gh-139312: Update bundled libexpat to 2.7.3 by StanFromIreland · Pull Request #139319 · python/cpython

StanFromIreland · 2025-09-25T06:34:35Z

Issue: Please upgrade bundled Expat to 2.7.3 (e.g. for two key bugfixes) #139312

sethmlarson

The update to the code looks fine, however the tarball checksum and versions of the expat SBOM aren't updated. This wasn't caught automatically (which I've fixed in #139331) but this PR should have the correct values before being backported.

sethmlarson

Thank you!

miss-islington-app · 2025-09-27T02:44:40Z

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

+ Blurb + Update sbom.spdx.json (cherry picked from commit 48d0d0d) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

miss-islington-app · 2025-09-27T02:44:51Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 48d0d0dd9733eae4935f2ebd31bef786d8074fc8 3.12

bedevere-app · 2025-09-27T02:44:52Z

GH-139376 is a backport of this pull request to the 3.14 branch.

miss-islington-app · 2025-09-27T02:44:55Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 48d0d0dd9733eae4935f2ebd31bef786d8074fc8 3.11

bedevere-app · 2025-09-27T02:44:56Z

GH-139377 is a backport of this pull request to the 3.13 branch.

miss-islington-app · 2025-09-27T02:44:58Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 48d0d0dd9733eae4935f2ebd31bef786d8074fc8 3.10

gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (cherry picked from commit 48d0d0d) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) + Blurb + Update sbom.spdx.json (cherry picked from commit 48d0d0d) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

StanFromIreland · 2025-09-27T08:20:44Z

3.12 backport has to wait for #139026

…9319) (cherry picked from commit 48d0d0d) # Conflicts: # Misc/sbom.spdx.json

bedevere-app · 2025-09-27T08:23:36Z

GH-139378 is a backport of this pull request to the 3.11 branch.

…9319) (cherry picked from commit 48d0d0d)

bedevere-app · 2025-09-27T08:28:09Z

GH-139379 is a backport of this pull request to the 3.10 branch.

hartwork · 2025-10-06T14:14:22Z

3.12 backport has to wait for #139026

@StanFromIreland merged just now, creating backport for 3.12 now…

…9319) + Blurb + Update sbom.spdx.json (cherry picked from commit 48d0d0d) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

bedevere-app · 2025-10-06T14:17:58Z

GH-139662 is a backport of this pull request to the 3.12 branch.

…9662) (cherry picked from commit 48d0d0d) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

…9319) (pythonGH-139379) (cherry picked from commit 7252d2b) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

bedevere-app · 2025-10-07T15:32:43Z

GH-139697 is a backport of this pull request to the 3.9 branch.

) (cherry picked from commit 7252d2b) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

StanFromIreland added 2 commits September 25, 2025 07:32

Commit

ffe05af

Blurb

4582d42

StanFromIreland requested a review from gpshead September 25, 2025 06:34

StanFromIreland requested a review from sethmlarson as a code owner September 25, 2025 06:34

bedevere-app bot added the awaiting review label Sep 25, 2025

bedevere-app bot mentioned this pull request Sep 25, 2025

Please upgrade bundled Expat to 2.7.3 (e.g. for two key bugfixes) #139312

Closed

sethmlarson mentioned this pull request Sep 25, 2025

SBOM tool doesn't cross-check libexpat version and checksum against refresh.sh #139330

Closed

sethmlarson requested changes Sep 25, 2025

View reviewed changes

bedevere-app bot added awaiting core review and removed awaiting review labels Sep 25, 2025

StanFromIreland added DO-NOT-MERGE needs backport to 3.10 only security fixes needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 bugs and security fixes needs backport to 3.14 bugs and security fixes labels Sep 25, 2025

StanFromIreland and others added 2 commits September 25, 2025 18:18

Merge branch 'main' into update-libexpat

ec9f367

Update sbom.spdx.json

292014c

StanFromIreland requested a review from sethmlarson September 25, 2025 17:23

StanFromIreland removed the DO-NOT-MERGE label Sep 25, 2025

sethmlarson approved these changes Sep 25, 2025

View reviewed changes

gpshead approved these changes Sep 27, 2025

View reviewed changes

bedevere-app bot added awaiting merge and removed awaiting core review labels Sep 27, 2025

gpshead merged commit 48d0d0d into python:main Sep 27, 2025
50 of 51 checks passed

bedevere-app bot removed the awaiting merge label Sep 27, 2025

miss-islington-app bot assigned gpshead Sep 27, 2025

bedevere-app bot removed the needs backport to 3.14 bugs and security fixes label Sep 27, 2025

bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Sep 27, 2025

StanFromIreland assigned StanFromIreland and unassigned gpshead Sep 27, 2025

StanFromIreland deleted the update-libexpat branch September 27, 2025 08:20

StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Sep 27, 2025

[3.11] pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-13…

b3ea132

…9319) (cherry picked from commit 48d0d0d) # Conflicts: # Misc/sbom.spdx.json

bedevere-app bot removed the needs backport to 3.11 only security fixes label Sep 27, 2025

StanFromIreland added a commit to StanFromIreland/cpython that referenced this pull request Sep 27, 2025

[3.11] pythongh-139312: Update bundled libexpat to 2.7.3 (pythonGH-13…

1fe9b26

…9319) (cherry picked from commit 48d0d0d)

bedevere-app bot removed the needs backport to 3.10 only security fixes label Sep 27, 2025

pablogsal pushed a commit that referenced this pull request Sep 28, 2025

[3.11] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (#139378)

6cb1649

pablogsal pushed a commit that referenced this pull request Sep 28, 2025

[3.10] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (#139379)

7252d2b

bedevere-app bot removed the needs backport to 3.12 only security fixes label Oct 6, 2025

ambv pushed a commit that referenced this pull request Oct 7, 2025

[3.12] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (GH-13…

aecbbee

…9662) (cherry picked from commit 48d0d0d) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

ambv pushed a commit that referenced this pull request Oct 7, 2025

[3.9] gh-139312: Update bundled libexpat to 2.7.3 (GH-139319) (GH-139697

e26ba93

) (cherry picked from commit 7252d2b) Co-authored-by: Stan Ulbrych <89152624+StanFromIreland@users.noreply.github.com>

hartwork mentioned this pull request Jan 31, 2026

[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210) #144363

Open

Uh oh!

Conversation

StanFromIreland commented Sep 25, 2025 • edited by bedevere-app bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sethmlarson left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sethmlarson left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

miss-islington-app bot commented Sep 27, 2025

Uh oh!

miss-islington-app bot commented Sep 27, 2025

Uh oh!

bedevere-app bot commented Sep 27, 2025

Uh oh!

miss-islington-app bot commented Sep 27, 2025

Uh oh!

bedevere-app bot commented Sep 27, 2025

Uh oh!

miss-islington-app bot commented Sep 27, 2025

Uh oh!

StanFromIreland commented Sep 27, 2025

Uh oh!

bedevere-app bot commented Sep 27, 2025

Uh oh!

bedevere-app bot commented Sep 27, 2025

Uh oh!

hartwork commented Oct 6, 2025

Uh oh!

bedevere-app bot commented Oct 6, 2025

Uh oh!

bedevere-app bot commented Oct 7, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

StanFromIreland commented Sep 25, 2025 •

edited by bedevere-app bot

Loading

sethmlarson left a comment •

edited

Loading