4.3.3

Highlights

• Wire up the forbid_external setting (previously defined but unused since the move off defusedxml in 4.0). When enabled, zeep refuses to transitively fetch http/https resources via xsd:import, xsd:include, wsdl:import or lxml entity resolution, raising zeep.exceptions.ExternalReferenceForbidden. The user-supplied entry-point WSDL/schema URL is still loaded. The default remains False to preserve existing behaviour; enable it when loading WSDLs from untrusted sources to mitigate SSRF via attacker-controlled import targets.

Internal

• Tooling only (no runtime changes): migrated dependency/build management to uv and replaced isort/flake8/black with ruff.

4.3.2

What's Changed

• Update proxy argument in httpx Client/AsyncClient by @aschollmeier-gcmlp in #1447
• Reformat using newer version of black. by @iksteen in #1470

New Contributors

• @aschollmeier-gcmlp made their first contribution in #1447
• @iksteen made their first contribution in #1470

Full Changelog: 4.3.1...4.3.2

4.3.1

• Fix regression in parsing xsd:Date with negative timezone

4.3.0

• Drop support for Python 3.7 and 3.8 and add support for Python 3.12 and 3.13 (#1421, #1408)
• Add workaround to support date values with timezone in combination with
  isodate 0.7.2 (#1431)
• Replace deprecated datetime.datetime.utcnow()
• Properly close 'file://' resources (#1339)
• Complete migration to pyproject.toml (remove setup.py)

4.2.1

Fix error regarding closing session in async transport (#1347)

4.2.0

• Drop support for Python 3.6
• Allow embedding CDATA elements in simple types (#1339)
• Allow to pass in a pre parsed Document (#1330)
• Fix httpx DeprecationWarning for post data (#1326)
• Add BinaryMemorySignature (#1300)
• Fix IndexError when empty body response (#1287)
• Add support for context manager on Client (#1166)
• Allow Ws Addressing plugin to use a different URL (#1328)
• Accept strings for xsd base64Binary (#1072)

4.1.0

• Remove last dependency on six (#1250)
• Use platformdirs instead of the appsdirs dependency (#1244)
• Pass digest method when signing timestamp node(#1201)
• Fix settings context manager when an exception is raised (#1193)
• Don't render decimals using scientific notation (#1191)
• Remove dependency on defusedxml (deprecated) (#1179)
• Improve handling of str values for Duration (#1165)