Stop compiling Python using --with-system-expat

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## [Unreleased]
 
+- Stopped using `--with-system-expat` when compiling new Python versions. ([#1925](https://github.com/heroku/heroku-buildpack-python/pull/1925))
 
 ## [v312] - 2025-10-05
 

builds/Dockerfile

@@ -17,4 +17,4 @@ RUN apt-get update --error-on=any \
 COPY --from=cosign /ko-app/cosign /usr/local/bin/cosign
 
 WORKDIR /tmp
-COPY build_python_runtime.sh python-3.13-ubuntu-22.04-libexpat-workaround.patch .
+COPY build_python_runtime.sh .

builds/build_python_runtime.sh

@@ -83,14 +83,6 @@ cosign verify-blob \
 tar --extract --file python.tgz --strip-components=1 --directory "${SRC_DIR}"
 cd "${SRC_DIR}"
 
-# Work around PGO profile test failures with Python 3.13 on Ubuntu 22.04, due to the tests
-# checking the raw libexpat version which doesn't account for Ubuntu backports:
-# https://github.com/heroku/heroku-buildpack-python/pull/1661#issuecomment-2405259352
-# https://github.com/python/cpython/issues/125067
-if [[ "${PYTHON_MAJOR_VERSION}" == "3.13" && "${STACK}" == "heroku-22" ]]; then
-	patch -p1 </tmp/python-3.13-ubuntu-22.04-libexpat-workaround.patch
-fi
-
 # Aim to keep this roughly consistent with the options used in the Python Docker images,
 # for maximum compatibility / most battle-tested build configuration:
 # https://github.com/docker-library/python
@@ -110,9 +102,6 @@ CONFIGURE_OPTS=(
 	# Skip running `ensurepip` as part of install, since the buildpack installs a curated
 	# version of pip itself (which ensures it's consistent across Python patch releases).
 	"--with-ensurepip=no"
-	# Build the `pyexpat` module using the `expat` library in the base image (which will
-	# automatically receive security updates), rather than CPython's vendored version.
-	"--with-system-expat"
 )
 
 if [[ "${PYTHON_MAJOR_VERSION}" != +(3.9) ]]; then