[security] Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210)

[hartwork]

Bug report

Bug description:

Hello! 👋

Please upgrade bundled Expat to 2.7.4 (e.g. for the fixes to CVE-2026-24515 and CVE-2026-25210).

• Blog post: https://blog.hartwork.org/posts/expat-2-7-4-released/
• GitHub release: https://github.com/libexpat/libexpat/releases/tag/R_2_7_4
• Change log: https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes

The CPython issue for previous 2.7.3 was #139312 and the related merged main pull request was #139319, in case you want to have a look. (The Dockerfile from comment #123689 (review) could be of help with raising confidence in a bump pull request when going forward.)

Thanks in advance!

CPython versions tested on:

3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, CPython main branch

Operating systems tested on:

Linux, macOS, Windows, Other

Linked PRs

• gh-144363: Update bundled libexpat to 2.7.4 #144365
• [3.14] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144499
• [3.13] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144500
• [3.12] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144501
• [3.11] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144514
• [3.10] gh-144363: Update bundled libexpat to 2.7.4 (GH-144365) #144515

[dkoszewski]

Hi, do you know the usual timeline for including a newer Expat release in Python distributions? Python 3.13 and 3.14 were released yesterday, but they don’t include this upgrade. Many thanks!

[hartwork]

@dkoszewski https://peps.python.org/pep-0719/#source-only-security-fix-releases reads "Provided irregularly on an as-needed basis until October 2029" which I read as "there is no usual". The key question to me would be how your distributor of CPython binaries builds CPython and whether you are even using the Expat bundled with CPython; e.g. for me system-wide Expat is used…

# python3 -c 'import pyexpat; print(pyexpat.__file__)' | xargs -n1 lddtree | grep libexpat
    libexpat.so.1 => /usr/lib64/libexpat.so.1

…and then the updates to system Expat are the answer.

[StanFromIreland]

I'm fairly certain we'll get it in by the next release, apologies!