City of Munich funds libexpat maintainer for up to six months to fix vulnerabilities and improve XML parser robustness

The maintainer of libexpat, a widely used C-based XML parser, says the project is now funded by the City of Munich for up to six months through its Open Source Sabbatical program. The work will prioritize fixing five known vulnerabilities, adding XML 1.0r5 support, and improving security and maintainability.

This is another example of public-sector support helping sustain critical open source infrastructure that many organizations rely on but few directly fund. Short-term paid maintenance could accelerate fixes, but it also highlights the need for more durable funding models for open source security.