Skip to content

Please upgrade bundled Expat to 2.7.1聽#131809

Closed
Closed
Please upgrade bundled Expat to 2.7.1#131809
Assignees
sethmlarson
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.9 (EOL)end of liferelease-blockertopic-XMLtype-securityA security issue

Description

@hartwork
hartwork
opened on Mar 27, 2025

Bug report

Bug description:

Hi! 馃憢

Please upgrade bundled Expat to 2.7.1 (e.g. for the fix to what can be argued a regression that came with the fix for CVE-2024-8176 in Expat 2.7.0).

The CPython issue for previous 2.7.0 was #131261 and the related merged main pull request was #131272, in case you want to have a look. The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.

Thanks in advance!

CC @sethmlarson @gpshead

CPython versions tested on:

3.9, 3.10, CPython main branch, 3.14, 3.13, 3.12, 3.11

Operating systems tested on:

Other, Windows, macOS, Linux

Linked PRs

Activity

  1. hartwork
    added
    type-bugAn unexpected behavior, bug, or error
    on Mar 27, 2025
  2. ZeroIntensity
    added
    type-securityA security issue
    topic-XML
    3.11only security fixes
    3.10 (EOL)end of life
    3.9 (EOL)end of life
    3.12only security fixes
    3.13only security fixes
    3.14bugs and security fixes
    and removed
    type-bugAn unexpected behavior, bug, or error
    on Mar 27, 2025
  3. picnixz
    added
    extension-modulesC modules in the Modules dir
    on Mar 28, 2025
  4. gpshead
    added
    release-blocker
    and removed
    extension-modulesC modules in the Modules dir
    on Mar 28, 2025
  5. ezio-melotti
    added this to Release and Deferred blockers 馃毇on Mar 28, 2025
  6. github-project-automation
    moved this to Todo in Release and Deferred blockers 馃毇on Mar 28, 2025

  7. 4 remaining items

  8. hugovk
    added a commit that references this issue on Apr 7, 2025

    gh-131809: Upgrade vendored expat to 2.7.1 (#132192)

    c0de650
  9. miss-islington
    added 2 commits that reference this issue on Apr 7, 2025

    pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)

    fa241f8

    pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)

    622489a
  10. sethmlarson
    added 3 commits that reference this issue on Apr 7, 2025

    [3.11] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192

    be68c3d

    [3.10] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192

    de980b7

    [3.9] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)

    899f79b
  11. gpshead
    added 2 commits that reference this issue on Apr 7, 2025

    [3.12] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132237)

    ed01daf

    [3.13] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132236)

    ac9d7c6
  12. Yhg1s
    added 3 commits that reference this issue on Apr 8, 2025

    [3.9] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132242)

    12deea5

    [3.10] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132241)

    53d4eaa

    [3.11] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132240)

    553d706
  13. ambv
    closed this as completedon Apr 8, 2025
  14. github-project-automation
    moved this from In Progress to Done in Release and Deferred blockers 馃毇on Apr 8, 2025

  15. hartwork commented on Apr 8, 2025

    @hartwork
    hartwork
    on Apr 8, 2025
    ContributorAuthor

    @gpshead @sethmlarson thank you! 馃檹

  16. rochebeard-byte commented on May 13, 2025

    @rochebeard-byte
    rochebeard-byte
    on May 13, 2025 路 Hidden as spam
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixes3.14bugs and security fixes3.9 (EOL)end of liferelease-blockertopic-XMLtype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions