Comment by om2

We have contributed a number of upstream fixes

  $ cd gnome-libxml2.git
  $ git log --oneline [email protected] | wc -l
      43

The main reason we have a fork at all is that upstream libxml2 has broken source and binary compatibility in various ways, and we can't take those changes because libxml2 is public API on our platforms. We do make an effort to upstream all security fixes, though we sometimes get to it only after we ship.