Automic VaultAutomic Vault

brew

Install expat with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper

XML 1.0 parser. Version 2.8.2 via Homebrew; verified 2026-06-25.

Install commandSecurity notes

install

Additional install commands

macOS

Homebrewverified · 100%
brew install expat

local Homebrew formula metadata

MacPortsverified · 94%
sudo port install expat

MacPorts ports tree · textproc/expat/Portfile · source: api.github.com

Linux

Alpine Linux apkverified · 92%
sudo apk add expat

Alpine Linux edge package indexes · expat · source: dl-cdn.alpinelinux.org

Debian aptverified · 92%
sudo apt install expat

Debian stable package indexes · expat · source: deb.debian.org

Fedora dnfverified · 92%
sudo dnf install expat

Fedora Rawhide package metadata · expat · source: dl.fedoraproject.org

Nixverified · 92%
nix profile install nixpkgs#expat

nixpkgs package indexes · pkgs/by-name/ex/expat/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%
sudo pacman -S expat

Arch Linux sync databases · expat · source: geo.mirror.pkgbuild.com

openSUSE zypperverified · 92%
sudo zypper install expat

openSUSE Tumbleweed package metadata · expat · source: download.opensuse.org

overview

Package summary

XML 1.0 parser

Commands and aliases

  • xmlwf

history

Project history and usage

Expat is a fast streaming XML parser library written in C, with xmlwf as its command-line well-formedness checker. It is package-manager-famous because XML parsing became infrastructure, and Expat is small, MIT-licensed, embeddable, and widely shipped.

Project history

The official repository describes Expat as a C99 library for parsing XML 1.0, started by James Clark in 1997. Its model is event-oriented: users register handlers before parsing, and those handlers are called as document structures are discovered.

The project site frames Expat around streaming rather than building a full in-memory document tree. That makes it useful for files too large to fit in memory, and for applications where parser performance and flexible callbacks are more important than a high-level DOM interface.

Adoption history

The Expat homepage states that numerous applications, libraries, and hardware use Expat, that bindings and third-party wrappers exist, and that Expat is packaged everywhere. That breadth is the key adoption story: many users never invoke xmlwf directly, but they depend on Expat through another program or language runtime.

The repository README documents common build-system integration, including CMake find_package usage. That is a sign of mature library adoption: Expat is not just an executable in package managers, but a dependency with headers, link targets, and ABI expectations.

How it is used

Developers use libexpat when they want a C XML parser that calls application-defined handlers for starts, ends, character data, and related XML structures. The included xmlwf executable is used to check whether XML input is well formed.

Because XML parsers sit at input boundaries, Expat's package history is often security-driven. The official GitHub issue tracker includes release coordination that references downstream updates in CPython, Gentoo, Spack, Homebrew, NixOS, MSYS2, and other packaging ecosystems when CVE fixes land.

Why package nerds care

Expat is a dependency-package archetype: boring when healthy, urgent when vulnerable. It is small enough to be embedded or vendored, but important enough that a security update can ripple through Python, Linux distributions, language package sets, and embedded builds.

The package also demonstrates the difference between library identity and command identity. Homebrew exposes xmlwf as the executable, while the real package value is libexpat and its headers.

Timeline

  • 1997: James Clark started Expat.
  • 2.4.x: Security releases triggered broad downstream package updates.
  • 2025: Expat 2.7.2 release coordination referenced Homebrew, CPython, NixOS, MSYS2, Spack, Gentoo, and other downstreams.
  • 2026: Expat 2.8.x release coordination continued around security fixes and downstream updates.

Related projects

  • CPython is a major downstream because Python includes pyexpat bindings and coordinates bundled Expat updates.
  • CMake's FindEXPAT module is an important integration path for C and C++ projects.
  • Other XML parsers are related by role, but Expat's official documentation emphasizes its streaming C API.

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for expat. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

  • No Homebrew post-install hook is recorded in formula metadata.
  • Homebrew bottle metadata is available for 6 platform targets.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

executables

Installed executables

CommandKindExposureNote
xmlwfcliglobal executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-08
manager version2.8.2
manager updated2026-06-25
local dataok
upstreamnot checked
latest detectednot detected

https://github.com/libexpat/libexpat

install metadata

Package metadata

Package keybrew:expat
Version2.8.2
Package managerHomebrew
Package manager pagehttps://formulae.brew.sh/formula/expat
Homepagehttps://libexpat.github.io/
Repositoryhttps://github.com/libexpat/libexpat
Upstream docshttps://libexpat.github.io/doc
LicenseMIT
Source archivehttps://github.com/libexpat/libexpat/releases/download/R_2_8_2/expat-2.8.2.tar.xz
Last updated2026-06-25T21:42:09Z
Pulseupdated
Bottleavailable (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux)
Homebrew post-installnot defined
Servicenone declared

registry facts

Source database details

Source DatabaseHomebrew formula API
Taphomebrew/core
Full Nameexpat
Version Scheme0
Revision0
Head VersionHEAD
Bottle Stable Root URLhttps://ghcr.io/v2/homebrew/core
Deprecatedno
Disabledno
Keg Onlyyes
URL Keys
  • head
  • stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Debian apt95%

expat 2.7.1-2

XML parsing C library - example application

https://libexpat.github.io/

sudo apt install expat
  • Section: text
  • Architecture: amd64
  • 2 dependencies
  • normalized package name match
  • Matched by: Expat
Debian stable package indexes · deb.debian.org · Debian stable package indexes: expat from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Debian apt95%

libexpat1 2.7.1-2

XML parsing C library - runtime library

https://libexpat.github.io/

sudo apt install libexpat1
  • Section: libs
  • Architecture: amd64
  • Source Package: expat
  • normalized package name match
  • Matched by: Expat
Debian stable package indexes · deb.debian.org · Debian stable package indexes: libexpat1 from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Debian apt95%

