We are getting:

Warning	C4005	'HAVE_MEMMOVE': macro redefinition	_elementtree	c:\users\segev\prj\python\cpython\modules\expat\winconfig.h	34	
Warning	C4267	'=': conversion from 'size_t' to 'unsigned char', possible loss of data	_elementtree	c:\users\segev\prj\python\cpython\modules\expat\siphash.h	316	
Warning	C4996	'getenv': This function or variable may be unsafe. Consider using _dupenv_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.	_elementtree	C:\Users\Segev\prj\python\cpython\Modules\expat\xmlparse.c	796	
Warning	C4005	'HAVE_MEMMOVE': macro redefinition	_elementtree	c:\users\segev\prj\python\cpython\modules\expat\winconfig.h	34	
Warning	C4005	'HAVE_MEMMOVE': macro redefinition	_elementtree	c:\users\segev\prj\python\cpython\modules\expat\winconfig.h	34

And in 64-bit:

c:\users\segev\prj\python\cpython\modules\expat\siphash.h(201): warning C4244: 'initializing': conversion from '__int64' to 'char', possible loss of data

I'm not sure how many Python versions this affects.

New changeset c8fb58bd7917151e63398587a7fc2126db7c26de by Victor Stinner in branch 'master':
bpo-30726: PCbuild _elementtree: remove duplicate defines (#2348)
https://github.com/python/cpython/commit/c8fb58bd7917151e63398587a7fc2126db7c26de

My commit c8fb58bd7917151e63398587a7fc2126db7c26de (co-written with Jeremy Kloth) fixes the "macro redefinition".

There are still warnings in the siphash code, but I suggest to report them upstream, and *then* propose to cherry-pick fixes from libexpat (as I did for Visual Studio 2008 support in Python 2.7 when I upgraded libexpat to 2.2.1, but I was lucky, the fix was already made in libexpat).

Oh... I'm sorry Segev Finer, I didn't see that you proposed a PR :-(

For siphash.h warnings, I created a PR on libexpat:
https://github.com/libexpat/libexpat/pull/58

> Oh... I'm sorry Segev Finer, I didn't see that you proposed a PR :-(

Please rebase and rewrite your PR to just add _CRT_SECURE_NO_WARNINGS. Once merged, I will include this change to my 3.6 and 3.5 backports.

New changeset 87c65550730a8f85ce339ba197bce4fb7e836619 by Victor Stinner (Segev Finer) in branch 'master':
bpo-30726: Fix elementtree warnings on Windows due to expat upgrade (#2319)
https://github.com/python/cpython/commit/87c65550730a8f85ce339ba197bce4fb7e836619

New changeset f42ce179c8aaa7e211ac4123c58fa3dd9a452004 by Victor Stinner in branch '3.5':
[3.5] bpo-30726: PCbuild _elementtree: remove duplicate defines (#2348) (#2350)
https://github.com/python/cpython/commit/f42ce179c8aaa7e211ac4123c58fa3dd9a452004

New changeset d32a05953130fb5cc2d3c0c9fcb20ad0859353f3 by Victor Stinner in branch '3.6':
[3.6] bpo-30726: PCbuild _elementtree: remove duplicate defines (#2348) (#2349)
https://github.com/python/cpython/commit/d32a05953130fb5cc2d3c0c9fcb20ad0859353f3

New changeset 8f525882fa43209d52afdb99753de2f5111d7433 by Victor Stinner in branch 'master':
bpo-30726: expat: Fix compiler warnings on Windows 64-bit (#2368)
https://github.com/python/cpython/commit/8f525882fa43209d52afdb99753de2f5111d7433

It seems that the issue repeats in pyexpat.vcxproj. I submitted a PR for that one as well.

New changeset 7526cadd64566725ffc56071a7208828a46ddbd8 by Steve Dower (Segev Finer) in branch 'master':
bpo-30726: Also fix pyexpat.vcxproj (#2375)
https://github.com/python/cpython/commit/7526cadd64566725ffc56071a7208828a46ddbd8

All that remains is back porting https://github.com/python/cpython/pull/2375 and than this issue is fixed.

How far back does it need to be ported? Just to 3.5?

> How far back does it need to be ported? Just to 3.5?

Up to 2.7, expat 2.2.1 was updated to 2.7 as well. I even proposed a PR for 3.3 and 3.4 (not merged yet). But since this issue only fixes a warning, I don't think that it's worth it to backport it to 3.3 and 3.4.

It doesn't even fix a warning - only suppresses it. Since there is no behavior change at all, I'm not inclined to backport any further than is trivial.

Segev Finer: Would you mind to backport PR 2375 to 3.6 and 3.5 branches?

Maybe also to 2.7, at least in PCbuild, maybe also PC/VS9.0/.

