Python: Expat Patch Sweeps the Branches, Old Bugs Finally Close
A security update to the bundled Expat XML library propagated across six release branches, while a cluster of long-dormant bug reports—some over a decade old—got merged fixes for real correctness issues in arrays, sockets, and mock objects.
Duration: PT2M24S
Episode overview
This episode is a short developer briefing from Python.
It explains recent repository work in plain language.
- Show: Python
- Published: 2026-08-12T13:08:13Z
- Audio duration: PT2M24S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day, and welcome to Python for August 12th, 2026.
The dominant story today is a coordinated security backport. Expat, the XML parser bundled with CPython, moved to version 2.8.3 across branches 3.10 through 3.15. StanFromIreland opened the fix in PR 155560, and it was cherry-picked by miss-islington into every actively maintained release line. When you see the same…
The second theme is old bugs finally getting closed out. Several fixes merged today trace back to issues filed years ago. PR 133137 fixes a Windows bug where seeking a pipe silently succeeded instead of raising an error — filed against gh-86768. PR 12370, from 2021, adds proper line buffering support to socket dot…
A few isolated but notable fixes: PR 154569 corrected array unpickling for little-endian float sixteen data, where the decoder was comparing against the wrong constant and always decoded big-endian. And commit 44e92d4 from Neil Schemenauer fixes a thread-state slot leak in the free-threaded build, tightening…
What's next: watch for the Expat 2.8.3 backport to 3.10, still open as PR 155618, and keep an eye on the flame graph timing fixes in the profiling module, still under review.
That's the briefing. Back…
Nearby episodes from Python
- Curses Cleanup and a Wave of Correctness Fixes
- Free-Threading Race Conditions Take Center Stage
- Data Corruption Fixes and the Great Backport Sweep
- System Calls, Copy Replace, and a Reference Leak Fix
- Security Backports and a Cleaner C API
- Backports, Security Fixes, and Long-Standing Bug Cleanup
- Weekly Recap - Argument Clinic Overhaul & Cross-Platform Reliability
- Windows Path and Encoding Cleanup Marathon