Skip to content

Upgrade bundled Expat to 2.8.2 (e.g. for the fix to CVE-2026-56132 and 12 others) #152216

Closed
Closed
Upgrade bundled Expat to 2.8.2 (e.g. for the fix to CVE-2026-56132 and 12 others)#152216
Assignees
StanFromIreland
Labels
3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issue

Description

@hartwork
hartwork
opened on Jun 25, 2026

Please see blog post https://blog.hartwork.org/posts/expat-2-8-2-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes for details. Affects all alive branches of Python. Thank you!

PS: Note that this release comes with three new files files to be bundled:

  • lib/fallthrough.h
  • lib/memory_sanitizer.h
  • lib/xcsinc.c

Related: #149698 (predecessor for Expat 2.8.1)

CC @StanFromIreland

Linked PRs

Activity

  1. StanFromIreland
    marked Disable -Wimplicit-fallthrough warning for Modules/expat #125506 as a duplicate of this issue on Jun 25, 2026
  2. StanFromIreland
    added
    release-blocker
    on Jun 29, 2026
  3. github-project-automation
    added this to Release and Deferred blockers 🚫on Jun 29, 2026
  4. github-project-automation
    moved this to Todo in Release and Deferred blockers 🚫on Jun 29, 2026
  5. gpshead
    added 3 commits that reference this issue on Jul 10, 2026

    gh-152216: Update bundled expat to 2.8.2 (GH-152234)

    c22e9c9

    [3.14] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#153525)

    6f931c9

    [3.15] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#153524)

    3e776ee
  6. hugovk
    removed
    3.14bugs and security fixes
    3.15bugs and security fixes
    3.16new features, bugs and security fixes
    on Jul 10, 2026

  7. cdce8p commented on Jul 13, 2026

    @cdce8p
    cdce8p
    on Jul 13, 2026
    Contributor

    I'm seeing a lot of new compiler warnings with clang on macOS after #152234 was merged. They all are about -Wunreachable-code-fallthrough, e.g.:

    In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:283:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  283 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
    Python 3.16.0a0 (heads/main:adebb681533, Jul 13 2026, 12:06:01) [Clang 21.0.0 (clang-2100.1.1.101)] on darwin

    ./configure
make -j12 -s
    All warnings 
    In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:283:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  283 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:290:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  290 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:436:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  436 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:443:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  443 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:549:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  549 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:558:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  558 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:580:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  580 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:591:9: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  591 |         CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |         ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:688:11: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  688 |           CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |           ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:733:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  733 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:759:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  759 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:770:9: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  770 |         CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |         ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:783:11: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  783 |           CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |           ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:928:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  928 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:941:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  941 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:958:5: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  958 |     CHECK_NMSTRT_CASES(enc, ptr, end, nextTokPtr)
      |     ^
./Modules/expat/xmltok_impl.c:116:5: note: expanded from macro 'CHECK_NMSTRT_CASES'
  116 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:965:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
  965 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:1200:7: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
 1200 |       CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |       ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
In file included from ./Modules/expat/xmltok.c:309:
./Modules/expat/xmltok_impl.c:1220:11: warning: fallthrough annotation in unreachable code [-Wunreachable-code-fallthrough]
 1220 |           CHECK_NAME_CASES(enc, ptr, end, nextTokPtr)
      |           ^
./Modules/expat/xmltok_impl.c:87:5: note: expanded from macro 'CHECK_NAME_CASES'
   87 |     EXPAT_FALLTHROUGH;                                                         \
      |     ^
./Modules/expat/fallthrough.h:45:33: note: expanded from macro 'EXPAT_FALLTHROUGH'
   45 | #      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
      |                                 ^
19 warnings generated.

  8. hartwork commented on Jul 13, 2026

    @hartwork
    hartwork
    on Jul 13, 2026
    ContributorAuthor

    @cdce8p we saw that symptom upstream with clang-based emscripten off Ubuntu 22.04 (3.1.5~dfsg-3ubuntu1) and updating to Ubuntu 24.04 (3.1.6~dfsg-7) made it go away as documented. Upstream CI is using Linux Clang 21 in many places with -Werror and is all green. So my guess is that it's either Apple Clang or the version of it that is the issue here. If you dig into the issue deeper, I'd be curious to learn what you find for the cause.

    CC @neek78

  9. neek78 commented on Jul 13, 2026

    @neek78
    neek78
    on Jul 13, 2026
    Contributor

    @cdce8p So my guess is that it's either Apple Clang or the version of it that is the issue here. If you dig into the issue deeper, I'd be curious to learn what you find for the cause.

    I definitely saw that with older clang versions, I never determined exactly when this changed; I just ran a test with the latest release of Apple Clang, it it doesn't show the warnings. This was both building libexpat using its own CMake build, and cpython (via autotools) with the embedded expat version.

