Skip to content

gh-131809: Upgrade vendored expat to 2.7.1#132192

Merged
hugovk merged 2 commits intopython:mainfrom
gpshead:security/expat271
Apr 7, 2025
Merged

gh-131809: Upgrade vendored expat to 2.7.1#132192
hugovk merged 2 commits intopython:mainfrom
gpshead:security/expat271

Conversation

@gpshead
Copy link
Member

@gpshead gpshead commented Apr 7, 2025 •
edited by bedevere-app bot
Loading

@gpshead gpshead requested a review from sethmlarson as a code owner April 7, 2025 04:08
@bedevere-app bedevere-app bot mentioned this pull request Apr 7, 2025
Closed
@gpshead gpshead moved this from Todo to In Progress in Release and Deferred blockers 🚫 Apr 7, 2025
@gpshead gpshead added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Apr 7, 2025
@bedevere-bot
Copy link

bedevere-bot commented Apr 7, 2025

🤖 New build scheduled with the buildbot fleet by @gpshead for commit 108a6b3 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F132192%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Apr 7, 2025
@hugovk hugovk mentioned this pull request Apr 7, 2025
Closed
@sethmlarson sethmlarson mentioned this pull request Apr 7, 2025
Closed
sethmlarson
sethmlarson approved these changes Apr 7, 2025
View reviewed changes
Copy link
Contributor

@sethmlarson sethmlarson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@sethmlarson
Copy link
Contributor

sethmlarson commented Apr 7, 2025

I can handle the backports for this PR once merged. Buildbot failures don't look relevant.

@hugovk hugovk merged commit c0de650 into python:main Apr 7, 2025
123 of 125 checks passed
@github-project-automation github-project-automation bot moved this from In Progress to Done in Release and Deferred blockers 🚫 Apr 7, 2025
@miss-islington-app
Copy link

miss-islington-app bot commented Apr 7, 2025

Thanks @gpshead for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13.
🐍🍒⛏🤖

miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 7, 2025
@gpshead @miss-islington
pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)
fa241f8 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
miss-islington pushed a commit to miss-islington/cpython that referenced this pull request Apr 7, 2025
@gpshead @miss-islington
pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)
622489a 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
@miss-islington-app
Copy link

miss-islington-app bot commented Apr 7, 2025

Sorry, @gpshead and @hugovk, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c0de6500249469e6fc5b458d6afb6bad1b6755cd 3.11

@bedevere-app
Copy link

bedevere-app bot commented Apr 7, 2025

GH-132236 is a backport of this pull request to the 3.13 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.13 bugs and security fixes label Apr 7, 2025
@miss-islington-app
Copy link

miss-islington-app bot commented Apr 7, 2025

Sorry, @gpshead and @hugovk, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c0de6500249469e6fc5b458d6afb6bad1b6755cd 3.10

@bedevere-app
Copy link

bedevere-app bot commented Apr 7, 2025

GH-132237 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.12 only security fixes label Apr 7, 2025
@miss-islington-app
Copy link

miss-islington-app bot commented Apr 7, 2025

Sorry, @gpshead and @hugovk, I could not cleanly backport this to 3.9 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker c0de6500249469e6fc5b458d6afb6bad1b6755cd 3.9

sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Apr 7, 2025
@gpshead @sethmlarson
[3.11] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192
be68c3d 
)

(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Apr 7, 2025

GH-132240 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.11 only security fixes label Apr 7, 2025
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Apr 7, 2025
@gpshead @sethmlarson
[3.10] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192
de980b7 
)

(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Apr 7, 2025

GH-132241 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app bot removed the needs backport to 3.10 only security fixes label Apr 7, 2025
sethmlarson pushed a commit to sethmlarson/cpython that referenced this pull request Apr 7, 2025
@gpshead @sethmlarson
[3.9] pythongh-131809: Upgrade vendored expat to 2.7.1 (pythonGH-132192)
899f79b 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
@bedevere-app
Copy link

bedevere-app bot commented Apr 7, 2025

GH-132242 is a backport of this pull request to the 3.9 branch.

gpshead added a commit that referenced this pull request Apr 7, 2025
@miss-islington @gpshead
[3.12] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132237)
ed01daf 
* gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192)
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>

* make regen-sbom

---------

Co-authored-by: Gregory P. Smith <greg@krypto.org>
gpshead added a commit that referenced this pull request Apr 7, 2025
@miss-islington @gpshead
[3.13] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132236)
ac9d7c6 
* gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192)
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>

* make regen-sbom

---------

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Yhg1s pushed a commit that referenced this pull request Apr 8, 2025
@sethmlarson @gpshead
[3.9] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132242)
12deea5 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Yhg1s pushed a commit that referenced this pull request Apr 8, 2025
@sethmlarson @gpshead
[3.10] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132241)
53d4eaa 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
Yhg1s pushed a commit that referenced this pull request Apr 8, 2025
@sethmlarson @gpshead
[3.11] gh-131809: Upgrade vendored expat to 2.7.1 (GH-132192) (#132240)
553d706 
(cherry picked from commit c0de650)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
@hartwork hartwork mentioned this pull request Sep 16, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sethmlarson sethmlarson sethmlarson approved these changes

Assignees

@hugovk hugovk

Labels

release-blocker type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@gpshead @bedevere-bot @sethmlarson @hugovk