[upstream package] Relax lxml<6.0.0 constraint in splunk-appinspect to allow lxml>=6.1.0 (CVE-2026-41066 fix)

[RelativisticJet]

Note on venue

This issue is about the underlying splunk-appinspect Python package (pinned by this Action), not the Action wrapper itself. The PyPI metadata for splunk-appinspect declares no public source or bug tracker, so I'm filing here because it's the only public Splunk-org GitHub repo touching AppInspect. If there's a better venue, please redirect.

Summary

splunk-appinspect==4.2.0 and the newly-released 4.2.1 (2026-05-21) both declare Requires-Dist: lxml<6.0.0,>=5.3.0. The upper bound prevents downstream projects from picking up lxml==6.1.0, which patches CVE-2026-41066 / GHSA-vfmq-68hx-4jfw (XXE via iterparse() and ETCompatXMLParser() when resolve_entities=True). The 4.2.1 release did not relax this constraint.

Dependabot flags this in any repo that consumes splunk-appinspect through a hashed lockfile (pip-audit, pip-compile, poetry). Downstream maintainers cannot resolve it without either (a) carving out the CVE with an ignore-rule (the path I took — see DECISION_LOG entry), or (b) abandoning splunk-appinspect, which is the only tool that runs Splunkbase certification checks.

Ask

Could the lxml<6.0.0 upper bound be relaxed in the next splunk-appinspect release, ideally to allow lxml>=6.1.0? If lxml 6.x introduces API surface incompatibilities that the constraint exists to guard against, an outline of what splunk-appinspect calls into would help downstream projects understand the upgrade path.

Reachability for our use case

In our repo, lxml is invoked exclusively by splunk-appinspect against our own .spl artifact built from this repo's source tree. The XXE pathway requires untrusted XML input; our trusted-input CI use case is below the CVSS general-population threat model. I've documented this as accepted residual risk in our DECISION_LOG and applied a pip-audit --ignore-vuln carve-out so CI stays green. Filing this so downstream projects with stricter postures (or auditors who don't dig into reachability) aren't blocked.

Versions

• splunk-appinspect: 4.2.0 (and 4.2.1, released 2026-05-21 — same constraint)
• Constraint: Requires-Dist: lxml<6.0.0,>=5.3.0
• Fixed lxml version: 6.1.0
• CVE: CVE-2026-41066 (CVSS 7.5 HIGH)
• GHSA: GHSA-vfmq-68hx-4jfw