gh-144363: Update bundled libexpat to 2.7.4 by StanFromIreland · Pull Request #144365 · python/cpython

StanFromIreland · 2026-01-31T17:18:12Z

Issue: [security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363

gpshead

confirmed this matches expat 2.7.4 - i committed a minor tweak to keep the COPYING file in sync.

bedevere-bot · 2026-02-01T00:58:43Z

🤖 New build scheduled with the buildbot fleet by @gpshead for commit c305ac7 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F144365%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

encukou · 2026-02-04T16:09:22Z

Modules/expat/COPYING

@@ -1,5 +1,5 @@
 Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper
-Copyright (c) 2001-2022 Expat maintainers
+Copyright (c) 2001-2025 Expat maintainers


Should Doc/license.rst change as well?

probably so if it correctly contains a copy of this one. if we haven't automated updating that from the various scattered license sources of truth that could be a followup rather than blocking this. the listed date extension is not material to a license's validity.

I propose we remove the double maintenance burden, see #144488.

miss-islington-app · 2026-02-05T12:58:22Z

Thanks @StanFromIreland for the PR, and @encukou for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

* Update to 2.7.4 * update expat license copyright year to match and a pedantic #define * include COPYING update in refresh.sh * Update checksum for copying --------- (cherry picked from commit d5cb9f6) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

bedevere-app · 2026-02-05T12:58:37Z

GH-144499 is a backport of this pull request to the 3.14 branch.

miss-islington-app · 2026-02-05T12:58:39Z

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d5cb9f6a9b6f48cc08c4422259498d4fd023357a 3.11

bedevere-app · 2026-02-05T12:58:42Z

GH-144500 is a backport of this pull request to the 3.13 branch.

miss-islington-app · 2026-02-05T12:58:43Z

Sorry, @StanFromIreland and @encukou, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker d5cb9f6a9b6f48cc08c4422259498d4fd023357a 3.10

bedevere-app · 2026-02-05T12:58:47Z

GH-144501 is a backport of this pull request to the 3.12 branch.

* Update to 2.7.4 * update expat license copyright year to match and a pedantic #define * include COPYING update in refresh.sh * Update checksum for copying --------- (cherry picked from commit d5cb9f6) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

* Update to 2.7.4 * update expat license copyright year to match and a pedantic #define * include COPYING update in refresh.sh * Update checksum for copying --------- Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

…4365) * Update to 2.7.4 * update expat license copyright year to match and a pedantic #define * include COPYING update in refresh.sh * Update checksum for copying --------- (cherry picked from commit d5cb9f6) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

bedevere-app · 2026-02-05T16:48:40Z

GH-144514 is a backport of this pull request to the 3.11 branch.

…4365) * Update to 2.7.4 * update expat license copyright year to match and a pedantic #define * include COPYING update in refresh.sh * Update checksum for copying --------- (cherry picked from commit d5cb9f6) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

bedevere-app · 2026-02-05T16:52:01Z

GH-144515 is a backport of this pull request to the 3.10 branch.

…4499) (cherry picked from commit d5cb9f6) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

…4500) (cherry picked from commit d5cb9f6) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org>

* Update to 2.7.4 * update expat license copyright year to match and a pedantic #define * include COPYING update in refresh.sh * Update checksum for copying --------- Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

(cherry picked from commit d5cb9f6) This also backports commit: 51d3099 Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Petr Viktorin <encukou@gmail.com>

Update to 2.7.4

ee38f32

StanFromIreland requested a review from gpshead January 31, 2026 17:18

StanFromIreland requested a review from sethmlarson as a code owner January 31, 2026 17:18

bedevere-app bot added the awaiting review label Jan 31, 2026

bedevere-app bot mentioned this pull request Jan 31, 2026

[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363

Closed

StanFromIreland added needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Jan 31, 2026

gpshead self-assigned this Feb 1, 2026

gpshead added 2 commits January 31, 2026 16:48

update expat license copyright year to match and a pedantic #define

ff30356

include COPYING update in refresh.sh

c305ac7

gpshead approved these changes Feb 1, 2026

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting review labels Feb 1, 2026

gpshead added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 1, 2026

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Feb 1, 2026

StanFromIreland and others added 2 commits February 1, 2026 08:56

Update checksum for copying

96278ea

Merge branch 'main' into libexpat-2.7.4

09dd95f

encukou reviewed Feb 4, 2026

View reviewed changes

StanFromIreland mentioned this pull request Feb 4, 2026

Docs: Pull expat license from Modules/expat/ in license.rst #144488

Merged

encukou merged commit d5cb9f6 into python:main Feb 5, 2026
50 checks passed

bedevere-app bot removed the awaiting merge label Feb 5, 2026

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Feb 5, 2026

miss-islington-app bot assigned encukou and unassigned gpshead Feb 5, 2026

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Feb 5, 2026

bedevere-app bot removed the needs backport to 3.12 only security fixes label Feb 5, 2026

StanFromIreland deleted the libexpat-2.7.4 branch February 5, 2026 13:21

StanFromIreland assigned StanFromIreland and unassigned encukou Feb 5, 2026

bedevere-app bot removed the needs backport to 3.11 only security fixes label Feb 5, 2026

bedevere-app bot removed the needs backport to 3.10 only security fixes label Feb 5, 2026

pablogsal pushed a commit that referenced this pull request Mar 2, 2026

[3.11] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144514)

d1475b5

pablogsal pushed a commit that referenced this pull request Mar 2, 2026

[3.10] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) (#144515)

384afdd

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

gh-144363: Update bundled libexpat to 2.7.4#144365

gh-144363: Update bundled libexpat to 2.7.4#144365
encukou merged 5 commits intopython:mainfrom
StanFromIreland:libexpat-2.7.4

StanFromIreland commented Jan 31, 2026 •

edited by bedevere-app bot

Loading

gpshead left a comment

bedevere-bot commented Feb 1, 2026

encukou Feb 4, 2026

gpshead Feb 4, 2026

StanFromIreland Feb 4, 2026

Uh oh!

miss-islington-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

miss-islington-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

miss-islington-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

Labels

4 participants

Uh oh!

Conversation

StanFromIreland commented Jan 31, 2026 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

gpshead left a comment

Choose a reason for hiding this comment

bedevere-bot commented Feb 1, 2026

encukou Feb 4, 2026

Choose a reason for hiding this comment

gpshead Feb 4, 2026

Choose a reason for hiding this comment

StanFromIreland Feb 4, 2026

Choose a reason for hiding this comment

Uh oh!

miss-islington-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

miss-islington-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

miss-islington-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

bedevere-app bot commented Feb 5, 2026

Labels

4 participants

StanFromIreland commented Jan 31, 2026 •

edited by bedevere-app bot

Loading