Repository navigation
Upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375) #138998
Description
Bug report
Bug description:
Hi! 👋
Please upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375).
- GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_7_2
- Change log: https://github.com/libexpat/libexpat/blob/R_2_7_2/expat/Changes
The CPython issue for previous 2.7.1 was #131809 and the related merged main pull request was #132192, in case you want to have a look. (The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.)
Thanks in advance!
CPython versions tested on:
3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch
Operating systems tested on:
Linux, macOS, Windows, Other
Linked PRs
- gh-138998: Upgrade vendored expat to 2.7.2 #138999
- [3.14] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139024
- [3.13] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139025
- [3.12] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139026
- gh-138998:
expat/refresh.sh: Fail if Step 3 is not completed #139049 - [3.10] gh-138998: Upgrade vendored expat to 2.7.2 (#138999) #139053
- [3.9] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) #139055
- [3.11] gh-138998: Upgrade vendored expat to 2.7.2 (#138999) #139056
Activity
[-]Please upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375)[/-][+]Upgrade bundled Expat to 2.7.2 (e.g. for the fix to CVE-2025-59375)[/+]gh-138998: Upgrade vendored expat to 2.7.2 (#138999)
pythongh-138998: Upgrade vendored expat to 2.7.2 (pythonGH-138999)
pythongh-138998: Upgrade vendored expat to 2.7.2 (pythonGH-138999)
pythongh-138998: Upgrade vendored expat to 2.7.2 (pythonGH-138999)
[3.14] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (#139024)
pythongh-138998: Upgrade vendored expat to 2.7.2 (python#138999)
[3.9] pythongh-138998: Upgrade vendored expat to 2.7.2 (pythonGH-138999)
pythongh-138998: Upgrade vendored expat to 2.7.2 (python#138999)
gh-138998: `expat/refresh.sh`: Fail if Step 3 is not completed (GH-13…
[3.13] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (#139025)
[3.11] gh-138998: Upgrade vendored expat to 2.7.2 (#138999) (#139056)
[3.10] gh-138998: Upgrade vendored expat to 2.7.2 (#138999) (#139053)
pyexpatrelated to.ExternalEntityParserCreate#139400pyexpatrelated to.ExternalEntityParserCreate#139400[3.12] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (#139026)
picnixz commentedon Oct 7, 2025
After an other discussion, it was decided that it was fine to backport 2.7.2 and keep the default values.
cc @ambv
[3.9] gh-138998: Upgrade vendored expat to 2.7.2 (GH-138999) (GH-139055)
hartwork commentedon Oct 7, 2025
@picnixz seems to be about 3.9. How about Expat 2.7.3? Will you backport or should I (later today)? I checked #139312 just now but don't see anything 3.9 yet.
hartwork commentedon Oct 7, 2025
@picnixz update: Found the answer at #139312 (comment) myself now 👍