Horton

Re: libxml2 author overwhelmed with security requests

Tom Lane <tgl@sss.pgh.pa.us>

View thread
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Bruce Momjian <bruce@momjian.us>
Cc: Sandeep Thakkar <sandeep.thakkar@enterprisedb.com>, Pavel Stehule <pavel.stehule@gmail.com>, Jim Jones <jim.jones@uni-muenster.de>, PostgreSQL-development <pgsql-hackers@lists.postgresql.org>
Date: 2025-07-28T14:15:17Z
Lists: pgsql-hackers 
Bruce Momjian <bruce@momjian.us> writes:
> Where do we think our use of libxml2 is heading?  Do you suspect
> security scanners will start negative reporting the use of libxml2?

There's at least one distro that's already stopped building with
--with-libxml out of security concerns.  (I forget who exactly,
but it's been mentioned on the PG lists.)

			regards, tom lane