GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-139312: Update bundled libexpat to 2.7.3 by StanFromIreland · Pull Request #139319 · python/cpython

Conversation

@StanFromIreland

@StanFromIreland StanFromIreland commented Sep 25, 2025 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Issue: Please upgrade bundled Expat to 2.7.3 (e.g. for two key bugfixes) #139312

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
StanFromIreland added 2 commits September 25, 2025 07:32
@StanFromIreland
Commit
ffe05af
@StanFromIreland
Blurb
4582d42
@StanFromIreland
StanFromIreland requested a review from gpshead September 25, 2025 06:34
@StanFromIreland
StanFromIreland requested a review from sethmlarson as a code owner September 25, 2025 06:34
@bedevere-app bedevere-app Bot added the awaiting review label Sep 25, 2025
@bedevere-app bedevere-app Bot mentioned this pull request Sep 25, 2025
Please upgrade bundled Expat to 2.7.3 (e.g. for two key bugfixes) #139312
Closed
@sethmlarson sethmlarson mentioned this pull request Sep 25, 2025
SBOM tool doesn't cross-check libexpat version and checksum against refresh.sh #139330
Closed
sethmlarson
sethmlarson requested changes Sep 25, 2025
View reviewed changes

@sethmlarson sethmlarson left a comment •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The update to the code looks fine, however the tarball checksum and versions of the expat SBOM aren't updated. This wasn't caught automatically (which I've fixed in #139331) but this PR should have the correct values before being backported.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
StanFromIreland and gpshead reacted with thumbs up emoji
All reactions
  • 👍 2 reactions
@bedevere-app bedevere-app Bot added awaiting core review and removed awaiting review labels Sep 25, 2025
@StanFromIreland StanFromIreland added DO-NOT-MERGE needs backport to 3.10 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels Sep 25, 2025
StanFromIreland and others added 2 commits September 25, 2025 18:18
@StanFromIreland
Merge branch 'main' into update-libexpat
ec9f367
@StanFromIreland
Update sbom.spdx.json
292014c
@StanFromIreland
StanFromIreland requested a review from sethmlarson September 25, 2025 17:23
@StanFromIreland StanFromIreland removed the DO-NOT-MERGE label Sep 25, 2025
sethmlarson
sethmlarson approved these changes Sep 25, 2025
View reviewed changes

@sethmlarson sethmlarson left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
gpshead
gpshead approved these changes Sep 27, 2025
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Sep 27, 2025
@gpshead
gpshead merged commit 48d0d0d into python:main Sep 27, 2025
@bedevere-app bedevere-app Bot removed the awaiting merge label Sep 27, 2025
@miss-islington-app

miss-islington-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 27, 2025
@StanFromIreland @miss-islington
pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-139319)
487a75e 
+ Blurb
+ Update sbom.spdx.json
(cherry picked from commit 48d0d0d)

Co-authored-by: Stan Ulbrych <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Sep 27, 2025
@StanFromIreland @miss-islington
pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-139319)
2164636 
+ Blurb
+ Update sbom.spdx.json
(cherry picked from commit 48d0d0d)

Co-authored-by: Stan Ulbrych <[email protected]>
@miss-islington-app

miss-islington-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 48d0d0dd9733eae4935f2ebd31bef786d8074fc8 3.12
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

GH-139376 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned gpshead Sep 27, 2025
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Sep 27, 2025
@miss-islington-app

miss-islington-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 48d0d0dd9733eae4935f2ebd31bef786d8074fc8 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

GH-139377 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Sep 27, 2025
@miss-islington-app

miss-islington-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 48d0d0dd9733eae4935f2ebd31bef786d8074fc8 3.10
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
hugovk pushed a commit that referenced this pull request Sep 27, 2025
@miss-islington @StanFromIreland
[3.14] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (#139376)
5761773 
gh-139312: Update bundled libexpat to 2.7.3 (GH-139319)

(cherry picked from commit 48d0d0d)

Co-authored-by: Stan Ulbrych <[email protected]>
@StanFromIreland StanFromIreland assigned StanFromIreland and unassigned gpshead Sep 27, 2025
gpshead pushed a commit that referenced this pull request Sep 27, 2025
@miss-islington @StanFromIreland
[3.13] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (#139377)
a461f25 
gh-139312: Update bundled libexpat to 2.7.3 (GH-139319)

+ Blurb
+ Update sbom.spdx.json
(cherry picked from commit 48d0d0d)

Co-authored-by: Stan Ulbrych <[email protected]>
@StanFromIreland
StanFromIreland deleted the update-libexpat branch September 27, 2025 08:20
@StanFromIreland

StanFromIreland commented Sep 27, 2025

Copy link
Copy Markdown
Member Author

3.12 backport has to wait for #139026
hartwork reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Sep 27, 2025
@StanFromIreland
[3.11] pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-13…
b3ea132 
…9319)

(cherry picked from commit 48d0d0d)

# Conflicts:
#	Misc/sbom.spdx.json
@bedevere-app

bedevere-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

GH-139378 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Sep 27, 2025
StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Sep 27, 2025
@StanFromIreland
[3.11] pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-13…
1fe9b26 
…9319)

(cherry picked from commit 48d0d0d)
@bedevere-app

bedevere-app Bot commented Sep 27, 2025

Copy link
Copy Markdown

GH-139379 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.10 label Sep 27, 2025
pablogsal pushed a commit that referenced this pull request Sep 28, 2025
@StanFromIreland
[3.11] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (#139378)
6cb1649
pablogsal pushed a commit that referenced this pull request Sep 28, 2025
@StanFromIreland
[3.10] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (#139379)
7252d2b
@hartwork

hartwork commented Oct 6, 2025

Copy link
Copy Markdown
Contributor

3.12 backport has to wait for #139026

@StanFromIreland merged just now, creating backport for 3.12 now…
StanFromIreland reacted with thumbs up emoji
All reactions
  • 👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
hartwork pushed a commit to hartwork/cpython that referenced this pull request Oct 6, 2025
@StanFromIreland @hartwork
[3.12] pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-13…
dc87fc4 
…9319)

+ Blurb
+ Update sbom.spdx.json
(cherry picked from commit 48d0d0d)

Co-authored-by: Stan Ulbrych <[email protected]>
@bedevere-app

bedevere-app Bot commented Oct 6, 2025

Copy link
Copy Markdown

GH-139662 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Oct 6, 2025
ambv pushed a commit that referenced this pull request Oct 7, 2025
@hartwork @StanFromIreland
[3.12] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (GH-13…
aecbbee 
…9662)

(cherry picked from commit 48d0d0d)

Co-authored-by: Stan Ulbrych <[email protected]>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Oct 7, 2025
@StanFromIreland @miss-islington
[3.10] pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-13…
c3f6eec 
…9319) (pythonGH-139379)

(cherry picked from commit 7252d2b)

Co-authored-by: Stan Ulbrych <[email protected]>
@bedevere-app

bedevere-app Bot commented Oct 7, 2025

Copy link
Copy Markdown

GH-139697 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
ambv pushed a commit that referenced this pull request Oct 7, 2025
@miss-islington @StanFromIreland
[3.9] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (GH-139697
e26ba93 
)

(cherry picked from commit 7252d2b)

Co-authored-by: Stan Ulbrych <[email protected]>
@hartwork hartwork mentioned this pull request Jan 31, 2026
[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
@sethmlarson sethmlarson sethmlarson approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@StanFromIreland StanFromIreland

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@StanFromIreland @hartwork @gpshead @sethmlarson
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.