Release notes for sbmlutils 0.17.2

We are pleased to release the next version of sbmlutils including the following changes. This release makes flattening and the validation of comp models faster, and lifts the lower bound of requests above a security advisory.

Performance

• flatten_sbml and flatten_sbml_doc no longer validate the comp model unless asked. The new argument validate=False is passed to the option performValidation of libsbml's CompFlatteningConverter, which ran the full consistency check of the comp document before every flattening. The flat model is byte-identical; flattening the dex body model takes 0.02 s instead of 0.25 s, and the PBPK models of pkpdsim flatten in 0.15 s instead of 2.5 s. validate=True restores the check. Without the validation libsbml can flatten some invalid comp models into a wrong flat model which is itself valid, so validate a comp model which was not validated when it was written (create_model does) (#521, #522)
• a document with errors from reading it is refused before the flattening, and an error which libsbml's converter only logs, e.g. a replaced element, port or deletion it cannot resolve, now fails the flattening instead of being dropped in silence (#522)
• ValidationOptions(comp_flat_model=False) skips the check of the flat model when a comp document is validated: libsbml flattens a copy of a comp document and checks the flat model (CompFlatModelNotValid), which a workflow that flattens the model and validates the flat model anyway does twice. The validation of a PBPK model with 14 model definitions takes 1.03 s instead of 1.23 s. The default keeps the check (#523)
• the rest of the validation time of a comp model with many model definitions is libsbml checking every model definition in a copy of the whole document, which is quadratic in their number, reported as sbmlteam/libsbml#505

Security

• requests>=2.33.0 instead of requests>=2.32.4: requests before 2.33.0 extracts a file of a zip archive in extract_zipped_paths to a predictable path in the temporary directory and reuses a file which already exists there (GHSA-gc5v-m9x4-r6x2, CVE-2026-25645). sbmlutils does not call the function and pymetadata already requires requests 2.34.2, so an installation was not affected; the declared lower bound and the lowest tox environment are now above the advisory as well

Packaging and development

• the lock has the newest releases of all packages; pandas stays at 2.3.3, which cobrapy and py4cytoscape require, and tox at 4.67.4 (tox-dev/tox#4357). A scan of the lock and of the lower bounds with pip-audit finds no known vulnerability