upgrade ruff

[woutdenolf]

No description provided.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[loichuder]

What about the defusedxml change? Was this triggered by a ruff rule violation?

Should we not change it for every xml invocation, then?

[woutdenolf]

Should we not change it for every xml invocation, then?

It is already fully used: parse and minidom.

S318 Using `xml` to parse untrusted data is known to be vulnerable to XML attacks; use `defusedxml` equivalents
  --> src/ewoksdraw/svg/svg_canvas.py:31:11
   |
29 |     )
30 |
31 |     dom = minidom.parseString(svg_string)
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
32 |     return dom.toprettyxml(indent="  ")
   |

S314 Using `xml` to parse untrusted data is known to be vulnerable to XML attacks; use `defusedxml` equivalents
  --> src/ewoksdraw/tests/test_graph_to_svg.py:13:12
   |
12 | def _get_svg_groups(output_path: Path):
13 |     tree = ElementTree.parse(output_path)
   |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
14 |     root = tree.getroot()
15 |     return [child for child in root if child.tag.endswith("g")]
   |

S314 Using `xml` to parse untrusted data is known to be vulnerable to XML attacks; use `defusedxml` equivalents
  --> src/ewoksdraw/tests/test_svg_path_integration.py:43:12
   |
41 |     assert output_path.is_file()
42 |
43 |     tree = ElementTree.parse(output_path)
   |            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
44 |     root = tree.getroot()
   |

Found 3 errors.
29 files left unchanged

[loichuder]

I was alluding to

from xml.etree.ElementTree import Element
from xml.etree.ElementTree import tostring

in src/ewoksdraw/svg/svg_canvas.py.

But these seem safe then.