GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-126623: Update libexpat to 2.6.4, make future updates easier by sethmlarson · Pull Request #126792 · python/cpython

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Nov 13, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

This upgrades libexpat to 2.6.4 but also adds a refresh.sh script to make future updates easier. Used the refresh.sh script for HACL* as a reference. Willing to create the backport PRs myself as this diff won't apply cleanly to 3.11 and earlier.

cc @hartwork

  • Issue: Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602) #126623

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead reacted with heart emoji
All reactions
  • ❤️ 1 reaction
@sethmlarson sethmlarson added type-security A security issue 3.14 bugs and security fixes labels Nov 13, 2024
@bedevere-app bedevere-app Bot added the awaiting review label Nov 13, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Nov 13, 2024
Please upgrade bundled Expat to 2.6.4 (e.g. for the fix to CVE-2024-50602) #126623
Closed
@sethmlarson
sethmlarson force-pushed the libexpat-2.6.4 branch from 97d863d to 278df3c Compare November 13, 2024 17:12
sethmlarson
sethmlarson commented Nov 13, 2024
View reviewed changes
Comment thread Modules/expat/expat_external.h

/* Namespace external symbols to allow multiple libexpat version to
co-exist. */
#include "pyexpatns.h"

@sethmlarson sethmlarson Nov 13, 2024

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved this so we have an easier anchor point for sed.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead reacted with thumbs up emoji
All reactions
  • 👍 1 reaction
@sethmlarson
Update libexpat to 2.6.4, make future updates easier
1e8a6fb
@sethmlarson
sethmlarson force-pushed the libexpat-2.6.4 branch from 278df3c to 1e8a6fb Compare November 13, 2024 17:57
@sethmlarson
sethmlarson requested a review from gpshead November 13, 2024 18:01
@gpshead gpshead added needs backport to 3.9 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Nov 13, 2024
gpshead
gpshead approved these changes Nov 13, 2024
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Nov 13, 2024
@gpshead
gpshead enabled auto-merge (squash) November 13, 2024 18:26
@gpshead
gpshead merged commit 3c99969 into python:main Nov 13, 2024
@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 13, 2024
@miss-islington-app

miss-islington-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@sethmlarson
sethmlarson deleted the libexpat-2.6.4 branch November 13, 2024 18:31
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 13, 2024
@sethmlarson @miss-islington
pythongh-126623: Update libexpat to 2.6.4, make future updates easier (…
66d95bb 
…pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

GH-126796 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Nov 13, 2024
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Nov 13, 2024
@sethmlarson @miss-islington
pythongh-126623: Update libexpat to 2.6.4, make future updates easier (…
a16c365 
…pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

GH-126797 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Nov 13, 2024
@miss-islington-app

miss-islington-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 3c9996909402fadc98e6ca2a64e75a71a7427352 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned gpshead Nov 13, 2024
@miss-islington-app

miss-islington-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 3c9996909402fadc98e6ca2a64e75a71a7427352 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app

miss-islington-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

Sorry, @sethmlarson and @gpshead, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 3c9996909402fadc98e6ca2a64e75a71a7427352 3.9
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Nov 13, 2024
@sethmlarson
[3.11] pythongh-126623: Update libexpat to 2.6.4, make future updates…
fbff1ae 
… easier (pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

GH-126798 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Nov 13, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Nov 13, 2024
@sethmlarson
[3.10] pythongh-126623: Update libexpat to 2.6.4, make future updates…
f2949e2 
… easier (pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

GH-126799 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Nov 13, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Nov 13, 2024
@sethmlarson
[3.9] pythongh-126623: Update libexpat to 2.6.4, make future updates …
a60574e 
…easier (pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
@bedevere-app

bedevere-app Bot commented Nov 13, 2024

Copy link
Copy Markdown

GH-126800 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label Nov 13, 2024
sethmlarson added a commit to sethmlarson/cpython that referenced this pull request Nov 13, 2024
@sethmlarson
[3.8] pythongh-126623: Update libexpat to 2.6.4, make future updates …
7d48f06 
…easier (pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
gpshead pushed a commit that referenced this pull request Nov 13, 2024
@miss-islington @sethmlarson
[3.12] gh-126623: Update libexpat to 2.6.4, make future updates easier (
9e86d21 
GH-126792) (GH-126797)

gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
gpshead pushed a commit that referenced this pull request Nov 13, 2024
@miss-islington @sethmlarson
[3.13] gh-126623: Update libexpat to 2.6.4, make future updates easier (
1d6ba84 
GH-126792) (GH-126796)

gh-126623: Update libexpat to 2.6.4, make future updates easier (GH-126792)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)

Co-authored-by: Seth Michael Larson <[email protected]>
ambv pushed a commit that referenced this pull request Dec 2, 2024
@sethmlarson
[3.10] gh-126623: Update libexpat to 2.6.4, make future updates easier (
b3a6042 
GH-126792) (GH-126799)

(cherry picked from commit 3c99969)
ambv pushed a commit that referenced this pull request Dec 2, 2024
@sethmlarson
[3.9] gh-126623: Update libexpat to 2.6.4, make future updates easier (…
6b8f442 
…GH-126792) (GH-126800)

(cherry picked from commit 3c99969)
ambv pushed a commit that referenced this pull request Dec 3, 2024
@sethmlarson
[3.11] gh-126623: Update libexpat to 2.6.4, make future updates easier (
2e161e2 
GH-126792) (GH-126798)

Update libexpat to 2.6.4, make future updates easier.
(cherry picked from commit 3c99969)
picnixz pushed a commit to picnixz/cpython that referenced this pull request Dec 8, 2024
@sethmlarson @picnixz
pythongh-126623: Update libexpat to 2.6.4, make future updates easier (…
115a7b3 
…pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
ebonnal pushed a commit to ebonnal/cpython that referenced this pull request Jan 12, 2025
@sethmlarson @ebonnal
pythongh-126623: Update libexpat to 2.6.4, make future updates easier (…
6fd470f 
…pythonGH-126792)

Update libexpat to 2.6.4, make future updates easier.
@hartwork hartwork mentioned this pull request Mar 14, 2025
Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

3.14 bugs and security fixes type-security A security issue

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@sethmlarson @gpshead
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402520 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.