Release Expat 2.8.1 (ETA 2026-05-10) #1214

Pull requests that motivate cutting this new release now:

• [CVE-2026-45186] Prevent attribute collision check DoS #1216

Other yet-to-merge pull requests going into the release:

• Prepare release 2.8.1 (part of #1214, ETA 2026-05-10) #1217

Regular releases:

• Bump .so version info, document in change log
• Bump release version everywhere (including doc/reference.html)
• Fill release date (both change log and man page date)
• make distcheck source tarballs using ./distribute.sh
• GitHub:
  • Create signed Git tag and push it
  • Build Windows installer and binaries zip file using GitHub Actions — https://github.com/libexpat/libexpat/actions/runs/25634889993
  • Create new release — https://github.com/libexpat/libexpat/releases/tag/R_2_8_1
    • Upload source tarballs + .asc GPG signature files
    • Upload Windows installer and binaries zip file
  • Close current milestone and create a follow-up one
• SourceForge:
  • Upload Windows 32bit installer and binaries zip file
  • Upload Windows 64bit installer and binaries zip file
  • Upload source tarballs + .asc GPG signature files
  • Make the new .tar.xz source tarball default download for all but Windows
  • Make the new 64bit binaries zip file default download for Windows
• Website
  • Add news item — libexpat/libexpat.github.io@6d6c709
  • Sync API documentation — libexpat/libexpat.github.io@8b97565
• Let the community know:
  • Mail Expat distro maintainers directly
  • Blog about it at blog.hartwork.org — https://blog.hartwork.org/posts/expat-2-8-1-released/
  • Submit to Hacker News — https://news.ycombinator.com/item?id=48099356
  • Submit to Lobsters
  • Blog about it at xml.com — TODO
• Bump ebuild in Gentoo — gentoo/gentoo@9809916

Specific to 2.8.1:

• Write to oss-security list — https://www.openwall.com/lists/oss-security/2026/05/11/16
• Create issue with CPython — Upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186) python/cpython#149698

Related downstream issues and pull requests:

• CPython
  • Upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186) python/cpython#149698
  • gh-149698: Update bundled expat to 2.8.1 python/cpython#149699
• Gentoo
  • gentoo/gentoo@9809916
  • https://bugs.gentoo.org/974504
  • https://bugs.gentoo.org/974505
• Spack
  • expat: 2.8.1 + deprecate vulnerable 2.8.0 (for CVE-2026-45186) spack/spack-packages#4784