docx`` package, so installing
+both can produce an environment whose imported files depend on installation
+order.
+
+Applications should declare exactly one of the two distributions as a direct
+dependency. Migrating an existing application normally does not require import
+changes, but its use of undocumented upstream internals must be reviewed.
+
+Intentional differences
+-----------------------
+
+An intentional difference is recorded when ``python-docx-oss`` changes a
+public inherited API or its observable behavior. Each record must identify:
+
+* the affected public API;
+* the behavior of the recorded upstream baseline;
+* the ``python-docx-oss`` behavior and rationale; and
+* any migration action required by callers.
+
+Additive APIs and capabilities do not require individual divergence records;
+they belong in the API documentation and Capability Matrix. Upstream baseline
+changes follow the :doc:`../dev/upstream-maintenance` policy.

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/docs/user/custom-xml.rst

@@ -89,7 +89,15 @@ Delete a child by passing the element itself::
     customers.delete_item(customer)
 
 The indexes in ``items`` can change after deletion. Removing an entire Custom
-XML part is not currently provided by this API.
+XML part uses the main document part::
+
+    document.part.delete_custom_xml_part(customers)
+
+The Custom XML part, its relationship from the main document, and any related
+``itemPropsN.xml`` property part are omitted the next time the document is
+saved. The deleted ``itemN.xml`` name becomes available for later additions.
+Attempting to delete a part that is not related to the document, including a
+part that has already been deleted, raises ``ValueError``.
 
 Existing relationships to Custom XML property parts, such as
 ``itemPropsN.xml``, are preserved during load/save round trips.

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/docs/user/documents.rst

@@ -67,13 +67,18 @@ Opening a file-like document
 |docx| can open a document from a so-called *file-like* object. It can also
 save to a file-like object. This can be handy when you want to get the source
 or target document over a network connection or from a database and don't want
-to (or aren't allowed to) interact with the file system. A ``.docx`` package is
-binary, so an in-memory stream must be an :class:`io.BytesIO` object::
-
-    from io import BytesIO
+to (or aren't allowed to) interact with the file system. Raw DOCX bytes can be
+opened directly::
 
     from docx import Document
 
+    with open("foobar.docx", "rb") as file:
+        document = Document(file.read())
+
+A binary file-like object such as :class:`io.BytesIO` is also supported::
+
+    from io import BytesIO
+
     with open("foobar.docx", "rb") as file:
         source_stream = BytesIO(file.read())
     document = Document(source_stream)
@@ -92,5 +97,23 @@ After saving, rewind the output stream before reading it or opening it again::
 Always open ``.docx`` files in binary mode (``"rb"`` for reading and ``"wb"``
 for writing).
 
+Exporting and copying in memory
+-------------------------------
+
+Use :meth:`Document.to_bytes <docx.document.Document.to_bytes>` when the complete
+DOCX package needs to be uploaded, cached, returned over HTTP, or stored in a
+database::
+
+    content = document.to_bytes()
+
+Use :meth:`Document.copy <docx.document.Document.copy>` to create an independent
+snapshot that can be modified without changing the source document::
+
+    customer_document = document.copy()
+    customer_document.add_paragraph("Customer-specific content")
+
+The copy has its own XML trees, parts, and relationships. Both operations stay
+in memory and do not create temporary files.
+
 Okay, so you've got a document open and are pretty sure you can save it
 somewhere later. Next step is to get some content in there ...

python_docx_oss-0.3.0/docs/user/sanitization.rst

@@ -0,0 +1,56 @@
+.. _sanitization:
+
+Document sanitization
+=====================
+
+Sanitization removes selected package-level information before a document is
+shared. Every operation is disabled by default because removal is destructive.
+
+Use :meth:`Document.sanitize() <docx.document.Document.sanitize>` with explicit
+options and inspect its report before saving::
+
+    from docx import Document
+
+    document = Document("input.docx")
+    report = document.sanitize(
+        personal_metadata=True,
+        comments=True,
+        web_extensions=True,
+        formatting_revisions=True,
+    )
+
+    if report.changed:
+        document.save("sanitized.docx")
+
+The returned :class:`~docx.sanitize.SanitizationReport` identifies scrubbed
+properties, removed XML markers, parts, and relationships, plus any warnings.
+Each removed relationship is represented by
+:class:`~docx.sanitize.RemovedRelationship`. Repeating the same sanitization is
+idempotent: the second report has ``changed == False`` when nothing new was
+added.
+
+Options
+-------
+
+``personal_metadata``
+    Clears author and last-modified-by values and canonicalizes the revision
+    number. Duplicate property elements are removed.
+
+``comments``
+    Removes comment markers from all reachable Word XML story parts and removes
+    the complete comments relationship tree, including modern comments extension
+    parts when present.
+
+``web_extensions``
+    Removes web-extension task panes and their related package parts.
+
+``formatting_revisions``
+    Removes property-change history such as ``rPrChange`` and ``pPrChange`` while
+    retaining the currently effective formatting.
+
+Scope boundary
+--------------
+
+This API does not accept or reject tracked content revisions. It also does not
+remove Custom XML, macros, OLE objects, external links, or application-specific
+business metadata. Those operations require separate policy decisions.

