GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.9] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) by StanFromIreland · Pull Request #139055 · python/cpython

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Sep 17, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member

(cherry picked from commit 64c876d)

  • Issue: Upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375) #138998

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@StanFromIreland
[3.9] pythongh-138998: Upgrade vendored expat to 2.7.2 (pythonGH-138999)
efe2c7d 
(cherry picked from commit 64c876d)

Co-authored-by: Stan Ulbrych <[email protected]>
@bedevere-app bedevere-app Bot added the awaiting review label Sep 17, 2025
This was referenced Sep 17, 2025
Upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375) #138998
Closed
gh-138998: Upgrade vendored expat to 2.7.2 #138999
Merged
@gpshead gpshead added the release-blocker label Sep 18, 2025
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Sep 18, 2025
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Sep 18, 2025
gpshead
gpshead approved these changes Sep 18, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Sep 18, 2025
@picnixz picnixz mentioned this pull request Sep 24, 2025
gh-90949: add Expat API to prevent XML deadly allocations #139234
Merged
@picnixz

picnixz commented Sep 24, 2025

Copy link
Copy Markdown
Member

Please see the rationale of possibly NOT merging this one as 3.9 is almost EOL: #139234 (comment).
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz picnixz added the DO-NOT-MERGE label Sep 24, 2025
@picnixz

picnixz commented Sep 26, 2025

Copy link
Copy Markdown
Member

After some discussion, and since 3.9 is nearing its EOL, we won't include this in the last release of 3.9. Including it means that we could be stuck with non-configurable defaults if we don't manage to perfectly land #139234.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz picnixz closed this Sep 26, 2025
@github-project-automation github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫 Sep 26, 2025
@StanFromIreland
StanFromIreland deleted the backport-64c876d-3.9 branch September 26, 2025 15:03
@StanFromIreland
StanFromIreland restored the backport-64c876d-3.9 branch October 7, 2025 12:25
@StanFromIreland StanFromIreland reopened this Oct 7, 2025
@github-project-automation github-project-automation Bot moved this from Done to In Progress in Release and Deferred blockers 🚫 Oct 7, 2025
@StanFromIreland

StanFromIreland commented Oct 7, 2025

Copy link
Copy Markdown
Member Author

CC @ambv
ambv reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@picnixz picnixz removed the DO-NOT-MERGE label Oct 7, 2025
@ambv
ambv merged commit f3d8338 into python:3.9 Oct 7, 2025
5 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@github-project-automation github-project-automation Bot moved this from In Progress to Done in Release and Deferred blockers 🚫 Oct 7, 2025
@bedevere-app bedevere-app Bot removed the awaiting merge label Oct 7, 2025
@StanFromIreland
StanFromIreland deleted the backport-64c876d-3.9 branch February 5, 2026 16:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

release-blocker

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@StanFromIreland @picnixz @gpshead @ambv
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.