lxml 6.0.0 is not supported

[harshitsengar]

https://pypi.org/project/lxml/#history

A new version was released by lxml and our requirements.txt needs version lxml>=4.6.5

However with the latest version connector is failing

[setrawicana]

Hi, following up with this, lxml@5.4.0 has been marked to have Stack-based Buffer Overflow by Checkmarx (CVE-2025-6170). According to it, the remediate to this vulnerability is on 6.0.2 fyi

[jamesdow21]

What was the problem that lxml >= 6.0 was causing?

As far as I can tell, lxml is only used within redshift_connector as the specified parser for BeautifulSoup4 when parsing SAML responses within the Active Directory Federation Services Identity Provider plugin in redshift_connecter/plugin/adfs_credentials_provider.py

The modified dependency with the upper bound makes it impossible to install redshift_connector on Python 3.14 (without building lxml from source).

If the upper bound is left in place instead of fixing the underlying problem, then redshift_connector is effectively ending support at Python 3.13

[jamesdow21]

@timm4205 I see that you have made the past couple of releases for this library

Can you weigh in on this issue and/or the related #265?