    This is the AppleClang version with which I tested-

    % /usr/bin/clang --version
Apple clang version 21.0.0 (clang-2100.1.1.101)
Target: arm64-apple-darwin25.5.0

  10. neek78 commented on Jul 13, 2026

    @neek78
    neek78
    on Jul 13, 2026
    Contributor

    Ok, it's because cpython's non-debug build turns on -Wunreachable-code - this results in warnings from both AppleClang and clang. It would be possible to disable -Wunreachable-code-fallthrough specifically.

  11. cdce8p commented on Jul 13, 2026

    @cdce8p
    cdce8p
    on Jul 13, 2026
    Contributor

    Ok, it's because cpython's non-debug build turns on -Wunreachable-code - this results in warnings from both AppleClang and clang. It would be possible to disable -Wunreachable-code-fallthrough specifically.

    Should this be added to xmltok_impl.c upstream then?

    #ifdef __clang__
#pragma clang diagnostic ignored "-Wunreachable-code-fallthrough"
#endif

  12. hartwork commented on Jul 13, 2026

    @hartwork
    hartwork
    on Jul 13, 2026
    ContributorAuthor

    @cdce8p I have no interest in adding things like that to the Expat code base.

  13. neek78 commented on Jul 13, 2026

    @neek78
    neek78
    on Jul 13, 2026
    Contributor

    @cdce8p I have no interest in adding things like that to the Expat code base.

    i tend to agree. Libexpat has its own buildsystem(s), which set appropriate flags for the code; Cpython takes the code, but builds it itself. I would suggest making the change in Cpython's build system for building expat somewhere.

    Out of interest, are these warnings showing up in CI ?

  14. cdce8p commented on Jul 13, 2026

    @cdce8p
    cdce8p
    on Jul 13, 2026
    Contributor

    I have no interest in adding things like that to the Expat code base.

    In that case another option might be to add -Wno-unreachable-code-fallthrough here:

    cpython/Makefile.pre.in

    Lines 1451 to 1452 in 1fece44

    Modules/expat/xmltok.o: $(srcdir)/Modules/expat/xmltok.c $(LIBEXPAT_HEADERS) $(PYTHON_HEADERS)
    $(CC) -c $(LIBEXPAT_CFLAGS) -o $@ $(srcdir)/Modules/expat/xmltok.c

    @StanFromIreland Would that be acceptable?

  15. StanFromIreland commented on Jul 13, 2026

    @StanFromIreland
    StanFromIreland
    on Jul 13, 2026
    Member

    I don't think we should be ignoring warnings, we also shouldn't be fixing them, they should be resolved upstream instead. Previously, there were several warnings which this update allowed us to remove from our ignore list.

  16. hartwork commented on Jul 13, 2026

    @hartwork
    hartwork
    on Jul 13, 2026
    ContributorAuthor

    I would like to note that Expat CI is using -Wall -Wextra -pedantic with -Werror and that -Wunreachable-code-fallthrough is beyond that. The goal of libexpat is to fix bugs, not to address warnings beyond -Wextra that do not expose actual bugs. If there is a bug to fix related to this warning, an in-depth analysis is welcome upstream.

  17. cdce8p commented on Jul 13, 2026

    @cdce8p
    cdce8p
    on Jul 13, 2026
    Contributor

    I would like to note that Expat CI is using -Wall -Wextra -pedantic with -Werror and that -Wunreachable-code-fallthrough is beyond that.

    To be fair, AFAIK CPython only enables -Wunreachable-code explicitly. While I do share the desire to get these kind of changes upstream, I can also understand the position not to include it. Anyway, I opened #153671 in case silencing it during the build is ok. There at least seems to be some precedent to doing that for other warning types.

    cpython/Makefile.pre.in

    Lines 1518 to 1519 in 701a7c5

    Modules/_hacl/Hacl_Streaming_HMAC.o: $(srcdir)/Modules/_hacl/Hacl_Streaming_HMAC.c $(LIBHACL_HMAC_HEADERS)
    $(CC) -Wno-unused-variable -c $(LIBHACL_CFLAGS) -o $@ $(srcdir)/Modules/_hacl/Hacl_Streaming_HMAC.c

  18. StanFromIreland
    added a commit that references this issue on Jul 27, 2026

    [3.13] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#154747)

    31b4886
  19. Yhg1s
    added a commit that references this issue on Aug 11, 2026

    [3.12] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (GH-154747)…

    01d1f81
  20. StanFromIreland
    marked this as blocking on Aug 11, 2026
  21. pablogsal
    added 2 commits that reference this issue on Aug 11, 2026

    [3.11] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#155576)

    0f54a85

    [3.10] gh-152216: Update bundled expat to 2.8.2 (GH-152234) (#155577)

    31e6a4c
  22. StanFromIreland
    closed this as completedon Aug 12, 2026
  23. github-project-automation
    moved this from Todo to Done in Release and Deferred blockers 🚫on Aug 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

3.10 (EOL)end of life3.11only security fixes3.12only security fixes3.13only security fixesextension-modulesC modules in the Modules dirrelease-blockertopic-XMLtype-securityA security issue

Projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions