Description

hartwork

opened on Mar 27, 2025

Issue body actions

Bug report

Bug description:

Hi! 👋

Please upgrade bundled Expat to 2.7.1 (e.g. for the fix to what can be argued a regression that came with the fix for CVE-2024-8176 in Expat 2.7.0).

• GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_7_1
• Change log: https://github.com/libexpat/libexpat/blob/R_2_7_1/expat/Changes

The CPython issue for previous 2.7.0 was #131261 and the related merged main pull request was #131272, in case you want to have a look. The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CC @sethmlarson @gpshead

CPython versions tested on:

3.9, 3.10, CPython main branch, 3.14, 3.13, 3.12, 3.11

Operating systems tested on:

Other, Windows, macOS, Linux

Linked PRs

• gh-131809: Upgrade vendored expat to 2.7.1 #132192
• gh-131809: Upgrade libexpat to 2.7.1 #132235
• [3.13] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) #132236
• [3.12] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) #132237
• [3.11] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) #132240
• [3.10] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) #132241
• [3.9] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) #132242

Activity

1. hartwork

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Mar 27, 2025
2. ZeroIntensity

   added

   type-securityA security issueA security issue

   topic-XML

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   3.12only security fixesonly security fixes

   3.13only security fixesonly security fixes

   3.14bugs and security fixesbugs and security fixes

   and removed

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   on Mar 27, 2025
3. picnixz

   added

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   on Mar 28, 2025
4. gpshead

   added

   release-blocker

   and removed

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   on Mar 28, 2025
5. ezio-melotti

   added this to Release and Deferred blockers 🚫on Mar 28, 2025
6. github-project-automation

   moved this to Todo in Release and Deferred blockers 🚫on Mar 28, 2025
7. 4 remaining items
8. hugovk

   added a commit that references this issue on Apr 7, 2025

   gh-131809: Upgrade vendored expat to 2.7.1 (#132192)

   c0de650
9. miss-islington

   added 2 commits that reference this issue on Apr 7, 2025

   pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)

   fa241f8

   pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)

   622489a
10. sethmlarson

    added 3 commits that reference this issue on Apr 7, 2025

    [3.11] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192

    be68c3d

    [3.10] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192

    de980b7

    [3.9] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)

    899f79b
11. gpshead

    added 2 commits that reference this issue on Apr 7, 2025

    [3.12] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132237)

    ed01daf

    [3.13] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132236)

    ac9d7c6
12. Yhg1s

    added 3 commits that reference this issue on Apr 8, 2025

    [3.9] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132242)

    12deea5

    [3.10] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132241)

    53d4eaa

    [3.11] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132240)

    553d706
13. ambv

    closed this as completedon Apr 8, 2025
14. github-project-automation

    moved this from In Progress to Done in Release and Deferred blockers 🚫on Apr 8, 2025
15. hartwork commented on Apr 8, 2025

    

    hartwork

    on Apr 8, 2025

    ContributorAuthor

    More actions

    @gpshead @sethmlarson thank you! 🙏
16. rochebeard-byte commented on May 13, 2025

    

    rochebeard-byte

    on May 13, 2025 · Hidden as spam

    show commentMore actions

Issue actions