Repository navigation
Upgrade our bundled copy of libexpat to the latest (2.4.9?) #97005
Description
Activity
I did not look to see if our use of libexpat actually allows the CVE in question to be triggered. If so that suggests we should do this sooner rather than later, but it is good for us to stay up to date in a timely fashion regardless.
- added a commit that references this issue
on Sep 22, 2022 - added 6 commits that reference this issue
on Sep 22, 2022 We can close this issue now :)
There have been important security fixes in libexpat since our update to 2.4.7. Such as one for https://nvd.nist.gov/vuln/detail/CVE-2022-40674.
This likely impacts our binary releases that use our bundled expat libraries (Windows and macOS?) the most. Some OS distro Python packages often link against their own expat package which they've probably already patched.