# expat 2.8.2

:herb: Fast streaming XML parser written in C99 with >90% test coverage; moved from SourceForge to GitHub

Snapshot of gominimal/pkgs commit `545842f16bb432a11517c8cded28c2f6fb9a690c` (pushed 2026-07-27T19:51:20.000Z).

## Install

```sh
min add expat
```

## Direct advisories

| ID | Severity | CVSS | Fix status | Fixed version | Summary |
| --- | --- | --- | --- | --- | --- |
| CVE-2026-45186 | LOW | 2.9 | fixed | R.2.8.1 | — |
| CVE-2026-50219 | MEDIUM | 4.9 | fixed | R.2.8.2 | — |
| CVE-2026-56131 | MEDIUM | 4.9 | fixed | R.2.8.2 | — |
| CVE-2026-56132 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56403 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56404 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56405 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56406 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56407 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56408 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56409 | MEDIUM | 6.5 | fixed | R.2.8.2 | — |
| CVE-2026-56410 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56411 | MEDIUM | 6.9 | fixed | R.2.8.2 | — |
| CVE-2026-56412 | MEDIUM | 4.9 | fixed | R.2.8.2 | — |

## Transitive advisories

None at this commit.

## Dependencies

- Build (3): base-bootstrap, make, toolchain
- Runtime (1): glibc

## Scorecard

| Category | Score | Band |
| --- | --- | --- |
| supply-chain | 96 | good |
| advisories | 100 | perfect |
| quality | 55 | mid |
| maintenance | 100 | perfect |
| licence | 100 | perfect |

## Links

- Homepage: https://libexpat.github.io/
- Package page (HTML): https://minimal.dev/pkgs/expat
- JSON API (floats latest): https://minimal.dev/api/pkgs/expat.json
- SBOM (CycloneDX 1.5): https://minimal.dev/api/pkgs/expat/sbom.json