F45 Change Proposal: libxml215 (system-wide)

Project Discussion Change Proposals
,
1

:link: Change Proposal Name libxml215

This is a proposed Change for Fedora Linux.
This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee.

Wiki
Announced

:link: Summary

Update the libxml2 library from version 2.13.9 to 2.15.3. This release includes critical security fixes and requires a system-wide mass rebuild due to an ABI (soname) change. Additionally, this update marks the official deprecation of the libxml2 Python bindings, which are scheduled for removal in 2.16.

:link: Owner

:link: Detailed Description

The update to 2.15.3 is necessary to address several security vulnerabilities fixed only in version 2.15.2 and above. Version 2.14 introduces an ABI change, requiring all packages linked against libxml2 to be rebuilt.

Furthermore, upstream has deprecated the libxml2 Python bindings. While these remain present in 2.15.3, they will be removed in 2.16. Fedora packages currently using these bindings must be ported to alternatives, such as python3-lxml or the standard library’s xml.etree. Concretely, this will mean that the python3-libxml2 subpackage will be marked as deprecated.

:link: Feedback

:link: Benefit to Fedora

  • Security: Several security vulnerabilities, that are only fixed in 2.15.2 and above, are fixed in this release
  • Modernization: Aligns Fedora with the latest upstream release, which sees security and bugfixes.

:link: Scope

  • Proposal owners:

    • Perform the libxml2 library update in Rawhide.
    • Coordinate the mass rebuild with Release Engineering.
    • Deprecation Management:
      • Audit all packages in Fedora using python3-libxml2.
      • Notify maintainers of affected packages.
      • Provide guidance/patches for migrating to lxml or ElementTree.

  • Other developers:

    • Mass Rebuild: Maintainers of packages depending on libxml2 must ensure their packages rebuild successfully against the new ABI.
    • Migration: Maintainers of packages relying on the Python bindings in python3-libxml2 must begin porting their code to alternative libraries before the planned removal in 2.16.

  • Release engineering: #13382

    • A mass rebuild will be required due to the ABI change.

  • Policies and guidelines: N/A (not needed for this Change)

  • Trademark approval: N/A (not needed for this Change)

  • Alignment with the Fedora Strategy:

:link: Upgrade/compatibility impact

  • C ABI: Applications not rebuilt will fail to run due to the soname change.
  • Python ABI: Although applications using the Python bindings will run, the applications will need to be ported to alternative APIs before libxml2 2.16 is released.

:link: Early Testing (Optional)

Do you require ‘QA Blueprint’ support? N

Proposed MR for the package update to 2.15.3: Making sure you're not a bot!

:link: How To Test

There should be no user-visible changes to test, as the majority of the upstream changes are removing old and unused code in the libxml2 library. A mass rebuild of dependent packages is the most effective test, but testing that functionality using libxml2 in those packages still works as expected will be useful.

:link: User Experience

:link: Dependencies

Preliminary list of packages depending on libxml2: approximately 600 binary packages, including many critical path packages.

Preliminary list of packages depending on python3-libxml2, which will be affected by the deprecation and eventual removal:

  • beaker-client
  • gnome-doc-utils
  • imagefactory
  • itstool
  • koji-vm
  • ovfenv-
  • python3-dmidecode
  • python3-libxslt
  • rteval
  • setroubleshoot-server
  • virt-manager-common

:link: Contingency Plan

  • Contingency mechanism:
    • ABI Breakage: If the mass rebuild is unsuccessful or reveals widespread, unresolvable issues, revert to 2.13.9.
    • Binding Deprecation: If a critical system package cannot be ported away from the libxml2 Python bindings in time, we will maintain the bindings in a separate legacy package (python3-libxml2-legacy) as a temporary measure until the migration is completed.
  • Contingency deadline: Beta freeze
  • Blocks release? Yes

:link: Documentation

There were many removals and deprecations between 2.13.9 and 2.15.3, including:

  • Removal of FTP, HTTP and LZMA support
  • Removal of the libxml.m4 autoconf macros
  • Deprecation of direct struct access, with many accessor functions added

In addition, many other bugfixes and security fixes were added, including:

  • CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
  • CVE-2026-0990 fix: Prevent infinite recursion in xmlCatalogListXMLResolve
  • CVE-2026-0992 fix: Exponential behavior when handling
  • parser: Fix infinite loop in xmlCtxtParseContent
  • CVE-2025-10911 libxslt related: Ignore next/prev of documents when traversing XPath
  • CVE-2026-0989 fix: Add RelaxNG include limit

:link: Release Notes

Last edited by @amoloney 2026-06-11T19:02:51Z

Last edited by @amoloney 2026-06-11T19:02:51Z

2

How do you feel about the proposal as written?

  • Strongly in favor
  • In favor, with reservations
  • Neutral
  • Opposed, but could be convinced
  • Strongly opposed
0 voters

If you are in favor but have reservations, or are opposed but something could change your mind, please explain in a reply.

We want everyone to be heard, but many posts repeating the same thing actually makes that harder. If you have something new to say, please say it. If, instead, you find someone has already covered what you’d like to express, please simply give that post a :heart: instead of reiterating. You can even do this by email, by replying with the heart emoji or just “+1”. This will make long topics easier to follow.

Please note that this is an advisory “straw poll” meant to gauge sentiment. It isn’t a vote or a scientific survey. See About the Change Proposals category for more about the Change Process and moderation policy.

3

There was some feedback on the devel list that should be considered before this is filed with FESCo.

4

Link to thread.

5

This change proposal has now been submitted to FESCo with ticket #3628 for voting.

To find out more, please visit our Changes Policy documentation.

6

@amigadave can you respond to the feedback in either the mailing list or here? It’s almost a month since the change announcement with no follow-up

7

Hi, sorry for the delay, I missed the feedback.
I created a COPR with the updated package for testing: Making sure you're not a bot!
Additionally, I added a 2.13 subpackage, which provides only the old shared objects, which should ease the transition during a mass rebuild. I will try out mass-prebuild using the above COPR to see if there is any major problem caused by the update.
Regarding the Python module deprecation, upstream says that it will continue to provide the module for the foreseeable future, which is a little different than the previous maintainer saying that it would be removed in 2.16. Deprecating the subpackage may still be a good idea, though.
The updated package, including the 2.13 transitional subpackage, is in the merge request: Making sure you're not a bot!

8

This is very useful! Approx. 70 packages failed. Is a summary of why
those failures available?

E.g. httpd fails with:

  • xmlto man apachectl.xml
    xmlto: /builddir/build/BUILD/httpd-2.4.68-build/httpd-2.4.68/apachectl.xml does not validate (status 4)
    xmlto: Fix document syntax or use --skip-validation option
    /builddir/build/BUILD/httpd-2.4.68-build/httpd-2.4.68/apachectl.xml:3: parser error : Start tag expected, ‘<’ not found
    “http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd”>[
    ^
    error: Bad exit status from /var/tmp/rpm-tmp.8pckzq (%prep)
    Bad exit status from /var/tmp/rpm-tmp.8pckzq (%prep)

I assume that’s caused by the libxml update
 What is the plan here?