View packages at a commit

Paste a `locked_commit` from your `minimal.toml`, or a recent commit from the list.

Back to search results
expat owner avatar

expat

Version: 2.9.0

:herb: Fast streaming XML parser written in C99 with >90% test coverage; moved from SourceForge to GitHub

Install package

min add expat
Librarycc99expat

OpenSSF Score

OpenSSF Scorecard — expat

Scored 0–10, as OpenSSF Scorecard reports them.N/A: not applicable or inconclusive.

Binary-Artifacts

No binaries found in the repo

10
Branch-Protection

Branch protection is not maximal on development and all release branches

3
CII-Best-Practices

Badge detected: Passing

5
Code-Review

Found 4/9 approved changesets -- score normalized to 4

4
Dangerous-Workflow

No dangerous workflow patterns detected

10
Fuzzing

Project is fuzzed

10
License

License file detected

10
Maintained

30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10

10
Packaging

Packaging workflow not detected

N/A
Pinned-Dependencies

All dependencies are pinned

10
SAST

SAST tool is not run on all commits -- score normalized to 0

0
Security-Policy

Security policy file detected

10
Signed-Releases

5 out of the last 5 releases have a total of 5 signed artifacts.

8
Token-Permissions

GitHub workflow tokens follow principle of least privilege

10

Scored by OpenSSF Scorecard, from OpenSSF's weekly scan of public GitHub repositories.

libexpat/libexpatscanned

Last scored on

What is "expat"?

:herb: Fast streaming XML parser written in C99 with >90% test coverage; moved from SourceForge to GitHub

How to use this package

Quick install

Installs the package into the current environment for this session. Use --build or --runtime to persist it as a build-time or runtime dependency.

min add expat

Declare as a task dependency in minimal.toml

Listing the package under tasks.<name>.packages makes it available inside that task’s sandbox.

[tasks.dev]
packages = ["expat"]

Build-time vs runtime

Choose build-time for tools needed during compilation, runtime for dynamic libraries loaded at runtime.

min add --build expat
min add --runtime expat
Compare versions
to

Dependencies (4)

Dependencies
NameVersionKind
base-bootstrap—build
glibc2.44runtime
make4.4.1build
toolchain—build

Dependants (10)

Dependants
NameVersion
chromium-binCVE:29156.0.8078.47
chromium-headless-shell-bin156.0.8078.73
cmake4.4.4
dbus1.16.2
fontconfig2.18.3
gdb17.2
git2.56.0
libvips8.18.6
mesa26.2.5
pythonCVE:13.14.10
  1. expat v2.9.000b3d07
    Diff
    Lines:+2 / -2Deps:4CVE:2
    Released:
  2. expat v2.8.5a9c39ec
    Diff
    Lines:+7 / -3Deps:4
    Released:
  3. expat v2.8.4e502a84
    Diff
    Lines:+2 / -2Deps:4
    Released:
  4. expat v2.8.3c6b5542
    Diff
    Lines:+2 / -2Deps:4
    Released:
  5. expat v2.8.213b5e0e
    Diff
    Lines:+2 / -2Deps:4
    Released:
  6. expat v2.7.51975757
    Diff
    Lines:+7 / -3Deps:4
    Released:
  7. expat v2.7.311a4145
    Diff
    Lines:+39 / -18Deps:4(+1 / -1)
    Released:
  8. expat vc3ca6ee
    Diff
    Lines:+44Deps:4(+4)
    Released:

Showing 2 advisories

Security advisories for this package
High (2)
StatusIDsPackageSeverity

Build provenance

Loading provenance

For the signed record of what the build used, see the Provenance tab.

Software Bill of Materials — every package this build depends on
PackagesVersion
expatROOT2.9.0
acl2.4.0
attr2.6.0
bash5.3
bash-bootstrap5.3
binutils2.47
bison3.8.2
bzip21.0.8
coreutils9.12
diffutils3.12
file5.48
findutils4.11.0
flex2.6.4
gawk5.4.1
gawk-bootstrap5.4.1
gcc15.2.0
gdbm1.26
glibc2.44
gmp6.3.0
grep3.12
gzip1.15
libcap2.78
libffi3.8.0
linux_headers6.12.43
lz41.10.0
m41.4.21
make4.4.1
mpc1.4.1
mpfr4.2.2
ncurses6.6
openssl4.1.0
patch2.8.1
pcre210.49
perl5.44.0
pkgconf3.0.5
python3.14.10
readline8.3
sed4.10
sqlite3.54.0
tar1.35
tzdata2026e
util-linux2.42.4
xz5.8.4
zlib1.3.2
zstd1.5.7

Join the waitlist

Confirm your identity by email or GitHub.

or