Repository navigation
Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080) #149017
Description
Please see blog post https://blog.hartwork.org/posts/expat-2-8-0-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes for details. Affects all alive branches of Python. Thank you!
Related: #146083 (predecessor for Expat 2.7.5)
Linked PRs
- gh-149017: Upgrade bundled Expat to 2.8.0 #149020
- [3.14] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) #149073
- [3.13] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073) #149099
- [3.12] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073) #150007
- [3.11] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) #149074
- [3.10] gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) #149075
Activity
StanFromIreland commentedon Apr 26, 2026
Oh you beat me this time! ;-)
CVE-2026-3277{6,7,8}) #1460837 remaining items
hartwork commentedon May 11, 2026
@StanFromIreland that makes sense — thank you! 👍
[-][security] Please upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/-][+][security] Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/+][-][security] Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/-][+]Upgrade bundled Expat to 2.8.0 (e.g. for the fix to CVE-2026-41080)[/+][3.13] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (#149099)
[3.12] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (GH-149073…
[3.10] gh-149017: Upgrade bundled Expat to 2.8.0 (#149020) (#149075)
[3.11] gh-149017: Upgrade bundled Expat to 2.8.0 (GH-149020) (#149074)
hartwork commentedon Aug 10, 2026
@StanFromIreland the labels "3.10" and "3.11" look like leftovers here now. Is that true or intended to be and remain like that? I'm curious.
StanFromIreland commentedon Aug 10, 2026
Once the issue is closed it doesn’t really matter to be honest.
hartwork commentedon Aug 10, 2026
@StanFromIreland I see, thanks for your reply!