Skip to content

Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080) #149017

Closed
Closed
Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)#149017
Assignees
StanFromIreland
Labels
3.10 (EOL)end of life3.11only security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issue

Description

@hartwork
hartwork
opened on Apr 26, 2026

Please see blog post https://blog.hartwork.org/posts/expat-2-8-0-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #146083 (predecessor for Expat 2.7.5)

Linked PRs

Activity

  1. StanFromIreland
    added a commit that references this issue on Apr 27, 2026

    gh-149017: Upgrade bundled Expat to 2.8.0 (#149020)

    005555a
  2. StanFromIreland
    removed
    3.15bugs and security fixes
    on Apr 27, 2026
  3. StanFromIreland
    moved this from Todo to In Progress in Release and Deferred blockers 🚫on Apr 27, 2026
  4. hugovk
    added a commit that references this issue on Apr 28, 2026

    [3.14] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (#149073)

    c181c5f
  5. StanFromIreland
    removed
    3.14bugs and security fixes
    on Apr 28, 2026

  6. hartwork commented on May 11, 2026

    @hartwork
    hartwork
    on May 11, 2026
    ContributorAuthor

    @StanFromIreland I just noticed that a pull request for 3.12 is missing from the list above (while both 3.11 and 3.13 are included). I there some intention that I may be missing?

  7. StanFromIreland commented on May 11, 2026

    @StanFromIreland
    StanFromIreland
    on May 11, 2026
    Member

    I there some intention that I may be missing?

    The #146605 hasn't been merged yet so it can't be created.

  8. hartwork commented on May 11, 2026

    @hartwork
    hartwork
    on May 11, 2026
    ContributorAuthor

    I there some intention that I may be missing?

    The #146605 hasn't been merged yet so it can't be created.

    @StanFromIreland that makes sense — thank you! 👍

  9. StanFromIreland
    marked this as blocking on May 11, 2026
  10. hugovk
    changed the title [-][security] Please upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/-] [+][security] Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/+] on May 11, 2026
  11. hugovk
    changed the title [-][security] Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/-] [+]Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/+] on May 11, 2026
  12. StanFromIreland
    added a commit that references this issue on May 14, 2026

    [3.13] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (#149099)

    ae31e50
  13. StanFromIreland
    removed
    3.13only security fixes
    on May 17, 2026
  14. Yhg1s
    added a commit that references this issue on May 18, 2026

    [3.12] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073…

    aeb348e
  15. StanFromIreland
    removed
    3.12only security fixes
    on Jun 2, 2026
  16. pablogsal
    added 2 commits that reference this issue on Aug 10, 2026

    [3.10] gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) (#149075)

    fd0256f

    [3.11] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (#149074)

    00615a4
  17. StanFromIreland
    closed this as completedon Aug 10, 2026
  18. github-project-automation
    moved this from In Progress to Done in Release and Deferred blockers 🚫on Aug 10, 2026

  19. hartwork commented on Aug 10, 2026

    @hartwork
    hartwork
    on Aug 10, 2026
    ContributorAuthor

    @StanFromIreland the labels "3.10" and "3.11" look like leftovers here now. Is that true or intended to be and remain like that? I'm curious.

  20. StanFromIreland commented on Aug 10, 2026

    @StanFromIreland
    StanFromIreland
    on Aug 10, 2026
    Member

    Once the issue is closed it doesn’t really matter to be honest.

  21. hartwork commented on Aug 10, 2026

    @hartwork
    hartwork
    on Aug 10, 2026
    ContributorAuthor

    @StanFromIreland I see, thanks for your reply!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions