Hartwork Blog · libexpat now funded by the City of Munich for up to 6 months
Skip to main content
Hartwork Blog
Free Software, Music, Chinese Chess
libexpat now funded by the City of Munich for up to 6 months
2026-08-04 20:04
For readers new to Expat:
libexpat is a fast streaming XML parser.<br>Alongside libxml2, Expat is one of the<br>most widely used<br>software libre XML parsers written in C, specifically C99.<br>It is cross-platform and licensed under<br>the MIT license.
Starting 2026-08-01, the<br>"security vacation" of the project<br>has ended and(!) I will be be paid to work<br>on maintaining libexpat for up to 6 months<br>thanks to<br>the City of Munich<br>under the umbrella of their<br>Open Source Sabbatical<br>program.
What does that mean?
For much of the past 10 years, working on libexpat has been competing<br>with my regular occupation as a software engineer, chores, social life and<br>re-creation. For the first time, I am now being employed to work<br>on maintaining libexpat as my "regular job" for a limited period of time.<br>My top priorities will be:
Fixing the currently 5 known unfixed vulnerabilities
Adding support for XML 1.0r5
Further improving the robustness and maintainability of the project
Yesterday and today most of my time went into fixing a<br>vulnerability uncovered by Mozilla.
Technically, I am being employed by digitial@M<br>now for of up 6 months with a regular working contract, including<br>cancellation by either party, remotely from home. There is plenty to do.
Unvalidated AI slop submissions will still not be apprecated, but for everything else:<br>if you want to throw intelligence at finding further vulnerabilities<br>in libexpat and send them my way,<br>the coming months will be the best chance at getting things fixed in reasonable time.<br>Queueing theory and laws of physics still apply.
Wish me luck!
PS: If anyone managed to combine<br>Clang-based MinGW with<br>AddressSanitizer<br>and Wine without<br>crashing at launch,<br>please show me how and drop me an e-mail. Thank you!
Best, Sebastian