Python 2.7 diverged https://github.com/python/cpython/commit/ab3b0ade505ce07a3d5ec4fbc991a154242732e6. It's only missing _CRT_SECURE_NO_WARNINGS. :P

New changeset d02c8416fe1b29b3322004b73133bf6c8a2e353a by Victor Stinner (Segev Finer) in branch '3.6':
[3.6] bpo-30726: Also fix pyexpat.vcxproj (GH-2375) (#2570)
https://github.com/python/cpython/commit/d02c8416fe1b29b3322004b73133bf6c8a2e353a

New changeset 320ee67f981f766ff55c55ef87d5ef17ce297824 by Victor Stinner (Segev Finer) in branch '3.5':
[3.5] bpo-30726: Also fix pyexpat.vcxproj (GH-2375) (#2571)
https://github.com/python/cpython/commit/320ee67f981f766ff55c55ef87d5ef17ce297824

New changeset d0ae4be443332d63fafb304944842fbaece734a3 by Victor Stinner (Segev Finer) in branch '2.7':
bpo-30726: Add _CRT_SECURE_NO_WARNINGS to _elementtree and pyexpat projects (#2572)
https://github.com/python/cpython/commit/d0ae4be443332d63fafb304944842fbaece734a3

Thanks Segev Finer for backports.

> It doesn't even fix a warning - only suppresses it. Since there is no behavior change at all, I'm not inclined to backport any further than is trivial.

I like decreasing the number of warnings. It helps to detect new warnings, and so to prevent bugs.

> I like decreasing the number of warnings. It helps to detect new warnings, and so to prevent bugs.

The approach used to suppress this warning will also suppress other warnings that might be fixable. Hard to say it's definitely a good thing in this case, though in general I agree that selectively suppressing warnings that cannot be fixed is a good thing.

> The approach used to suppress this warning will also suppress other warnings that might be fixable. Hard to say it's definitely a good thing in this case, though in general I agree that selectively suppressing warnings that cannot be fixed is a good thing.

Most secure CRT warnings are a bit useless in portable code since you are unlikely to really use strcpy_s and friends...

Steve Dower: "The approach used to suppress this warning will also suppress other warnings that might be fixable. Hard to say it's definitely a good thing in this case, though in general I agree that selectively suppressing warnings that cannot be fixed is a good thing."

First of all, Modules/expat/ is a copy of https://github.com/libexpat/libexpat/. In the past, it contained significant patches. Today, it almost contains zero patch, the major addition is the pyexpatns.h file:

https://github.com/python/cpython/blob/master/Modules/expat/pyexpatns.h

If someone considers that the following warning deserves a fix, please report it upstream:

Warning	C4996	'getenv': This function or variable may be unsafe. Consider using _dupenv_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.	_elementtree	C:\Users\Segev\prj\python\cpython\Modules\expat\xmlparse.c	796	

I read the code, and I don't think that it deserves a fix. Using non-portable function _dupenv_s() makes the code a little bit more complex for a little benefit.

I agree that if libexpat is upgraded again, suppressing warnings can hide a future real bug. But right now, we embed a copy of libexpat 2.1.1 and I don't want to modify our downstream copy.

I hope you notice I'm not against this particular change. I'm just voicing a general belief that suppressing an entire category of warnings for a whole project is not necessarily an improvement.

In future, and when applied to our own project files, expect me to push back against this kind of fix.

New changeset 5777e79ecbd1f2adf36456e09f210608ee221691 by Ned Deily (Victor Stinner) in branch '3.6':
[3.6] bpo-30726: PCbuild _elementtree: remove duplicate defines (#2348) (#2349)
https://github.com/python/cpython/commit/5777e79ecbd1f2adf36456e09f210608ee221691

New changeset b6012f982fabed6029d7e2db2a509a8b28b4f6e1 by Ned Deily (Segev Finer) in branch '3.6':
[3.6] bpo-30726: Also fix pyexpat.vcxproj (GH-2375) (#2570)
https://github.com/python/cpython/commit/b6012f982fabed6029d7e2db2a509a8b28b4f6e1

New changeset 71572bbe82aa0836c036d44d41c8269ba6a321be by larryhastings (Victor Stinner) in branch '3.4':
[3.4] bpo-29591, bpo-30694: Upgrade Modules/expat to libexpat 2.2.1 (#2164) (#2203)
https://github.com/python/cpython/commit/71572bbe82aa0836c036d44d41c8269ba6a321be

New changeset ab90986600ba7dea2aa41e5c1773791070725453 by Ned Deily (Victor Stinner) in branch '3.3':
[3.3] bpo-29591, bpo-30694: Upgrade Modules/expat to libexpat 2.2.1 (#2164) (#2204)
https://github.com/python/cpython/commit/ab90986600ba7dea2aa41e5c1773791070725453