gh-152216: Update bundled expat to 2.8.2 by StanFromIreland · Pull Request #152234 · python/cpython

StanFromIreland · 2026-06-25T19:47:11Z

I'm not sure if I did everything correctly for the Windows build system, but I guess we'll find out :-)

Issue: Upgrade bundled Expat to 2.8.2 (e.g. for the fix to CVE-2026-56132 and 12 others) #152216

zware

LG¹TM.

and also ripe for de-vendoring :) ↩

miss-islington-app · 2026-07-10T18:40:17Z

Thanks @StanFromIreland for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!

bedevere-app · 2026-07-10T18:40:30Z

GH-153524 is a backport of this pull request to the 3.15 branch.

miss-islington-app · 2026-07-10T18:40:31Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.13 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.13

bedevere-app · 2026-07-10T18:40:35Z

GH-153525 is a backport of this pull request to the 3.14 branch.

miss-islington-app · 2026-07-10T18:40:36Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.12

miss-islington-app · 2026-07-10T18:40:41Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.11

miss-islington-app · 2026-07-10T18:40:45Z

Sorry, @StanFromIreland and @gpshead, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c22e9c9daef4d97a3fdf1d41a119947ed46ad937 3.10

gh-152216: Update bundled expat to 2.8.2 (GH-152234) * Update bundled expat to 2.8.2 * `make regen-sbom` * Update download URL * Drop warnings (yay!) (cherry picked from commit c22e9c9) Co-authored-by: Stan Ulbrych <stan@python.org>

serhiy-storchaka · 2026-07-15T10:55:07Z

Please don't forget about backports.

StanFromIreland · 2026-07-15T17:22:34Z

@serhiy-storchaka these are blocked by the 2.8.1 update? See the issue.

bedevere-app · 2026-07-26T19:03:40Z

GH-154747 is a backport of this pull request to the 3.13 branch.

(cherry picked from commit c22e9c9)

bedevere-bot · 2026-07-27T20:27:50Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x Fedora Stable LTO + PGO 3.13 (tier-3) has failed when building commit 31b4886.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1633/builds/1022) and take a look at the build logs.
Check if the failure is related to this commit (31b4886) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1633/builds/1022

Summary of the results of the build (if available):

Click to see traceback logs

Note: switching to '31b4886e8f63275913fc01031466e10a4e4aed6f'.
You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.
If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:
git switch -c <new-branch-name>
Or undo this operation with:
git switch -
Turn off this advice by setting config variable advice.detachedHead to false
HEAD is now at 31b4886e8f632 [3.13] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#154747)
Switched to and reset branch '3.13'
find: ‘build’: No such file or directoryfind: ‘build’: No such file or directoryfind: ‘build’: No such file or directoryfind: ‘build’: No such file or directorymake[2]: [Makefile:3131: clean-retain-profile] Error 1 (ignored)
In function ‘hashtable_key_from_2_strings’,
inlined from ‘_extensions_cache_find_unlocked’ at Python/import.c:1284:17:
Python/import.c:1197:5: warning: ‘strncpy’ output truncated before terminating nul copying as many bytes from a string as its length [-Wstringop-truncation]
1197 | strncpy(key, str1_data, str1_len);
|^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Python/import.c:1183:27: note: length computed here
1183 | Py_ssize_t str1_len = strlen(str1_data);
|^~~~~~~~~~~~~~~~~./Modules/socketmodule.c: In function ‘getsockaddrarg’:
./Modules/socketmodule.c:2528:9: warning: ‘strncpy’ specified bound 64 equals destination size [-Wstringop-truncation]
2528 | strncpy((char *)sa->salg_name, name, sizeof(sa->salg_name));
|^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from ./Include/Python.h:14,
from ./Modules/_testexternalinspection.c:53:
./pyconfig.h:1985:9: warning: ‘_POSIX_C_SOURCE’ redefined
1985 | #define _POSIX_C_SOURCE 200809L
|^~~~~~~~~~~~~~~
In file included from /usr/include/bits/libc-header-start.h:33,
from/usr/include/stdint.h:26,
from/usr/lib/gcc/s390x-redhat-linux/16/include/stdint.h:11,
from/usr/include/elf.h:24,
from ./Modules/_testexternalinspection.c:4:
/usr/include/features.h:319:10: note: this is the location of the previous definition
319 | # define _POSIX_C_SOURCE 202405L
|^~~~~~~~~~~~~~~
./pyconfig.h:2006:9: warning: ‘_XOPEN_SOURCE’ redefined
2006 | #define _XOPEN_SOURCE 700
|^~~~~~~~~~~~~
/usr/include/features.h:234:10: note: this is the location of the previous definition
234 | # define _XOPEN_SOURCE 800
|^~~~~~~~~~~~~ar: libpython3.13.a: error reading Python/_warnings.o: No space left on devicemake[2]: *** [Makefile:1064: libpython3.13.a] Error 1make[1]: *** [Makefile:894: profile-gen-stamp] Error 2make: *** [Makefile:906: profile-run-stamp] Error 2

