Upgrade bundled Expat to 2.8.4 (e.g. for 4 security fixes)
Open
@StanFromIreland is already working on this.
Since Aug 31, 2026.
3.10
3.11
3.12
3.13
3.14
3.15
3.16
dependencies
extension-modules
topic-XML
type-security
- Dominant language
- Python
- Stars
- 77.2k
- Forks
- 36k
- PR merge metrics
- PR metrics pending
Description
Please see blog post https://blog.hartwork.org/posts/expat-2-8-4-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes for details. Affects all alive branches of Python. Thank you!
Related: #155558 (predecessor for Expat 2.8.3)
CC @StanFromIreland
- CVE-2026-66046
- CVE-2026-76641
- CVE-2026-76956
- CVE-2026-76957
- gh-156724
- gh-156731
- gh-156732
- gh-156733
- gh-156785
- gh-156786
- gh-156787
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.