libexpat now funded by the City of Munich for up to 6 months

The City of Munich has announced that it will fund the maintenance of the popular open-source software libexpat for up to six months, starting on August 1, 2026. libexpat is a fast streaming XML parser that is widely used across various platforms and is licensed under the MIT license. The funding comes as part of the city's Open Source Sabbatical program.

For the past decade, maintainer Adrian Chadd has had to balance work on libexpat with his regular job as a software engineer, personal responsibilities, and leisure activities. With this new funding, Chadd will now be employed full-time by digital@M to work on maintaining libexpat on a regular basis for a limited period of six months.

Chadd's top priorities for the duration of the funding will be to address the five known unfixed vulnerabilities in the project and to further improve the robustness and maintainability of libexpat. Most of his recent time has been spent fixing a vulnerability discovered by Mozilla.

Chadd works remotely from home under a regular working contract with digital@M, which allows for cancellation by either party. He emphasizes that the coming months present an excellent opportunity for others to help find and fix additional vulnerabilities in libexpat. However, he warns that unsolicited submissions of AI-generated content will not be welcomed.