bedevere-bot · 2026-07-27T20:37:23Z

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Hi! The buildbot s390x Fedora Stable Refleaks 3.13 (tier-3) has failed when building commit 31b4886.

What do you need to do:

Don't panic.
Check the buildbot page in the devguide if you don't know what the buildbots are or how they work.
Go to the page of the buildbot that failed (https://buildbot.python.org/#/builders/1662/builds/1208) and take a look at the build logs.
Check if the failure is related to this commit (31b4886) or if it is a false positive.
If the failure is related to this commit, please, reflect that on the issue and make a new Pull Request with a fix.

You can take a look at the buildbot page here:

https://buildbot.python.org/#/builders/1662/builds/1208

Summary of the results of the build (if available):

Click to see traceback logs

Note: switching to '31b4886e8f63275913fc01031466e10a4e4aed6f'.
You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.
If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:
git switch -c <new-branch-name>
Or undo this operation with:
git switch -
Turn off this advice by setting config variable advice.detachedHead to false
HEAD is now at 31b4886e8f632 [3.13] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#154747)
Switched to and reset branch '3.13'
In file included from ./Include/Python.h:14,
from ./Modules/_testexternalinspection.c:53:
./pyconfig.h:1985:9: warning: ‘_POSIX_C_SOURCE’ redefined
1985 | #define _POSIX_C_SOURCE 200809L
|^~~~~~~~~~~~~~~
In file included from /usr/include/bits/libc-header-start.h:33,
from/usr/include/stdint.h:26,
from/usr/lib/gcc/s390x-redhat-linux/16/include/stdint.h:11,
from/usr/include/elf.h:24,
from ./Modules/_testexternalinspection.c:4:
/usr/include/features.h:319:10: note: this is the location of the previous definition
319 | # define _POSIX_C_SOURCE 202405L
|^~~~~~~~~~~~~~~
./pyconfig.h:2006:9: warning: ‘_XOPEN_SOURCE’ redefined
2006 | #define _XOPEN_SOURCE 700
|^~~~~~~~~~~~~
/usr/include/features.h:234:10: note: this is the location of the previous definition
234 | # define _XOPEN_SOURCE 800
|^~~~~~~~~~~~~
Traceback (most recent call last):
Traceback (most recent call last):
Traceback (most recent call last):
Traceback (most recent call last):
Traceback (most recent call last):
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/codecs.h'
Traceback (most recent call last):
Traceback (most recent call last):
make: *** [Makefile:1716: Python/frozen_modules/codecs.h] Error 1make: *** Waiting for unfinished jobs....
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/importlib.machinery.h'
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/importlib.util.h'
Traceback (most recent call last):
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/runpy.h'make: *** [Makefile:1749: Python/frozen_modules/importlib.machinery.h] Error 1make: *** [Makefile:1752: Python/frozen_modules/runpy.h] Error 1
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/__phello__.h'
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/stat.h'
Traceback (most recent call last):
make: *** [Makefile:1758: Python/frozen_modules/__phello__.h] Error 1
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/posixpath.h'
Traceback (most recent call last):
make: *** [Makefile:1743: Python/frozen_modules/stat.h] Error 1
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/ntpath.h'make: *** [Makefile:1746: Python/frozen_modules/importlib.util.h] Error 1make: *** [Makefile:1734: Python/frozen_modules/posixpath.h] Error 1make: *** [Makefile:1731: Python/frozen_modules/ntpath.h] Error 1
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/site.h'
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 68, in <module>
main()
~~~~^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 64, in main
write_frozen(outpath, inpath, name, marshalled)
~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/var/lib/buildbot/worker/cstratak-fedora-stable-s390x/3.13.cstratak-fedora-stable-s390x.refleak/build/./Programs/_freeze_module.py", line 47, in write_frozenwithopen(outpath, "w") as outfile:
~~~~^^^^^^^^^^^^^^OSError: [Errno 28] No space left on device: 'Python/frozen_modules/__hello__.h'make: *** [Makefile:1755: Python/frozen_modules/__hello__.h] Error 1make: *** [Makefile:1740: Python/frozen_modules/site.h] Error 1

