Repository navigation
Upgrade bundled expat to 2.5.0 #98739
Description
Upgrade the bundled libexpat version to 2.5.0 which includes a fix for CVE-2022-43680. I haven't evaluated whether CPython is directly impacted by this CVE, but can confirm that it is detected by binary analysis tools such as Black Duck.
Related libexpat changelog includes additional fixes and details.
Activity
gh-98739: Update libexpat from 2.4.9 to 2.5.0 (#98742)
pythongh-98739: Update libexpat from 2.4.9 to 2.5.0 (pythonGH-98742)
pythongh-98739: Update libexpat from 2.4.9 to 2.5.0 (pythonGH-98742)
pythongh-98739: Update libexpat from 2.4.9 to 2.5.0 (pythonGH-98742)
pythongh-98739: Update libexpat from 2.4.9 to 2.5.0 (pythonGH-98742)
pythongh-98739: Update libexpat from 2.4.9 to 2.5.0 (pythonGH-98742)
gpshead commentedon Oct 27, 2022
Thanks for making the PR! Release branch merges will happen but are pending figuring out why the CLA bot is mistakenly not accepting those on our end.
gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742)
gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742)
[3.7] gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742) (#98788)
[3.8] gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742) (#98787)
[3.9] gh-98739: Update libexpat from 2.4.9 to 2.5.0 (GH-98742) (#98786)
pythongh-98739: Update libexpat from 2.4.9 to 2.5.0 (python#98742)
ned-deily commentedon Dec 5, 2022
I believe all the backports have been merged and thus we can close this issue.