Update dependency xmltodict to v1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
xmltodict	^0.14.0 → ^1.0.0

---

Release Notes

martinblech/xmltodict (xmltodict)

v1.0.4

Compare Source

Bug Fixes

• unparse: add bytes_errors policy and handle bytes scalars consistently (ed70434)

v1.0.3

Compare Source

Bug Fixes

• unparse: serialize None text/attrs as empty values (fixes #​401) (aa16511)

Documentation

• readme: fix Fedora and Arch package links (fd6a73b)

v1.0.2

Compare Source

Bug Fixes

• allow DOCTYPE with disable_entities=True (default) (25b61a4)

v1.0.1

Compare Source

Bug Fixes

• fail closed when entities disabled (c986d2d)
• validate XML comments (3d4d2d3)

Documentation

• add SECURITY.md (6413023)
• clarify behavior for empty lists (2025b5c)
• clarify process_comments docs (6b464fc)
• clarify strip whitespace comment behavior (b3e2203)
• create AGENTS.md for coding agents (0da66ee)
• replace travis with actions badge (2576b94)
• update CONTRIBUTING.md (db39180)

v1.0.0

Compare Source

⚠ BREAKING CHANGES

• modernize for Python 3.9+; drop legacy compat paths

Features

• unparse: add limited XML comment round-trip; unify _emit behavior (e43537e)
• unparse: add selective force_cdata support (bool/tuple/callable) (a497fed), closes #​375

Bug Fixes

• namespaces: attach [@xmlns](https://redirect.github.com/xmlns) to declaring element when process_namespaces=True (f0322e5), closes #​163
• streaming: avoid parent accumulation at item_depth; add regression tests (220240c)
• unparse: handle non-string #text with attributes; unify value conversion (927a025), closes #​366
• unparse: skip empty lists to keep pretty/compact outputs consistent (ab4c86f)

Reverts

• remove initial Release Drafter config (c0b74ed)

Documentation

• readme: add API reference for parse()/unparse() kwargs (e5039ad)
• readme: mention types-xmltodict stub package (58ec03e)

Code Refactoring

• modernize for Python 3.9+; drop legacy compat paths (7364427)

v0.15.1

Compare Source

• Security: Further harden XML injection prevention during unparse (follow-up to
  v0.15.0). In addition to '<'/'>' rejection, now also reject element and
  attribute names (including @xmlns prefixes) that:
  • start with '?' or '!'
  • contain '/' or any whitespace
  • contain quotes (' or ") or '='
  • are non-strings (names must be str; no coercion)

v0.15.0

Compare Source

• Security: Prevent XML injection (CVE-2025-9375) by rejecting '<'/'>' in
  element and attribute names (including @xmlns prefixes) during unparse.
  This limits validation to avoiding tag-context escapes; attribute values
  continue to be escaped by the SAX XMLGenerator.
  Advisory: https://fluidattacks.com/advisories/mono

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.