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/pyproject.toml

@@ -18,7 +18,7 @@ classifiers = [
   "Topic :: Office/Business :: Office Suites",
   "Topic :: Software Development :: Libraries",
 ]
-dependencies = ["lxml>=3.1.0", "typing_extensions>=4.9.0"]
+dependencies = ["lxml>=6.1.0", "typing_extensions>=4.9.0"]
 description = "Create, read, and update Microsoft Word .docx files."
 dynamic = ["version"]
 keywords = ["docx", "office", "openxml", "word"]
@@ -41,7 +41,7 @@ dev = [
   "behave>=1.2.6",
   "pyparsing>=3.2.3",
   "pyright>=1.1.401",
-  "pytest>=8.4.0",
+  "pytest>=9.0.3",
   "ruff>=0.11.13",
   "sphinx-book-theme",
   "tox>=4.26.0",

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/src/docx/__init__.py

@@ -13,7 +13,7 @@ from docx.api import Document
 if TYPE_CHECKING:
     from docx.opc.part import Part
 
-__version__ = "0.1.1"
+__version__ = "0.3.0"
 
 
 __all__ = ["Document"]

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/src/docx/api.py

@@ -5,6 +5,7 @@ Provides a syntactically more convenient API for interacting with the OpcPackage
 
 from __future__ import annotations
 
+import io
 import os
 from typing import IO, TYPE_CHECKING, cast
 
@@ -16,18 +17,20 @@ if TYPE_CHECKING:
     from docx.parts.document import DocumentPart
 
 
-def Document(docx: str | IO[bytes] | None = None) -> DocumentObject:
+def Document(docx: str | bytes | IO[bytes] | None = None) -> DocumentObject:
     """Return a |Document| object loaded from `docx`, where `docx` can be either a path
-    to a ``.docx`` file (a string) or a file-like object.
+    to a ``.docx`` file, raw DOCX bytes, or a binary file-like object.
 
     If `docx` is missing or ``None``, the built-in default document "template" is
     loaded.
     """
     docx = _default_docx_path() if docx is None else docx
+    source_name = "<bytes>" if isinstance(docx, bytes) else docx
+    docx = io.BytesIO(docx) if isinstance(docx, bytes) else docx
     document_part = cast("DocumentPart", Package.open(docx).main_document_part)
     if document_part.content_type != CT.WML_DOCUMENT_MAIN:
         tmpl = "file '%s' is not a Word file, content type is '%s'"
-        raise ValueError(tmpl % (docx, document_part.content_type))
+        raise ValueError(tmpl % (source_name, document_part.content_type))
     return document_part.document
 
 

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/src/docx/document.py

@@ -5,11 +5,14 @@
 
 from __future__ import annotations
 
+import io
 from typing import IO, TYPE_CHECKING, Iterator, List, Sequence
 
+from docx.api import Document as open_document
 from docx.blkcntnr import BlockItemContainer
 from docx.enum.section import WD_SECTION
 from docx.enum.text import WD_BREAK
+from docx.sanitize import SanitizationReport, sanitize_document
 from docx.section import Section, Sections
 from docx.shared import ElementProxy, Emu, Inches, Length
 from docx.text.run import Run
@@ -182,6 +185,10 @@ class Document(ElementProxy):
         """A |CoreProperties| object providing Dublin Core properties of document."""
         return self._part.core_properties
 
+    def copy(self) -> Document:
+        """Return an independent in-memory snapshot of this document."""
+        return open_document(io.BytesIO(self.to_bytes()))
+
     @property
     def custom_properties(self) -> CustomProperties:
         """A |CustomProperties| object providing custom properties of document."""
@@ -223,6 +230,27 @@ class Document(ElementProxy):
         """
         self._part.save(path_or_stream)
 
+    def sanitize(
+        self,
+        *,
+        personal_metadata: bool = False,
+        comments: bool = False,
+        web_extensions: bool = False,
+        formatting_revisions: bool = False,
+    ) -> SanitizationReport:
+        """Apply the explicitly selected package-level cleanup operations.
+
+        Every option defaults to |False| because sanitization is destructive. The
+        returned report describes all package and XML changes made to this document.
+        """
+        return sanitize_document(
+            self,
+            personal_metadata=personal_metadata,
+            comments=comments,
+            web_extensions=web_extensions,
+            formatting_revisions=formatting_revisions,
+        )
+
     @property
     def sections(self) -> Sections:
         """|Sections| object providing access to each section in this document."""
@@ -249,6 +277,12 @@ class Document(ElementProxy):
         """
         return self._body.tables
 
+    def to_bytes(self) -> bytes:
+        """Serialize this document as a complete in-memory DOCX package."""
+        with io.BytesIO() as stream:
+            self.save(stream)
+            return stream.getvalue()
+
     @property
     def _block_width(self) -> Length:
         """A |Length| object specifying the space between margins in last section."""

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/src/docx/image/constants.py

@@ -101,6 +101,7 @@ class MIME_TYPE:
     """Image content types."""
 
     BMP = "image/bmp"
+    EMF = "image/x-emf"
     GIF = "image/gif"
     JPEG = "image/jpeg"
     PNG = "image/png"

{python_docx_oss-0.1.1 → python_docx_oss-0.3.0}/src/docx/image/emf.py

@@ -13,7 +13,7 @@ class Emf(BaseImageHeader):
     @property
     def content_type(self):
         """
-        MIME content type for this image, unconditionally `image/emf` for
+        MIME content type for this image, unconditionally `image/x-emf` for
         EMF images.
         """
         return MIME_TYPE.EMF
@@ -38,7 +38,6 @@ class Emf(BaseImageHeader):
         y1 = stream_rdr.read_long(20)
 
         frame = tuple(map(stream_rdr.read_long, (24, 28, 32, 36)))
-        size = x1 - x0, y1 - y0
 
         xdpi = 2540.0 * (x1 - x0) / (frame[2] - frame[0])
         ydpi = 2540.0 * (y1 - y0) / (frame[3] - frame[1])