Repository navigation
Upgrade bundled Expat to 2.8.1 (e.g. for the fix to CVE-2026-45186) #149698
Description
Please see blog post https://blog.hartwork.org/posts/expat-2-8-1-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_1/expat/Changes for details. Affects all alive branches of Python. Thank you!
Related: #149017 (predecessor for Expat 2.8.0)
Linked PRs
- gh-149698: Update bundled expat to 2.8.1 #149699
- [3.15] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #149812
- [3.14] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #149813
- [3.13] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #149827
- [3.12] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #150020
- [3.11] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (GH-150020) #155550
- [3.10] gh-149698: Update bundled expat to 2.8.1 (GH-149699) #155551
Activity
[3.15] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#149812)
[3.14] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#149813)
[3.13] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#149827)
encukou commentedon May 14, 2026
3.12 backport is waiting on #146605 & #149017.
chris-eibl commentedon Jul 18, 2026
#146605 (2.7.5) and #150007 (3.12 backport of 2.8.0, #149017) are done, so I think this is no longer blocked :)
StanFromIreland commentedon Jul 18, 2026
The issue is still open as the backport PRs #149074 and #149075 haven't been merged yet, so I haven't been able to open the backports. This could be a good place to test that new stacked PRs feature I think we've enabled.
chris-eibl commentedon Jul 18, 2026
Ups, was replying to
without quoting (since that was the immediate post before).
IOW, the 3.12 backport should no longer be blocked?
StanFromIreland commentedon Jul 18, 2026
Oh right, sorry! Yes, 3.12 backport isn't blocked, just 3.11 and 3.10 now.
[3.12] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#150020)
[3.10] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (#155551)
[3.11] gh-149698: Update bundled expat to 2.8.1 (GH-149699) (GH-150020)…