Hartwork Blog · libexpat now funded by the City of Munich for up to 6 months

For readers new to Expat:

libexpat is a fast streaming XML parser.
Alongside libxml2, Expat is one of the
most widely used
software libre XML parsers written in C, specifically C99.
It is cross-platform and licensed under
the MIT license.

Starting 2026-08-01, the
“security vacation” of the project
has ended and(!) I will be be paid to work
on maintaining libexpat for up to 6 months
thanks to
the City of Munich
under the umbrella of their
Open Source Sabbatical
program.
What does that mean?

For much of the past 10 years, working on libexpat has been competing
with my regular occupation as a software engineer, chores, social life and
re-creation. For the first time, I am now being employed to work
on maintaining libexpat as my “regular job” for a limited period of time.
My top priorities will be:

Yesterday and today most of my time went into fixing a
vulnerability uncovered by Mozilla.

Technically, I am being employed by digitial@M
now for of up 6 months with a regular working contract, including
cancellation by either party, remotely from home. There is plenty to do.

Unvalidated AI slop submissions will still not be apprecated, but for everything else:
if you want to throw intelligence at finding further vulnerabilities
in libexpat and send them my way,
the coming months will be the best chance at getting things fixed in reasonable time.
Queueing theory and laws of physics still apply.

Wish me luck!

PS: If anyone managed to combine
Clang-based MinGW with
AddressSanitizer
and Wine without
crashing at launch,
please show me how and drop me an e-mail. Thank you!

Best, Sebastian