libexpat 2.8.2 regression affecting large Subversion checkouts on Windows and 32-bit platforms (fixed in 2.8.3)

Hi all,

This is a small heads-up for those who use or package Apache Subversion.

Subversion internally uses libexpat to parse the XML responses.  libexpat
version 2.8.2 (released Jun 25 2026) contains a regression that can cause
unexpected "Malformed XML: out of memory" errors on Windows (x86 and x64)
and 32-bit platforms with large XML responses.

An example of such issue would be a checkout that uses bulk-style updates
with an overall size of more than 2 GB:

  svn co https://svn.example.com/files wc
  A    wc\2gb.iso
  svn: E175009: The XML response contains invalid XML
  svn: E130003: Malformed XML: out of memory at line 129

This regression has been fixed in libexpat 2.8.3.  So if you are packaging
Apache Subversion with libexpat 2.8.2, consider updating to the fixed
version.

More details on the issue can be found here:
- https://github.com/libexpat/libexpat/issues/1297
- https://github.com/libexpat/libexpat/releases/tag/R_2_8_3
- https://blog.hartwork.org/posts/expat-2-8-3-released/

Information about use of bulk-style updates in Subversion can be found here:
- https://subversion.apache.org/docs/release-notes/1.8.html#serf-skelta-default


Thanks,
Evgeny Kotkov