For readers caller to Expat:
libexpat is simply a accelerated streaming XML parser. Alongside libxml2, Expat is 1 of the most wide used software libre XML parsers written successful C, specifically C99. It is cross-platform and licensed under the MIT license.
Starting 2026-08-01, the
"security vacation" of the project
has ended and(!) I will beryllium be paid to work
on maintaining libexpat for up to 6 months
thanks to
the City of Munich
under the umbrella of their
Open Source Sabbatical
program.
What does that mean?
For overmuch of the past 10 years, moving connected libexpat has been competing with my regular business arsenic a package engineer, chores, societal life and re-creation. For the first time, I americium now being employed to work on maintaining libexpat arsenic my "regular job" for a constricted play of time. My apical priorities will be:
-
Fixing the currently 5 known unfixed vulnerabilities
-
Adding support for XML 1.0r5
-
Further improving the robustness and maintainability of the project
Yesterday and coming astir of my clip went into fixing a vulnerability uncovered by Mozilla.
Technically, I americium being employed by digitial@M now for of up 6 months pinch a regular moving contract, including cancellation by either party, remotely from home. There is plentifulness to do.
Unvalidated AI slop submissions will still not beryllium apprecated, but for everything else: if you want to propulsion intelligence astatine uncovering further vulnerabilities in libexpat and send them my way, the coming months will beryllium the champion chance astatine getting things fixed successful reasonable time. Queueing theory and laws of physics still apply.
Wish maine luck!
PS: If anyone managed to combine Clang-based MinGW with AddressSanitizer and Wine without crashing astatine launch, please show maine really and drop maine an e-mail. Thank you!
Best, Sebastian
English (US) · 
Indonesian (ID) ·