gh-152216: Update bundled expat to 2.8.2 by StanFromIreland · Pull Request #152234 · python/cpython

StanFromIreland · 2026-06-25T19:47:11Z

I'm not sure if I did everything correctly for the Windows build system, but I guess we'll find out :-)

Issue: Upgrade bundled Expat to 2.8.2 (e.g. for the fix to CVE-2026-56132 and 12 others) #152216

zware

LG¹TM.

and also ripe for de-vendoring :) ↩

miss-islington-app · 2026-07-10T18:40:17Z

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

bedevere-app · 2026-07-10T18:40:30Z

GH-153524 is a backport of this pull request to the 3.15 branch.

miss-islington-app · 2026-07-10T18:40:31Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.13

bedevere-app · 2026-07-10T18:40:35Z

GH-153525 is a backport of this pull request to the 3.14 branch.

miss-islington-app · 2026-07-10T18:40:36Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.12

miss-islington-app · 2026-07-10T18:40:41Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.11

miss-islington-app · 2026-07-10T18:40:45Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.10

gh-152216: Update bundled expat to 2.8.2 (GH-152234) * Update bundled expat to 2.8.2 * `make regen-sbom` * Update download URL * Drop warnings (yay!) (cherry picked from commit c22e9c9) Co-authored-by: Stan Ulbrych <stan@python.org>

serhiy-storchaka · 2026-07-15T10:55:07Z

Please don't forget about backports.

StanFromIreland · 2026-07-15T17:22:34Z

@serhiy-storchaka these are blocked by the 2.8.1 update? See the issue.

bedevere-app · 2026-07-26T19:03:40Z

GH-154747 is a backport of this pull request to the 3.13 branch.

(cherry picked from commit c22e9c9)

bedevere-bot · 2026-07-27T20:27:50Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x Fedora Stable LTO + PGO 3.13 (tier-3) has failed when building commit 31b4886.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1633/builds/1022) and take a look at the build logs.
Check if the failure is related to this commit (31b4886) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1633/builds/1022

Summary of the results of the build (if available):

Click to see traceback logs

Note: switching to '31b4886e8f63275913fc01031466e10a4e4aed6f'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at 31b4886e8f632 [3.13] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#154747)
Switched to and reset branch '3.13'

find: ‘build’: No such file or directory
find: ‘build’: No such file or directory
find: ‘build’: No such file or directory
find: ‘build’: No such file or directory
make[2]: [Makefile:3131: clean-retain-profile] Error 1 (ignored)
In function ‘hashtable_key_from_2_strings’,
    inlined from ‘_extensions_cache_find_unlocked’ at Python/import.c:1284:17:
Python/import.c:1197:5: warning: ‘strncpy’ output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation]
 1197 |     strncpy(key, str1_data, str1_len);
      |     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Python/import.c:1183:27: note: length computed here
 1183 |     Py_ssize_t str1_len = strlen(str1_data);
      |                           ^~~~~~~~~~~~~~~~~
./Modules/socketmodule.c: In function ‘getsockaddrarg’:
./Modules/socketmodule.c:2528:9: warning: ‘strncpy’ specified bound 64 equals destination size [-Wstringop-truncation]
 2528 |         strncpy((char *)sa->salg_name, name, sizeof(sa->salg_name));
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ./Include/Python.h:14,
                 from ./Modules/_testexternalinspection.c:53:
./pyconfig.h:1985:9: warning: ‘_POSIX_C_SOURCE’ redefined
 1985 | #define _POSIX_C_SOURCE 200809L
      |         ^~~~~~~~~~~~~~~
In file included from /usr/include/bits/libc-header-start.h:33,
                 from /usr/include/stdint.h:26,
                 from /usr/lib/gcc/s390x-redhat-linux/16/include/stdint.h:11,
                 from /usr/include/elf.h:24,
                 from ./Modules/_testexternalinspection.c:4:
/usr/include/features.h:319:10: note: this is the location of the previous definition
  319 | # define _POSIX_C_SOURCE        202405L
      |          ^~~~~~~~~~~~~~~
./pyconfig.h:2006:9: warning: ‘_XOPEN_SOURCE’ redefined
 2006 | #define _XOPEN_SOURCE 700
      |         ^~~~~~~~~~~~~
/usr/include/features.h:234:10: note: this is the location of the previous definition
  234 | # define _XOPEN_SOURCE  800
      |          ^~~~~~~~~~~~~
ar: libpython3.13.a: error reading Python/_warnings.o: No space left on device
make[2]: *** [Makefile:1064: libpython3.13.a] Error 1
make[1]: *** [Makefile:894: profile-gen-stamp] Error 2
make: *** [Makefile:906: profile-run-stamp] Error 2

bedevere-bot · 2026-07-27T20:37:23Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x Fedora Stable Refleaks 3.13 (tier-3) has failed when building commit 31b4886.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1662/builds/1208) and take a look at the build logs.
Check if the failure is related to this commit (31b4886) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1662/builds/1208

Summary of the results of the build (if available):

Click to see traceback logs

Note: switching to '31b4886e8f63275913fc01031466e10a4e4aed6f'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at 31b4886e8f632 [3.13] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#154747)
Switched to and reset branch '3.13'

