libexpat now funded by the City of Munich for up to 6 months

# Hartwork Blog · libexpat now funded by the City of Munich for up to 6 months Source: [https://blog.hartwork.org/posts/libexpat-city-of-munich-open-source-sabbatical/](https://blog.hartwork.org/posts/libexpat-city-of-munich-open-source-sabbatical/) 2026\-08\-04 20:04For readers new to Expat: > [libexpat](https://libexpat.github.io/)is a fast streaming XML parser\. Alongside libxml2, Expat is one of the[most widely used](https://libexpat.github.io/doc/users/)software libre XML parsers written in C, specifically C99\. It is cross\-platform and licensed under[the MIT license](https://opensource.org/licenses/MIT)\. Starting 2026\-08\-01, the["security vacation" of the project](https://github.com/libexpat/libexpat/issues/1277)has ended and\(\!\) I will be be paid to work on maintaining libexpat for up to 6 months thanks to the[City of Munich](https://en.wikipedia.org/wiki/Munich)under the umbrella of their[Open Source Sabbatical](https://opensource.muenchen.de/software/libexpat.html#open-source-sabbatical)program\. What does that mean? For much of the past 10 years, working on libexpat has been competing with my regular occupation as a software engineer, chores, social life and re\-creation\. For the first time, I am now being employed to work on maintaining libexpat as my "regular job" for a limited period of time\. My top priorities will be: - Fixing the[currently 5 known unfixed vulnerabilities](https://github.com/libexpat/libexpat/issues/1160) - Adding[support for XML 1\.0r5](https://github.com/libexpat/libexpat/issues/171) - Further improving the robustness and maintainability of the project Yesterday and today most of my time went into fixing a[vulnerability uncovered by Mozilla](https://github.com/libexpat/libexpat/pull/1296)\. Technically, I am being employed by[digitial@M](https://digital-at-m.de/)now for of up 6 months with a regular working contract, including cancellation by either party, remotely from home\. There is plenty to do\. Unvalidated AI slop submissions will still not be apprecated, but for everything else: if you want to throw intelligence at finding further vulnerabilities in libexpat and[send them my way](mailto:[email protected]), the coming months will be the best chance at getting things fixed in reasonable time\.[Queueing theory](https://en.wikipedia.org/wiki/Queueing_theory)and laws of physics still apply\. Wish me luck\! PS: If anyone managed to combine[Clang\-based MinGW](https://github.com/mstorsjo/llvm-mingw)with[AddressSanitizer](https://clang.llvm.org/docs/AddressSanitizer.html)and Wine without[crashing at launch](https://github.com/libexpat/libexpat/actions?query=branch%3Amingw-clang-ci), please show me how and[drop me an e\-mail](mailto:[email protected])\. Thank you\! Best, Sebastian