StanFromIreland added 2 commits June 25, 2026 20:44

Update bundled expat to 2.8.2
62eac34

make regen-sbom
9be0223

StanFromIreland requested review from a team, AA-Turner, emmatyping, erlend-aasland, itamaro and sethmlarson as code owners June 25, 2026 19:47

bedevere-appBot mentioned this pull request Jun 25, 2026
Upgrade bundled Expat to 2.8.2 (e.g. for the fix to CVE-2026-56132 and 12 others) #152216
Open

bedevere-appBot added the awaiting core review label Jun 25, 2026

StanFromIreland added 2 commits June 25, 2026 21:04

Update download URL
8ca751a

Drop warnings (yay!)
75cbdce

StanFromIreland requested review from encukou and gpshead June 25, 2026 20:27

hartwork mentioned this pull request Jun 26, 2026
Release Expat 2.8.2 (ETA 2026-06-25) libexpat/libexpat#1276
Closed
29 tasks

StanFromIreland added the release-blocker label Jul 10, 2026

github-project-automationBot moved this to Todo in Release and Deferred blockers 🚫Jul 10, 2026

github-project-automationBot added this to Release and Deferred blockers 🚫Jul 10, 2026

zware approved these changes Jul 10, 2026
View reviewed changes

bedevere-appBot added awaiting merge and removed awaiting core review labels Jul 10, 2026

gpshead approved these changes Jul 10, 2026
View reviewed changes

gpshead merged commit c22e9c9 into python:mainJul 10, 2026
74 checks passed

bedevere-appBot removed the awaiting merge label Jul 10, 2026

github-project-automationBot moved this from Todo to Done in Release and Deferred blockers 🚫Jul 10, 2026

bedevere-appBot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Jul 10, 2026

miss-islington-appBot assigned gpshead Jul 10, 2026

bedevere-appBot removed the needs backport to 3.14 bugs and security fixes label Jul 10, 2026

StanFromIreland deleted the 2.8.2 branch July 10, 2026 18:59

bedevere-appBot removed the needs backport to 3.13 bugs and security fixes label Jul 26, 2026

StanFromIreland added a commit that referenced this pull request Jul 27, 2026
[3.13]gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#154747)
31b4886
(cherry picked from commit c22e9c9)

Uh oh!

Uh oh!

Conversation

StanFromIreland commented Jun 25, 2026• edited by bedevere-app BotLoading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

zware left a comment

Choose a reason for hiding this comment

Footnotes

Uh oh!

Uh oh!

miss-islington-appBot commented Jul 10, 2026

Uh oh!

bedevere-appBot commented Jul 10, 2026

Uh oh!

miss-islington-appBot commented Jul 10, 2026

Uh oh!

bedevere-appBot commented Jul 10, 2026

Uh oh!

miss-islington-appBot commented Jul 10, 2026

Uh oh!

miss-islington-appBot commented Jul 10, 2026

Uh oh!

miss-islington-appBot commented Jul 10, 2026

Uh oh!

serhiy-storchaka commented Jul 15, 2026

Uh oh!

StanFromIreland commented Jul 15, 2026

Uh oh!

bedevere-appBot commented Jul 26, 2026

Uh oh!

bedevere-bot commented Jul 27, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

bedevere-bot commented Jul 27, 2026

⚠️⚠️⚠️ Buildbot failure ⚠️⚠️⚠️

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

StanFromIreland commented Jun 25, 2026•
edited by bedevere-app Bot
Loading