Prepare 1.8.1 (#133)

freddyheppell · web-flow · commit 3e4b09c8cda1 · 2026-06-16T11:26:51.000+01:00
diff --git a/docs/changelog.rst b/docs/changelog.rst
@@ -1,6 +1,14 @@
 Changelog
 =========
 
+v1.8.1 (2026-06-16)
+-------------------
+
+**Security**
+
+* Hardened XML parsing against the Billion Laughs attack by refusing to parse XML documents containing DOCTYPE or ENTITY declarations (which should not be present in valid sitemaps) (:ghsa:`GHSA-p5wc-9w9r-m232` by :user:`EQSTLab`)
+* Hardened GZIP compression against decompression bomb attacks by decompressing only up to the configured maximum sitemap size (:ghsa:`GHSA-8823-qg2x-pv9f` by :user:`EQSTLab`)
+
 v1.8.0 (2026-01-25)
 -------------------
 
diff --git a/docs/conf.py b/docs/conf.py
@@ -71,6 +71,7 @@
     'pr': (f'{_gh_root}/pull/%s', '#%s'),
     'user': (f'https://github.com/%s', '@%s'),
     'commit': (f'{_gh_root}/commit/%s', '%.7s'),
+    'ghsa': (f'{_gh_root}/security/advisories/%s', '%s'),
 }
 
 graphviz_output_format = 'svg'

Original file line number	Diff line number	Diff line change
`@@ -71,6 +71,7 @@`
`71`	`71`	`'pr': (f'{_gh_root}/pull/%s', '#%s'),`
`72`	`72`	`'user': (f'https://github.com/%s', '@%s'),`
`73`	`73`	`'commit': (f'{_gh_root}/commit/%s', '%.7s'),`
	`74`	`+ 'ghsa': (f'{_gh_root}/security/advisories/%s', '%s'),`
`74`	`75`	`}`
`75`	`76`
`76`	`77`	`graphviz_output_format = 'svg'`