libexpat Gets a Paid Maintainer: Munich Funds 6-Month Security Sprint
Starting August 1, 2026, Sebastian Pipping, the maintainer of libexpat, is officially employed by the City of Munich to work on the project full-time. The contract runs for up to six months, under Munich's Open Source Sabbatical program. This is the first time Pipping has been paid to maintain libexpat, which he has done on a volunteer basis for the past decade.
The Immediate Priority: Fixing Vulnerabilities
Pipping's top priority is fixing five known unfixed vulnerabilities. Within the first two days, he already spent most of his time on a vulnerability reported by Mozilla. The project has a history of security issues, and the new funding allows for dedicated attention to these critical bugs.
Technical Details: XML 1.0r5 and Beyond
Beyond security, Pipping plans to add support for XML 1.0r5, the latest revision of the XML specification. This is a significant update that brings changes to character encoding and conformance requirements. He also aims to improve the overall robustness and maintainability of the codebase, which is written in C99 and cross-platform.
The Backstory: A Decade of Volunteer Work
For years, Pipping balanced libexpat maintenance with his full-time job as a software engineer. The new arrangement gives him the rare opportunity to treat maintenance as his "regular job." He notes that there is plenty to do, and the funding will directly translate into faster fixes and more proactive improvements.
A Call for Help: Finding More Bugs
Pipping is actively encouraging security researchers to submit vulnerability reports. He specifically mentions that the coming months are the best chance to get issues fixed in a reasonable time. He also makes a tongue-in-cheek reference to queueing theory, implying that he can now process a higher volume of reports.
A Technical Challenge: Clang, MinGW, and Wine
In a side note, Pipping asks for help with a specific technical problem: combining Clang-based MinGW with AddressSanitizer and Wine without crashing at launch. This is a niche but real issue for developers doing cross-platform C development. If you've solved this, he wants to hear from you.
Why This Matters for Developers
libexpat is one of the most widely used XML parsers, alongside libxml2. It's embedded in countless applications, from web servers to desktop software. A security vulnerability in libexpat can have far-reaching consequences. This funding ensures that critical fixes are prioritized and delivered faster.
The Bigger Picture: Government Funding for Open Source
Munich's Open Source Sabbatical program is a notable example of government support for critical open-source infrastructure. It sets a precedent that could encourage other municipalities to fund maintainers of essential projects. This is a positive development for the sustainability of open-source software.
What's Next for libexpat?
With dedicated funding, the project can now address long-standing issues and improve its security posture. Developers who rely on libexpat should watch for updates and consider testing the upcoming releases. The six-month window is a unique opportunity for the community to contribute and benefit.
A Personal Note from the Maintainer
Pipping ends his announcement with a simple "Wish me luck!" — a humble request from someone who has dedicated years to a thankless task. Now, with institutional support, he can focus on making libexpat more secure and robust for everyone.
How You Can Help
If you use libexpat, consider reporting any bugs you find. If you have experience with Clang, MinGW, and Wine, Pipping would appreciate your expertise. The project is open to contributions, and the current funding period is an ideal time to get involved.
Conclusion
This is a win for the open-source community. The City of Munich's investment in libexpat is a model for how governments can support critical software infrastructure. For developers, it means a more secure and reliable XML parser in the months ahead.
