DeprecationWarning: defusedxml.lxml is no longer supported

[jaap3]

zeep/loader.py imports defusedxml.lxml.fromstring, this works, but was (recently) deprecated:

DeprecationWarning: defusedxml.lxml is no longer supported and will be removed in a future release.

The best references to why it was deprecated I could find are here:

tiran/defusedxml#31
tiran/defusedxml#25

[markp2]

I am hitting this issue too with Zeep 3.4.0:

/Library/Frameworks/Python.framework/Versions/3.6/lib/python3.6/site-packages/zeep/loader.py:3:

DeprecationWarning: defusedxml.lxml is no longer supported and will be removed in a future release.
  from defusedxml.lxml import fromstring

The problem line is:

from defusedxml.lxml import fromstring

[jaap3]

There's some more information in this ticket: tiran/defusedxml#38, short summary, the module isn't going away until there's some alternative

[arjitkgupta]

Is this issue or #1014 fixed and released ?
I am getting the same error with below.
Python 3.6.1
pytest 5.4.2
zeep 3.4.0

[akeeman]

There's some more information in this ticket: tiran/defusedxml#38, short summary, the module isn't going away until there's some alternative.

So Zeep is using defusedxml while deprecated while there is no alternative and it's not likely to not go away anytime soon.
Normally there are two things that can happen: (1) Zeep switches to something else (not available so not a real option) or (2) defusedxml removes the warning for now (not a Zeep issue). A nasty third could be to suppress the warning in Zeep, but that hides the fact that it is what it is: using a deprecated third party feature.

So I'd say it's your decision if you want the warning to be gone: (run before importing zeep stuff)

import warnings
warnings.filterwarnings("ignore", "defusedxml.lxml is no longer supported and will be removed in a future release.", DeprecationWarning)

Or just filter in the log:

import logging

logging.getLogger(*you logger here*).addFilter(lambda record: "defusedxml.lxml is no longer supported" not in message)
# may be:
# logging.root.addFilter(lambda record: "defusedxml.lxml is no longer supported" not in message)

[xmo-odoo]

According to defusedxml and lxml's own documentation, there's no need for a replacement because the protection of defused are largely built into lxml: when parsing a document it's possible to opt-out of resolving entities (which is the primary "internal" vulnerability of lxml according to defused's table), and then do whatever is desirable on the Entity nodes that leaves in the document, whether it's ignoring them, asserting there are none, stripping them out, or even resolving an acceptable subset of them. All that's missing is at best some amount of convenience for the latter part (deciding what to do with the entity nodes if they don't get resolved).