GeezerVison

Summary

Replace the earlier vendored implementation with an independent, non-vendored XML compatibility split from #8954.

• Keep the existing registry xml 1.4.0 dependency and its existing expansion limits. No Cargo changes, vendored files or updater-tool changes remain in this PR's diff.
• Improve namespace callbacks, parser-error propagation, handler-return validation and ElementTree error reporting through the published backend's APIs.
• Update 12 XML library/test files from CPython 3.15.0, commit d220409a13b77de7a6c30abe16ea90db01528edc, using the existing scripts/update_lib tool.
• Remove 25 existing expected-failure decorators demonstrated stale by canonical tests. Test bodies/assertions are unchanged; unproven markers remain.

The previous custom backend supplied cumulative amplification-accounting APIs absent from the published crate. This replacement excludes those APIs instead of vendoring the backend. Its pre-existing fixed expansion protections are unchanged.

Fresh validation

The local validation below was run on replacement commit dcff68be451106be0de358b266152b424c837eda against pinned main 75df7a8c2e47f981163792fe0154d698c28bcf93. The subsequent one-decorator follow-up is described separately below:

• Locked, offline, single-job build with --no-default-features --features stdlib,stdio,importlib,host_env,threading: passed.
• Targeted rustpython-stdlib library Clippy with -D warnings: passed.
• Exactly 52 canonical observations in five bounded processes: 49 successes and 3 expected failures, with no unexpected successes, failures, errors or skips. Coverage includes XML validators, SAX/DOM consumers, pure/native ElementTree cases, handler-return errors, and three isolated parent-parser constructor/reference-drop methods.
• The three retained expected failures document incomplete reparse-enabled callback timing and two malformed-input error-message differences.
• A fresh build initially reached its 40-minute execution limit. A separately reviewed same-source continuation preserved completed dependencies, rebuilt unfinished VM/stdlib/root components, and completed build and Clippy. The timed-out attempt is not counted as a successful build.

The 52 local observations are not a complete XML-suite or workspace validation. On replacement commit dcff68be, Linux, macOS and Windows canonical CI found one stale expected-failure marker: ExpatReaderTest.test_expat_external_dtd_enabled passed unexpectedly in each initial run and rerun. This follow-up removes that decorator through update_lib, leaving assertions unchanged. The test validates external resolver dispatch and the expected unsupported-scheme URLError, not successful external DTD parsing. Correctness CI for dcff68be has finished: all other jobs passed; native canonical jobs failed only on this stale marker. On follow-up commit 4eb7a6889f08c93c6b459f7daeba7bae82364aac, all three native canonical jobs and the other 20 correctness jobs passed; Lib Dependencies also passed. The remaining Linux Rust job reached its 45-minute execution limit during sandbox-mode compilation and was cancelled, so full CI is not green. A targeted rerun request using the PR author account was denied because repository admin rights are required; a maintainer rerun is needed. Earlier broad results in this PR applied to the superseded vendored implementation, not this replacement.

Remaining limitations

• Cumulative amplification-limit setters remain unsupported; existing published-backend fixed limits are not weakened.
• External child-parser construction/inherited state does not implement parsing external DTDs or entity fragments; feeding those inputs still raises NotImplementedError.
• Namespace maps cannot preserve redundant same-URI declarations or arbitrary declaration order.
• Reparse settings do not provide full Expat deferred-callback timing or buffered-WASM performance/security parity.
• The bounded local validation did not run broad lifecycle/GC, allocation-failure, entity-expansion, external-resolution or network suites. The isolated constructor methods create at most three parsers without feeding XML or explicitly invoking GC.
• Reviewed reads use three exact local canonical fixtures. Audit hooks provide defense in depth, not complete audit-event coverage or kernel isolation.
• The shared XMLGenerator method passed in four memory-backed variants in local validation; its file-writing variant was deliberately unrun locally. CI subsequently exercised the full SAX module; this is not a claim that all unselected markers are resolved.

Commit hooks

cspell alone was skipped for the initial XML correction commit under explicit user authorization. The normal Git commit ran conflict checking, Ruff format/check, redundant-test-patches and rustfmt successfully. Prettier reported no applicable files under normal merge-hook selection. The separate exception for #9342 was not reused; no broader hook waiver applies.

For the one-line Python-only follow-up, the normal Git commit ran with SKIP unset: conflict checking, Ruff format/check and redundant-test-patches passed. Rustfmt, cspell and Prettier naturally reported no applicable files. No further hook exception was used.

AI assistance: dot assisted with extraction, canonical migration, source review and bounded validation. The exact model version is not exposed.