In file included from ./Include/Python.h:14,
                 from ./Modules/_testexternalinspection.c:53:
./pyconfig.h:1985:9: warning: ‘_POSIX_C_SOURCE’ redefined
 1985 | #define _POSIX_C_SOURCE 200809L
      |         ^~~~~~~~~~~~~~~
In file included from /usr/include/bits/libc-header-start.h:33,
                 from /usr/include/stdint.h:26,
                 from /usr/lib/gcc/s390x-redhat-linux/16/include/stdint.h:11,
                 from /usr/include/elf.h:24,
                 from ./Modules/_testexternalinspection.c:4:
/usr/include/features.h:319:10: note: this is the location of the previous definition
  319 | # define _POSIX_C_SOURCE        202405L
      |          ^~~~~~~~~~~~~~~
./pyconfig.h:2006:9: warning: ‘_XOPEN_SOURCE’ redefined
 2006 | #define _XOPEN_SOURCE 700
      |         ^~~~~~~~~~~~~
/usr/include/features.h:234:10: note: this is the location of the previous definition
  234 | # define _XOPEN_SOURCE  800
      |          ^~~~~~~~~~~~~
Traceback (most recent call last):
Traceback (most recent call last):
Traceback (most recent call last):
Traceback (most recent call last):
Traceback (most recent call last):
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/codecs.h'
Traceback (most recent call last):
Traceback (most recent call last):
make: *** [Makefile:1716: Python/frozen_modules/codecs.h] Error 1
make: *** Waiting for unfinished jobs....
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/importlib.machinery.h'
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/importlib.util.h'
Traceback (most recent call last):
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/runpy.h'
make: *** [Makefile:1749: Python/frozen_modules/importlib.machinery.h] Error 1
make: *** [Makefile:1752: Python/frozen_modules/runpy.h] Error 1
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/__phello__.h'
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/stat.h'
Traceback (most recent call last):
make: *** [Makefile:1758: Python/frozen_modules/__phello__.h] Error 1
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/posixpath.h'
Traceback (most recent call last):
make: *** [Makefile:1743: Python/frozen_modules/stat.h] Error 1
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/ntpath.h'
make: *** [Makefile:1746: Python/frozen_modules/importlib.util.h] Error 1
make: *** [Makefile:1734: Python/frozen_modules/posixpath.h] Error 1
make: *** [Makefile:1731: Python/frozen_modules/ntpath.h] Error 1
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/site.h'
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
    main()
    ~~~~^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
    write_frozen(outpath, inpath, name, marshalled)
    ~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozen
    with open(outpath, "w") as outfile:
         ~~~~^^^^^^^^^^^^^^
OSError: [Errno 28] No space left on device: 'Python/frozen_modules/__hello__.h'
make: *** [Makefile:1755: Python/frozen_modules/__hello__.h] Error 1
make: *** [Makefile:1740: Python/frozen_modules/site.h] Error 1

StanFromIreland added 2 commits June 25, 2026 20:44

Update bundled expat to 2.8.2

62eac34

make regen-sbom

9be0223

StanFromIreland requested review from a team, AA-Turner, emmatyping, erlend-aasland, itamaro and sethmlarson as code owners June 25, 2026 19:47

bedevere-app Bot mentioned this pull request Jun 25, 2026

Upgrade bundled Expat to 2.8.2 (e.g. for the fix to CVE-2026-56132 and 12 others) #152216

Open

bedevere-app Bot added the awaiting core review label Jun 25, 2026

StanFromIreland added 2 commits June 25, 2026 21:04

Update download URL

8ca751a

Drop warnings (yay!)

75cbdce

StanFromIreland requested review from encukou and gpshead June 25, 2026 20:27

hartwork mentioned this pull request Jun 26, 2026

Release Expat 2.8.2 (ETA 2026-06-25) libexpat/libexpat#1276

Closed

29 tasks

StanFromIreland added the release-blocker label Jul 10, 2026

github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Jul 10, 2026

github-project-automation Bot added this to Release and Deferred blockers 🚫 Jul 10, 2026

zware approved these changes Jul 10, 2026

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting core review labels Jul 10, 2026

gpshead approved these changes Jul 10, 2026

View reviewed changes

gpshead merged commit c22e9c9 into python:main Jul 10, 2026
74 checks passed

bedevere-app Bot removed the awaiting merge label Jul 10, 2026

github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫 Jul 10, 2026

bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jul 10, 2026

miss-islington-app Bot assigned gpshead Jul 10, 2026

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Jul 10, 2026

StanFromIreland deleted the 2.8.2 branch July 10, 2026 18:59

bedevere-app Bot removed the needs backport to 3.13 bugs and security fixes label Jul 26, 2026

StanFromIreland added a commit that referenced this pull request Jul 27, 2026

[3.13] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#154747)

31b4886

(cherry picked from commit c22e9c9)

Uh oh!

Uh oh!

Conversation

StanFromIreland commented Jun 25, 2026 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zware left a comment

Choose a reason for hiding this comment

Footnotes

Uh oh!

Uh oh!

miss-islington-app Bot commented Jul 10, 2026

Uh oh!

bedevere-app Bot commented Jul 10, 2026

Uh oh!

miss-islington-app Bot commented Jul 10, 2026

Uh oh!

bedevere-app Bot commented Jul 10, 2026

Uh oh!

miss-islington-app Bot commented Jul 10, 2026

Uh oh!

miss-islington-app Bot commented Jul 10, 2026

Uh oh!

miss-islington-app Bot commented Jul 10, 2026

Uh oh!

serhiy-storchaka commented Jul 15, 2026

Uh oh!

StanFromIreland commented Jul 15, 2026

Uh oh!

bedevere-app Bot commented Jul 26, 2026

Uh oh!

bedevere-bot commented Jul 27, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

bedevere-bot commented Jul 27, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

StanFromIreland commented Jun 25, 2026 •

edited by bedevere-app Bot

Loading