Update dependency lxml to v6.1.0 [SECURITY] (#4823)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [lxml](https://lxml.de/)
([source](https://redirect.github.com/lxml/lxml),
[changelog](https://git.launchpad.net/lxml/plain/CHANGES.txt)) | `6.0.2`
→ `6.1.0` |
![age](https://developer.mend.io/api/mc/badges/age/pypi/lxml/6.1.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/lxml/6.0.2/6.1.0?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2026-41066](https://redirect.github.com/lxml/lxml/security/advisories/GHSA-vfmq-68hx-4jfw)

### Impact
Using either of the two parsers in the default configuration (with
`resolve_entities=True`) allows untrusted XML input to read local files.

### Patches
lxml 6.1.0 changes the default to `resolve_entities='internal'`, thus
disallowing local file access by default.

### Workarounds
Setting the `resolve_entities` option explicitly to
`resolve_entities='internal'` or `resolve_entities=False` disables the
local file access.

### Resources
Original report: https://bugs.launchpad.net/lxml/+bug/2146291

The default option was changed to `resolve_entities='internal'` for the
normal XML and HTML parsers in lxml 5.0. The default was not changed for
`iterparse()` and `ETCompatXMLParser()` at the time. lxml 6.1 makes the
safe option the default for all parsers.

---

### Release Notes

<details>
<summary>lxml/lxml (lxml)</summary>

###
[`v6.1.0`](https://redirect.github.com/lxml/lxml/blob/HEAD/CHANGES.txt#610-2026-04-17)

[Compare
Source](https://redirect.github.com/lxml/lxml/compare/lxml-6.0.4...lxml-6.1.0)

\==================

This release fixes a possible external entity injection (XXE)
vulnerability in
`iterparse()` and the `ETCompatXMLParser`.

## Features added

- [GH#486](https://redirect.github.com/GH/lxml/issues/486): The HTML
ARIA accessibility attributes were added to the set of safe attributes
in `lxml.html.defs`. This allows `lxml_html_clean` to pass them through.
  Patch by oomsveta.

- The default chunk size for reading from file-likes in `iterparse()` is
now configurable
  with a new `chunk_size` argument.

## Bugs fixed

- [LP#2146291](https://redirect.github.com/LP/lxml/issues/2146291): The
`resolve_entities` option was still set to `True` for
`iterparse` and `ETCompatXMLParser`, allowing for external entity
injection (XXE)
  when using these parsers without setting this option explicitly.
The default was now changed to `'internal'` only (as for the normal XML
and HTML parsers
  since lxml 5.0).
  Issue found by Sihao Qiu as CVE-2026-41066.

###
[`v6.0.4`](https://redirect.github.com/lxml/lxml/blob/HEAD/CHANGES.txt#604-2026-04-12)

[Compare
Source](https://redirect.github.com/lxml/lxml/compare/lxml-6.0.3...lxml-6.0.4)

\==================

## Bugs fixed

- [LP#2148019](https://redirect.github.com/LP/lxml/issues/2148019):
Spurious MemoryError during namespace cleanup.

###
[`v6.0.3`](https://redirect.github.com/lxml/lxml/blob/HEAD/CHANGES.txt#603-2026-04-09)

[Compare
Source](https://redirect.github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.0.3)

\==================

## Bugs fixed

- Several out of memory error cases now raise `MemoryError` that were
not handled before.

- Slicing with large step values (outside of `+/- sys.maxsize`) could
trigger undefined C behaviour.

- [LP#2125399](https://redirect.github.com/LP/lxml/issues/2125399): Some
failing tests were fixed or disabled in PyPy.

- [LP#2138421](https://redirect.github.com/LP/lxml/issues/2138421):
Memory leak in error cases when setting the `public_id` or `system_url`
of a document.

- Memory leak in case of a memory allocation failure when copying
document subtrees.

- When mapping an XPath result to Python failed, the result memory could
leak.

- When preparing an XSLT transform failed, the XSLT parameter memory
could leak.

## Other changes

- Built using Cython 3.2.4.

- Binary wheels use zlib 1.3.2.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Renovate
Bot](https://redirect.github.com/renovatebot/renovate).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45OS4wIiwidXBkYXRlZEluVmVyIjoiNDIuOTkuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->

Co-authored-by: tmt-renovate-bot[bot] <278025917+tmt-renovate-bot[bot]@users.noreply.github.com>

Author: tmt-renovate-bot[bot]