Munich Will Fund Six Months of Work on libexpat

Sebastian Pipping, the longtime maintainer of the libexpat library, has announced that as of August 1, 2026 he is being paid to work on the project — up to six months under the city of Munich's Open Source Sabbatical program. Formally, he is employed on an ordinary work contract within the digital@M organization and works remotely from home; the contract can be terminated by either party.

libexpat is a fast, streaming XML parser written in C (C99, to be precise), cross-platform and distributed under the MIT license. Along with libxml2, it is one of the most widely used free libraries for parsing XML.

From a Hobby to a Day Job

Pipping admits that for almost the entire past decade, work on libexpat competed with his main engineering job, household chores, socializing and rest. For the first time, maintaining the library is becoming genuine paid “work” for him — even if only for a limited time. With the start of the project's “security sabbatical,” the maintainer has set his priorities:

• fix five known but as-yet-unpatched vulnerabilities;
• add support for XML 1.0r5;
• generally improve the reliability and maintainability of the project.

According to the author, the first two days went into fixing a vulnerability reported by Mozilla.

Send Bugs, but No “AI Slop”

Pipping invites researchers to focus their efforts on finding new vulnerabilities in libexpat: the coming months are the best chance to see fixes land within a reasonable time frame, since the backlog and the laws of physics, as he wryly notes, haven't gone anywhere. At the same time, he specifically stipulates that unverified, AI-generated reports are still unwelcome.

The post ends with a request far removed from bureaucracy: if anyone has managed to combine the Clang build of MinGW with AddressSanitizer and Wine in a way that doesn't crash on startup, the author would be grateful for a tip by email.

Source: Hacker News