--- title: libexpat now funded by the City of Munich for up to 6 months description: The libexpat XML parser project has secured funding from the City of Munich through their Open Source Sabbatical program, allowing maintainer Sebastian Pipping... canonical: https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: libexpat now funded by the City of Munich for up to 6 months | daily.dev og:description: The libexpat XML parser project has secured funding from the City of Munich through their Open Source Sabbatical program, allowing maintainer Sebastian Pipping... og:url: https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46 og:image: https://api.daily.dev/og/posts/eyjnUPy46.png og:image:alt: libexpat now funded by the City of Munich for up to 6 months og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # libexpat now funded by the City of Munich for up to 6 months **[Hacker News](https://daily.dev/sources/hn)** · 2 min read · 2 upvotes · 1 comments ## Summary The libexpat XML parser project has secured funding from the City of Munich through their Open Source Sabbatical program, allowing maintainer Sebastian Pipping to work full-time on the project for up to 6 months starting August 2026. Top priorities include fixing 5 known unfixed vulnerabilities, adding XML 1.0r5 support, and improving overall robustness. This marks the end of the project's 'security vacation' and represents a rare case of municipal government funding critical open source infrastructure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Who is funding the libexpat maintainer to work on the library full time? The City of Munich is funding libexpat maintenance for up to six months starting August 1, 2026, through its Open Source Sabbatical program. Maintainer Sebastian Pipping is employed by digital@M under a regular working contract, working remotely, with priorities including fixing five known unfixed vulnerabilities and adding XML 1.0r5 support. _Developers relying on libexpat can follow daily.dev for updates on this open source security work._ ### How many known unfixed vulnerabilities does libexpat currently have? There are five known unfixed vulnerabilities in libexpat as of the start of this funded maintenance period, which the maintainer lists as a top priority to address alongside XML 1.0r5 support and general robustness improvements during the up-to-six-month funded engagement. _Teams depending on libexpat for XML parsing can track vulnerability fixes through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 69 comments across hackernews (as of 2026-09-13). **TL;DR:** The community broadly welcomes Munich funding libexpat as a rare, positive example of municipal government supporting critical open source infrastructure, though the thread quickly diverges into a lengthy debate about European software sovereignty, LiMux history, and whether such funding priorities make sense. **Sentiment:** 62% positive · 25% mixed · 13% skeptical **The case for** - Munich's Open Source Sabbatical is open to external developers, not just city employees, making it a uniquely accessible public funding model. - Fixing known vulnerabilities in a widely-used XML parser (including by LibreOffice) is seen as a concrete, high-value use of public funds. - The 'Public Money, Public Code' principle behind the program is praised as a model other governments should adopt. - Commenters note the city saved €11.7 million during the LiMux era, framing open source investment as fiscally sound. **The pushback** - Some question whether a single XML parser is a high enough priority given the breadth of open source software cities depend on. - One commenter raised suspicions of favoritism, suggesting the selection process may not be fully transparent. - Concern that such funding is short-term and project sustainability after 6 months remains unclear. - Broader open source initiatives in European public administration are criticized for lacking full-stack commitment and reverting after political changes. **By community** - hackernews (positive): Broadly enthusiastic about the funding model and the 'Public Money, Public Code' principle, with a significant side-thread debating LiMux history and European software sovereignty rather than the libexpat news itself. **Hottest debate:** Whether European governments should prioritize migrating off proprietary software (like Microsoft Office) for sovereignty reasons, or whether such efforts waste resources that could go toward more strategically important technology. **Open questions** - What happens to libexpat maintenance and the known vulnerabilities after the 6-month funded period ends? - Will Munich's new mayor Dominik Krause actually revive broader open source commitments, or is this an isolated initiative? - Could the Open Source Sabbatical program be expanded or replicated by other municipalities? **Highlights** > https://opensource.muenchen.de/sabbatical.html > The Open Source Sabbatical is intended to provide professionally qualified software developers with the opportunity to work on an open source project for a limited period of time in order to improve it. > This sabbatical is not only open to employees of the City of Munich, but also to external software developers. So cool. Congrats to Sebastian! > — [wxw on hackernews · 1 comments](https://news.ycombinator.com/item?id=49176764) > The 6 month open source sabbatical is something any external developers can apply to (with a specific Open Source project and an Idea what to do), and the city selects among the candidates. They do explain why they picked libexpat[1] (google translate works well enough for the site). 