GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — gh-158876: Update bundled Expat to 2.9.0 by StanFromIreland · Pull Request #158881 · python/cpython

Conversation

StanFromIreland commented Oct 5, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Member

Issue: Upgrade bundled Expat to 2.9.0 (e.g. for fixes to two vulnerabilities) #158876

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

hartwork reacted with heart emoji

All reactions

❤️ 1 reaction


          Update bundled Expat to 2.9.0

ab5bd53

bedevere-app Bot mentioned this pull request

Oct 5, 2026

Upgrade bundled Expat to 2.9.0 (e.g. for fixes to two vulnerabilities) #158876

Closed

StanFromIreland added 2 commits

October 5, 2026 21:23


          Merge branch 'main' into expat-2.9.0

dc0c4b3


          Oops, add files

b3e0aa0

hartwork reviewed

Oct 6, 2026

View reviewed changes

Comment thread

Modules/expat/pyexpatns.h Resolved

Uh oh!

There was an error while loading. Please reload this page.

StanFromIreland added 2 commits

October 6, 2026 16:38


          Merge branch 'main' into expat-2.9.0

0c49350


          Drop mappings for unexported symbols

7ae95f6

StanFromIreland marked this pull request as ready for review

October 6, 2026 18:39

StanFromIreland requested review from a team, AA-Turner, emmatyping, erlend-aasland, itamaro and sethmlarson as code owners

October 6, 2026 18:39

bedevere-app Bot added the awaiting core review label

Oct 6, 2026

StanFromIreland requested review from encukou and gpshead

October 6, 2026 18:40


          Merge in the main branch

bc1cd81

encukou approved these changes

Oct 20, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting core review labels

Oct 20, 2026

encukou commented Oct 20, 2026

Copy link

Copy Markdown

Member

I filed #159893 for the deprecations.

StanFromIreland reacted with thumbs up emoji

All reactions

👍 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

encukou enabled auto-merge (squash)

October 20, 2026 17:00

encukou merged commit 0071fb5 into python:main

Oct 20, 2026

62 checks passed

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the awaiting merge label

Oct 20, 2026

StanFromIreland deleted the expat-2.9.0 branch

October 20, 2026 17:42

StanFromIreland added needs backport to 3.11

only security fixes

needs backport to 3.12

only security fixes

needs backport to 3.13

only security fixes

needs backport to 3.14 bugs and security fixes labels

Oct 20, 2026

StanFromIreland added the needs backport to 3.15 bugs and security fixes label

Oct 20, 2026

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.12.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.13.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.15.
🐍🍒⛏🤖

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.11 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 0071fb511110a03d8766a9061f8813c9a1a9a4de 3.11

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot assigned encukou

Oct 20, 2026

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 0071fb511110a03d8766a9061f8813c9a1a9a4de 3.12

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

miss-islington-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.13 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 0071fb511110a03d8766a9061f8813c9a1a9a4de 3.13

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

GH-159920 is a backport of this pull request to the 3.14 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label

Oct 20, 2026

bedevere-app Bot commented Oct 20, 2026

Copy link

Copy Markdown

GH-159921 is a backport of this pull request to the 3.15 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label

Oct 20, 2026

StanFromIreland added a commit that referenced this pull request

Oct 20, 2026


          [3.14] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#159920)

db34557

(cherry picked from commit 0071fb5)

Co-authored-by: Stan Ulbrych <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>

StanFromIreland added a commit that referenced this pull request

Oct 20, 2026


          [3.15] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#159921)

1f70745

(cherry picked from commit 0071fb5)

Co-authored-by: Stan Ulbrych <[email protected]>
Co-authored-by: Petr Viktorin <[email protected]>

bedevere-app Bot commented Oct 22, 2026

Copy link

Copy Markdown

GH-160257 is a backport of this pull request to the 3.13 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.13 only security fixes label

Oct 22, 2026

bedevere-app Bot commented Oct 22, 2026

Copy link

Copy Markdown

GH-160258 is a backport of this pull request to the 3.12 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.12 only security fixes label

