Upgrade bundled Expat to 2.8.3 (e.g. for the fix to CVE-2026-72522)

[hartwork]

Please see blog post https://blog.hartwork.org/posts/expat-2-8-3-released/ for an overview and the change log at https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes for details. Affects all alive branches of Python. Thank you!

Related: #152216 (predecessor for Expat 2.8.2)

CC @StanFromIreland

---

• CVE-2026-72522

Linked PRs

• gh-155558: Update bundled Expat to 2.8.3 #155560
• [3.15] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) #155612
• [3.14] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) #155613
• [3.13] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) #155614
• [3.12] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) #155615
• [3.11] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) #155616
• [3.10] gh-155558: Update bundled Expat to 2.8.3 (GH-155560) #155618

[StanFromIreland]

@hartwork Thanks for letting us know! JFYI for the future, you don't need to add [security] to the title here, we have labels to distinguish such things.