Upstream unmaintained and vulnerable?

[h-vetinari]

Currently the upstream readme contains the statement

This project is unmaintained and has known security issues. It is foolish to use this software to process untrusted data.

Additionally, the maintainer removed themselves and while some people have shown interest in stepping up, it's unclear how that will turn out.

This is obviously not great™️ for such a low-level package with 130+ direct dependencies, and many more transitive ones.

FYI @conda-forge/libxml2 @conda-forge/core

[hmaarrfk]

I wonder what Qt is doing about it.

I also presume that the fix for the concern you raised is being addressed
https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/366