Oct 22, 2026

bedevere-app Bot commented Oct 22, 2026

Copy link

Copy Markdown

GH-160261 is a backport of this pull request to the 3.11 branch.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

bedevere-app Bot removed the needs backport to 3.11 only security fixes label

Oct 22, 2026

Yhg1s pushed a commit that referenced this pull request

Oct 25, 2026


          [3.12] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160258)

5cf3260

(cherry picked from commit 0071fb5)
(cherry picked from commit 25f598d)

Co-authored-by: Petr Viktorin <[email protected]>

Yhg1s added a commit that referenced this pull request

Oct 25, 2026


          [3.13] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160257)

cb3a838

(cherry picked from commit 0071fb5)

Co-authored-by: Petr Viktorin <[email protected]>
Co-authored-by: T. Wouters <[email protected]>

pablogsal pushed a commit that referenced this pull request

Oct 25, 2026


          [3.11] gh-158876: Update bundled Expat to 2.9.0 (GH-158881) (#160261)

b370d7a

(cherry picked from commit 0071fb5)
(cherry picked from commit 25f598d)

Co-authored-by: Petr Viktorin <[email protected]>

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.11] pythongh-158876: Update bundled Expat to 2.9.0 (pythonGH-158881)…

bcd989e

… (python#160261)

(cherry picked from commit 0071fb5)
(cherry picked from commit 25f598d)

Co-authored-by: Petr Viktorin <[email protected]>
(cherry picked from commit b370d7a)

3.10.22.x: 3.10 builds the bundled expat from setup.py, not from
LIBEXPAT_OBJS in Makefile.pre.in, so xcs.c is added to setup.py's
expat_sources (and xcs.h to expat_depends) instead.

icanhasmath pushed a commit to ActiveState/cpython that referenced this pull request

Oct 28, 2026


          [3.11] pythongh-158876: Update bundled Expat to 2.9.0 (pythonGH-158881)…

da54fc1

… (python#160261)

(cherry picked from commit 0071fb5)
(cherry picked from commit 25f598d)

Co-authored-by: Petr Viktorin <[email protected]>
(cherry picked from commit b370d7a)

3.10.22.x: 3.10 builds the bundled expat from setup.py, not from
LIBEXPAT_OBJS in Makefile.pre.in, so xcs.c is added to setup.py's
expat_sources (and xcs.h to expat_depends) instead.

(cherry picked from commit 95dadd7)

3.9.25.x: 3.9's pyexpat predates the module-state error helpers
(set_xml_error / SET_XML_ERROR), so the 64-bit line/column switch is
applied to 3.9's set_error() directly: it now reads
EXPAT_GetCurrent{Line,Column}Number (XML_GetError{Line,Column}Number
are aliases of the current-position getters in expat), formats them
with %llu, and stores them through a new set_error_attr_location()
that uses PyLong_FromUnsignedLongLong().

Reviewers

encukou

encukou approved these changes

sethmlarson

Awaiting requested review from sethmlarson

sethmlarson is a code owner

erlend-aasland

Awaiting requested review from erlend-aasland

erlend-aasland is a code owner

AA-Turner

Awaiting requested review from AA-Turner

AA-Turner is a code owner

emmatyping

Awaiting requested review from emmatyping

emmatyping is a code owner

itamaro

Awaiting requested review from itamaro

itamaro is a code owner

gpshead

Awaiting requested review from gpshead

+1 more reviewer

hartwork

hartwork left review comments

Reviewers whose approvals may not affect merge requirements

Uh oh!

There was an error while loading. Please reload this page.

Assignees

encukou

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

StanFromIreland commented Oct 5, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

encukou commented Oct 20, 2026

Uh oh!

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

miss-islington-app Bot commented Oct 20, 2026

Uh oh!

bedevere-app Bot commented Oct 20, 2026

Uh oh!

bedevere-app Bot commented Oct 20, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

bedevere-app Bot commented Oct 22, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

StanFromIreland commented Oct 5, 2026 •

edited by bedevere-app Bot

Loading

Uh oh!

There was an error while loading. Please reload this page.