GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-131809: Upgrade vendored expat to 2.7.1 by gpshead · Pull Request #132192 · python/cpython

Conversation

@gpshead

@gpshead gpshead commented Apr 7, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: Please upgrade bundled Expat to 2.7.1 #131809

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@gpshead
pythongh-131809: Upgrade vendored expat to 2.7.1
22d52f2
@gpshead gpshead added type-security A security issue needs backport to 3.9 release-blocker needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes labels Apr 7, 2025
@gpshead
gpshead requested a review from sethmlarson as a code owner April 7, 2025 04:08
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Apr 7, 2025
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Apr 7, 2025
@bedevere-app bedevere-app Bot added the awaiting core review label Apr 7, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Apr 7, 2025
Please upgrade bundled Expat to 2.7.1 #131809
Closed
@gpshead gpshead moved this from Todo to In Progress in Release and Deferred blockers 🚫 Apr 7, 2025
@gpshead
news blurb
108a6b3
@gpshead gpshead added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Apr 7, 2025
@bedevere-bot

bedevere-bot commented Apr 7, 2025

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @gpshead for commit 108a6b3 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F132192%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Apr 7, 2025
@hugovk hugovk mentioned this pull request Apr 7, 2025
Please upgrade bundled Expat to 2.7.0 (e.g. for the fix to CVE-2024-8176) #131261
Closed
@sethmlarson sethmlarson mentioned this pull request Apr 7, 2025
gh-131809: Upgrade libexpat to 2.7.1 #132235
Closed
sethmlarson
sethmlarson approved these changes Apr 7, 2025
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sethmlarson

sethmlarson commented Apr 7, 2025

Copy link
Copy Markdown
Contributor

I can handle the backports for this PR once merged. Buildbot failures don't look relevant.
gpshead reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@hugovk
hugovk merged commit c0de650 into python:main Apr 7, 2025
@bedevere-app bedevere-app Bot removed the awaiting core review label Apr 7, 2025
@github-project-automation github-project-automation Bot moved this from In Progress to Done in Release and Deferred blockers 🚫 Apr 7, 2025
@miss-islington-app

miss-islington-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

Thanks @gpshead for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 7, 2025
@gpshead @miss-islington
pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)
fa241f8 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 7, 2025
@gpshead @miss-islington
pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)
622489a 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
@miss-islington-app

miss-islington-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @hugovk, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c0de6500249469e6fc5b458d6afb6bad1b6755cd 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

GH-132236 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Apr 7, 2025
@miss-islington-app miss-islington-app Bot assigned hugovk Apr 7, 2025
@miss-islington-app

miss-islington-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @hugovk, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c0de6500249469e6fc5b458d6afb6bad1b6755cd 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

GH-132237 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Apr 7, 2025
@miss-islington-app

miss-islington-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

Sorry, @gpshead and @hugovk, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c0de6500249469e6fc5b458d6afb6bad1b6755cd 3.9
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Apr 7, 2025
@gpshead @sethmlarson
[3.11] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192
be68c3d 
)

(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

GH-132240 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Apr 7, 2025
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Apr 7, 2025
@gpshead @sethmlarson
[3.10] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192
de980b7 
)

(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

GH-132241 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Apr 7, 2025
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Apr 7, 2025
@gpshead @sethmlarson
[3.9] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)
899f79b 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
@bedevere-app

bedevere-app Bot commented Apr 7, 2025

Copy link
Copy Markdown

GH-132242 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.9 label Apr 7, 2025
gpshead added a commit that referenced this pull request Apr 7, 2025
@miss-islington @gpshead
[3.12] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132237)
ed01daf 
* gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192)
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>

* make regen-sbom

---------

Co-authored-by: Gregory P. Smith <[email protected]>
gpshead added a commit that referenced this pull request Apr 7, 2025
@miss-islington @gpshead
[3.13] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132236)
ac9d7c6 
* gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192)
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>

* make regen-sbom

---------

Co-authored-by: Gregory P. Smith <[email protected]>
Yhg1s pushed a commit that referenced this pull request Apr 8, 2025
@sethmlarson @gpshead
[3.9] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132242)
12deea5 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
Yhg1s pushed a commit that referenced this pull request Apr 8, 2025
@sethmlarson @gpshead
[3.10] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132241)
53d4eaa 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
Yhg1s pushed a commit that referenced this pull request Apr 8, 2025
@sethmlarson @gpshead
[3.11] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132240)
553d706 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <[email protected]>
@hartwork hartwork mentioned this pull request Sep 16, 2025
Upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375) #138998
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sethmlarson sethmlarson sethmlarson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@hugovk hugovk

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@gpshead @bedevere-bot @sethmlarson @hugovk
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.