GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080) · Issue #149017 · python/cpython

Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080) #149017

New issue
Copy link
New issue
Copy link
Closed
Closed
Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)#149017
Copy link
Assignees
StanFromIreland
Labels
3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issueA security issue

Description

@hartwork
hartwork
opened on Apr 26, 2026
Issue body actions

Please see blog post https://blog.hartwork.org/posts/expat-2-8-0-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #146083 (predecessor for Expat 2.7.5)

Linked PRs

  • gh-149017: Upgrade bundled Expat to 2.8.0 #149020
  • [3.14] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) #149073
  • [3.13] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073) #149099
  • [3.12] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073) #150007
  • [3.11] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) #149074
  • [3.10] gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) #149075
Reacted by Gregory P. Smith and Saif Ul Islam

Activity

Next
  1. picnixz
    added
    type-securityA security issueA security issue
    extension-modulesC modules in the Modules dirC modules in the Modules dir
    topic-XML
    on Apr 26, 2026
  2. StanFromIreland
    self-assigned this
    on Apr 26, 2026
  3. StanFromIreland commented on Apr 26, 2026

    @StanFromIreland
    StanFromIreland
    on Apr 26, 2026
    Member
    More actions

    Oh you beat me this time! ;-)

    Reacted by Sebastian Pipping
  4. StanFromIreland
    added
    3.11only security fixesonly security fixes
    3.10 (EOL)end of lifeend of life
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    on Apr 26, 2026
  5. StanFromIreland
    marked this as blocked on Apr 26, 2026
    • Upgrade bundled Expat to 2.7.5 (e.g. for the fixes to CVE-2026-3277{6,7,8}) #146083
  6. gpshead
    added
    release-blocker
    on Apr 27, 2026
  7. github-project-automation
    added this to Release and Deferred blockers 🚫on Apr 27, 2026
  8. github-project-automation
    moved this to Todo in Release and Deferred blockers 🚫on Apr 27, 2026
  9. 8 remaining items

  10. StanFromIreland
    marked this as blocking on May 11, 2026
    • Upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186) #149698
  11. hugovk
    changed the title [-][security] Please upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/-] [+][security] Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/+] on May 11, 2026
  12. hugovk
    changed the title [-][security] Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/-] [+]Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/+] on May 11, 2026
  13. StanFromIreland
    added a commit that references this issue on May 14, 2026

    [3.13] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (#149099)

    ae31e50
  14. StanFromIreland
    removed
    3.13only security fixesonly security fixes
    on May 17, 2026
  15. Yhg1s
    added a commit that references this issue on May 18, 2026

    [3.12] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073…

    aeb348e
  16. StanFromIreland
    removed
    3.12only security fixesonly security fixes
    on Jun 2, 2026
  17. pablogsal
    added 2 commits that reference this issue on Aug 10, 2026

    [3.10] gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) (#149075)

    fd0256f

    [3.11] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (#149074)

    00615a4
  18. StanFromIreland
    closed this as completedon Aug 10, 2026
  19. github-project-automation
    moved this from In Progress to Done in Release and Deferred blockers 🚫on Aug 10, 2026
  20. hartwork commented on Aug 10, 2026

    @hartwork
    hartwork
    on Aug 10, 2026
    ContributorAuthor
    More actions

    @StanFromIreland the labels "3.10" and "3.11" look like leftovers here now. Is that true or intended to be and remain like that? I'm curious.

  21. StanFromIreland commented on Aug 10, 2026

    @StanFromIreland
    StanFromIreland
    on Aug 10, 2026
    Member
    More actions

    Once the issue is closed it doesn’t really matter to be honest.

  22. hartwork commented on Aug 10, 2026

    @hartwork
    hartwork
    on Aug 10, 2026
    ContributorAuthor
    More actions

    @StanFromIreland I see, thanks for your reply!

  23. icanhasmath
    added a commit that references this issue on Oct 28, 2026

    [3.10] pythongh-149017: Upgrade bundled Expat to 2.8.0 (python#149020) (

    f45ef9e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @StanFromIreland
    StanFromIreland

Labels

3.10 (EOL)end of lifeend of life3.11only security fixesonly security fixesextension-modulesC modules in the Modules dirC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issueA security issue

Projects

  • Release and Deferred blockers 🚫
    Status
    Done
    Show more project fields

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.