1: https://opensource.muenchen.de/de/software/libexpat.html#ope... > — [what-is-water on hackernews](https://news.ycombinator.com/item?id=49178821) > Nobody whines when they overpay millions to Microsoft for trash software. Fund one tiny project and everybody loses their mind. > — [olyjohn on hackernews](https://news.ycombinator.com/item?id=49178220) > > The City of Munich follows the principle of Public Money, Public Code: Whenever possible, software developed in-house should be released as open source. The goal is not only to ensure the city’s own IT security but also to enable others to reuse the software securely, transparently, and in a traceable way.[1] [1] https://opensource.muenchen.de/security.html > — [warpech on hackernews](https://news.ycombinator.com/item?id=49179925) > The longer background is that Christian Ude our mayor until 2014 furthered the LiMux[1] project - migrating more than 14000 PCs in public administration to Linux. He got personal visits from both Ballmer and Gates that pressured him to stay with Microsoft[2] but did not balk. Unfortunately his successor caved to Microsoft's siren song abolished LiMux and Microsoft got a nice campus in the city (they used to be at the outskirts). Since May this year we have the young and energetic Dominik Krause and there is hope for change again. [1] https://en.wikipedia.org/wiki/LiMux [2] https://www.linux-magazin.de/ausgaben/2019/10/interview-2/ > — [weinzierl on hackernews · 6 comments](https://news.ycombinator.com/item?id=49176828) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49176606) · 281 points · 69 comments ## Community discussion Top comments from developers on daily.dev. **@taiwofrancis** · 0 upvotes > A win for the entire open-source ecosystem. ## Similar posts on daily.dev - [Stepping down as libxml2 maintainer](https://daily.dev/posts/stepping-down-as-libxml2-maintainer-ocr1nqoj1) · Hacker News · 0 upvotes · 0 comments - [nwellnhof/libxml2-ee: XML parser and toolkit, Enterprise Edition](https://daily.dev/posts/nwellnhof-libxml2-ee-xml-parser-and-toolkit-enterprise-edition-fv6joxiyc) · Lobsters · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#open-source](https://daily.dev/tags/open-source) [View this post on daily.dev](https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"libexpat now funded by the City of Munich for up to 6 months","url":"https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46"},"datePublished":"2026-08-05T00:15:20.979Z","dateModified":"2026-09-13T20:44:11.771Z","description":"The libexpat XML parser project has secured funding from the City of Munich through their Open Source Sabbatical program, allowing maintainer Sebastian Pipping...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,open-source","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"libexpat now funded by the City of Munich for up to 6 months"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46","comment":[{"@type":"Comment","text":"A win for the entire open-source ecosystem.","datePublished":"2026-08-05T04:18:44.526Z","url":"https://daily.dev/posts/eyjnUPy46#c-ytY2iT23F","author":{"@type":"Person","name":"Taiwo Francis Oguntade","url":"https://daily.dev/taiwofrancis","image":"https://media.daily.dev/image/upload/s--px3_Pvo4--/f_auto/v1785515368/avatars/avatar_FStpm3ZejUD3qGlEeoOUS?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/libexpat-now-funded-by-the-city-of-munich-for-up-to-6-months-eyjnupy46#faq","mainEntity":[{"@type":"Question","name":"Who is funding the libexpat maintainer to work on the library full time?","acceptedAnswer":{"@type":"Answer","text":"The City of Munich is funding libexpat maintenance for up to six months starting August 1, 2026, through its Open Source Sabbatical program. Maintainer Sebastian Pipping is employed by digital@M under a regular working contract, working remotely, with priorities including fixing five known unfixed vulnerabilities and adding XML 1.0r5 support. Developers relying on libexpat can follow daily.dev for updates on this open source security work."}},{"@type":"Question","name":"How many known unfixed vulnerabilities does libexpat currently have?","acceptedAnswer":{"@type":"Answer","text":"There are five known unfixed vulnerabilities in libexpat as of the start of this funded maintenance period, which the maintainer lists as a top priority to address alongside XML 1.0r5 support and general robustness improvements during the up-to-six-month funded engagement. Teams depending on libexpat for XML parsing can track vulnerability fixes through daily.dev."}}]} ```