libexpat1-dev 2.7.1-2

XML parsing C library - development kit

https://libexpat.github.io/

sudo apt install libexpat1-dev
  • Section: libdevel
  • Architecture: amd64
  • Source Package: expat
  • 3 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Expat
Debian stable package indexes · deb.debian.org · Debian stable package indexes: libexpat1-dev from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz
Nix95%

expat

nix profile install nixpkgs#expat
  • normalized package name match
  • Matched by: Expat
nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/ex/expat/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1
Ubuntu apt95%

expat 2.6.1-2build1

XML parsing C library - example application

https://libexpat.github.io/

sudo apt install expat
  • Section: universe/text
  • Architecture: amd64
  • 2 dependencies
  • normalized package name match
  • Matched by: Expat
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: expat from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz
Ubuntu apt95%

libexpat1 2.6.1-2build1

XML parsing C library - runtime library

https://libexpat.github.io/

sudo apt install libexpat1
  • Section: libs
  • Architecture: amd64
  • Source Package: expat
  • 1 dependencies
  • normalized package name match
  • Matched by: Expat
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: libexpat1 from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz
Ubuntu apt95%

libexpat1-dev 2.6.1-2build1

XML parsing C library - development kit

https://libexpat.github.io/

sudo apt install libexpat1-dev
  • Section: libdevel
  • Architecture: amd64
  • Source Package: expat
  • 3 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Expat
Ubuntu 24.04 LTS package indexes · archive.ubuntu.com · Ubuntu 24.04 LTS package indexes: libexpat1-dev from https://archive.ubuntu.com/ubuntu/dists/noble/main/binary-amd64/Packages.gz
apk95%

expat 2.8.1-r0

XML Parser library written in C

https://libexpat.github.io/

sudo apk add expat
  • License: MIT
  • Architecture: x86_64
  • Source Package: expat
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Expat
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: expat from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
apk95%

expat-dev 2.8.1-r0

XML Parser library written in C (development files)

https://libexpat.github.io/

sudo apk add expat-dev
  • License: MIT
  • Architecture: x86_64
  • Source Package: expat
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Expat
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: expat-dev from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
apk95%

expat-doc 2.8.1-r0

XML Parser library written in C (documentation)

https://libexpat.github.io/

sudo apk add expat-doc
  • License: MIT
  • Architecture: x86_64
  • Source Package: expat
  • normalized package name match
  • Matched by: Expat
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: expat-doc from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
apk95%

expat-static 2.8.1-r0

XML Parser library written in C (static library)

https://libexpat.github.io/

sudo apk add expat-static
  • License: MIT
  • Architecture: x86_64
  • Source Package: expat
  • 1 dependencies
  • normalized package name match
  • Matched by: Expat
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: expat-static from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
apk95%

libexpat 2.8.1-r0

XML Parser library written in C (libraries)

https://libexpat.github.io/

sudo apk add libexpat
  • License: MIT
  • Architecture: x86_64
  • Source Package: expat
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Expat
Alpine Linux edge package indexes · dl-cdn.alpinelinux.org · Alpine Linux edge package indexes: libexpat from https://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/APKINDEX.tar.gz
dnf95%

expat 2.8.1-1.fc45

An XML parser library

https://libexpat.github.io/

sudo dnf install expat
  • License: MIT
  • Category: Unspecified
  • Architecture: i686
  • Source Package: expat
  • 3 dependencies
  • 2 provides
  • normalized package name match
  • Matched by: Expat
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: expat from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
dnf95%

expat-devel 2.8.1-1.fc45

Libraries and header files to develop applications using expat

https://libexpat.github.io/

sudo dnf install expat-devel
  • License: MIT
  • Category: Unspecified
  • Architecture: i686
  • Source Package: expat
  • 3 dependencies
  • 2 provides
  • normalized package name match
  • Matched by: Expat
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: expat-devel from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
dnf95%

expat-static 2.8.1-1.fc45

expat XML parser static library

https://libexpat.github.io/

sudo dnf install expat-static
  • License: MIT
  • Category: Unspecified
  • Architecture: i686
  • Source Package: expat
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Expat
Fedora Rawhide package metadata · dl.fedoraproject.org · Fedora Rawhide package metadata: expat-static from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst
pacman95%

expat 2.8.1-1

An XML parser library

https://libexpat.github.io/

sudo pacman -S expat
  • License: MIT
  • Architecture: x86_64
  • 1 dependencies
  • 1 provides
  • normalized package name match
  • Matched by: Expat
Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: expat from https://geo.mirror.pkgbuild.com/core/os/x86_64/core.db.tar.gz

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

Related tools

  • avahiPopular package that depends on this formula.
  • s3-backerPopular package that depends on this formula.
  • waylandPopular package that depends on this formula.
  • webkitgtkPopular package that depends on this formula.

Same workflow

  • libxml2Shares av.db curated category or tags: c-library, cli, developer-tools, libraries, parser.
  • libxsltShares av.db curated category or tags: c-library, cli, developer-tools, libraries, xml.
  • libwbxmlShares av.db curated category or tags: cli, developer-tools, parser, xml.
  • libxoShares av.db curated category or tags: c-library, cli, developer-tools, libraries, xml.
  • castxmlShares av.db curated category or tags: cli, developer-tools, xml.
  • cdkShares av.db curated category or tags: c-library, cli, developer-tools, libraries.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Used sources

  • Geiger risk classifier
  • Nucleus package database
  • av.db category and tag curation
  • cross-ecosystem install command graph
  • curated package history
  • external package-manager database matches
  • package relationship graph
  • package version freshness
  • package-page enrichment