Sean WhalenandClaude Fable 5 571bbf741b Guarantee non-empty xml_schema: <feedback> identifies the report, not <version> ...

The <feedback> XML root element (anchored at the top of
parse_aggregate_report_xml) is what identifies an aggregate report;
<version> is optional metadata per RFC 7489 Appendix C. The "draft"
fallback only covered a fully absent <version>: an empty <version/>
(which xmltodict parses as None) or a whitespace-only value produced
xml_schema=None, which the flat-row serializer coerced to "" — and any
consumer detecting aggregate rows by a non-empty xml_schema, such as
the Google SecOps CBN parser's report-type cascade, silently dropped
the row. The fallback now applies unless <version> carries non-empty
text (attribute-wrapped values are unwrapped via _text like other
elements).

The regression test fails on the previous code with
xml_schema=None != "draft".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-11 15:52:47 -04:00

..

__init__.py

Split tests.py into per-module tests/test_<module>.py (#774)

2026-05-20 19:29:09 -04:00

test_cli.py

Add Google SecOps (Chronicle) output via the v1 events.import API

2026-07-11 15:08:31 -04:00

test_elastic.py

Fix failure-report timestamp skew on non-UTC hosts in ES/OpenSearch/Splunk outputs (#812)

2026-07-09 19:45:34 -04:00

test_gelf.py

Make the whole codebase pass pyright cleanly and enforce it in CI (#798)

2026-06-12 21:33:01 -04:00

test_gsecops.py

Add Google SecOps (Chronicle) output via the v1 events.import API

2026-07-11 15:08:31 -04:00

test_init.py

Guarantee non-empty xml_schema: <feedback> identifies the report, not <version>

2026-07-11 15:52:47 -04:00

test_kafkaclient.py

Make the whole codebase pass pyright cleanly and enforce it in CI (#798)

2026-06-12 21:33:01 -04:00

test_loganalytics.py

Expand honest test coverage from 59% to 83%; fix two latent bugs (#775)

2026-05-20 20:35:22 -04:00

test_maps.py

Split tests.py into per-module tests/test_<module>.py (#774)

2026-05-20 19:29:09 -04:00

test_opensearch.py

Fix failure-report timestamp skew on non-UTC hosts in ES/OpenSearch/Splunk outputs (#812)

2026-07-09 19:45:34 -04:00

test_postgres.py

Cover both arms of the optional psycopg import in postgres.py (#799)

2026-06-12 21:48:20 -04:00

test_s3.py

Declare backward-compatible method aliases inside class bodies (#797)

2026-06-12 20:50:47 -04:00

test_splunk.py

Fix failure-report timestamp skew on non-UTC hosts in ES/OpenSearch/Splunk outputs (#812)

2026-07-09 19:45:34 -04:00

test_syslog.py

Make the whole codebase pass pyright cleanly and enforce it in CI (#798)

2026-06-12 21:33:01 -04:00

test_utils.py

Stop system GeoIP files from shadowing the bundled IPinfo database (#813)

2026-07-09 20:07:00 -04:00

test_webhook.py

Declare backward-compatible method aliases inside class bodies (#797)

2026-06-12 20:50:47 -04:00

tzutil.py

Fix failure-report timestamp skew on non-UTC hosts in ES/OpenSearch/Splunk outputs (#812)

2026-07-09 19:45:34 -04:00