CVS commit: [pkgsrc-2026Q2] pkgsrc/textproc/expat
"Maya Rashish" <[email protected]>
| Newsgroups | gmane.os.netbsd.devel.pkgsrc.cvs |
|---|---|
| Message-ID | <[email protected]> |
Module Name: pkgsrc
Committed By: maya
Date: Sun Aug 16 21:28:42 UTC 2026
Modified Files:
pkgsrc/textproc/expat [pkgsrc-2026Q2]: Makefile builtin.mk distinfo
Log Message:
Pullup ticket #7231 - requested by taca
textproc/expat: Security fix
Revisions pulled up:
- textproc/expat/Makefile 1.67
- textproc/expat/builtin.mk 1.28
- textproc/expat/distinfo 1.61
---
Module Name: pkgsrc
Committed By: wiz
Date: Tue Aug 11 16:18:02 UTC 2026
Modified Files:
pkgsrc/textproc/expat: Makefile builtin.mk distinfo
Log Message:
expat: update to 2.8.3.
Release 2.8.3 Mon August 10 2026
Security fixes:
#1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
infinite loop caused by treating low surrogates (Unicode)
the same as high surrogates in functions *_toUtf16.
Needs Expat compiled with 16bit character support
(e.g. with Firefox and/or on Windows) to be affected.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
(Note the "AV:N" for network/remote, the "AV:L" in NVD by
Mitre is mistaken.)
Original bug report from Mozilla at:
https://bugzilla.mozilla.org/show_bug.cgi?id=2053153
Bug fixes:
#1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2)
#1286 lib: Reject empty version in the XML declaration
#1305 #1306 lib: Fix printf format for AIX
Other changes:
#1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
#1295 CMake|Windows: Add a 64bit MinGW toolchain file
#1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8
#1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later
#1300 Document the current wrap-around issues with functions
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetAttributeInfo
explicitly.
#1303 Address Clang Static Analyzer 22 warning
`core.NullPointerArithm`
#1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
for what these numbers do
Infrastructure:
#1311 CI: Limit workflow runtime and package installation runtime
#1310 CI: Pin Cppcheck version for a robust CI
#1310 CI: Migrate Cppcheck CI from macOS to Linux
#1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
and WASI SDK
#1304 CI: Activate AddressSanitizer for MSVC Windows CI
#1308 CI: Introduce zizmor static analysis for GitHub Actions
#1308 CI: Start using `persist-credentials: false` with Git checkout
#1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions
#1302 #1303 CI: Bump Clang from 21 to 22
#1293 #1294 Update project status for 2026-08
#1301 #1307 Add SPDX license identifiers to the source code
Fix some pkglint while here.
To generate a diff of this commit:
cvs rdiff -u -r1.65.2.1 -r1.65.2.2 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.27 -r1.27.4.1 pkgsrc/textproc/expat/builtin.mk
cvs rdiff -u -r1.59.2.1 -r1.59.2.2 pkgsrc/textproc/expat/distinfo
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
(unnamed)
(text/x-diff, 2.3 KB)
Modified files:
Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.65.2.1 pkgsrc/textproc/expat/Makefile:1.65.2.2
--- pkgsrc/textproc/expat/Makefile:1.65.2.1 Sun Jun 28 17:54:40 2026
+++ pkgsrc/textproc/expat/Makefile Sun Aug 16 21:28:42 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.65.2.1 2026/06/28 17:54:40 bsiegert Exp $
+# $NetBSD: Makefile,v 1.65.2.2 2026/08/16 21:28:42 maya Exp $
-DISTNAME= expat-2.8.2
+DISTNAME= expat-2.8.3
CATEGORIES= textproc
MASTER_SITES= ${MASTER_SITE_GITHUB:=libexpat/}
GITHUB_PROJECT= libexpat
Index: pkgsrc/textproc/expat/builtin.mk
diff -u pkgsrc/textproc/expat/builtin.mk:1.27 pkgsrc/textproc/expat/builtin.mk:1.27.4.1
--- pkgsrc/textproc/expat/builtin.mk:1.27 Sat Jan 31 17:39:20 2026
+++ pkgsrc/textproc/expat/builtin.mk Sun Aug 16 21:28:42 2026
@@ -1,4 +1,4 @@
-# $NetBSD: builtin.mk,v 1.27 2026/01/31 17:39:20 wiz Exp $
+# $NetBSD: builtin.mk,v 1.27.4.1 2026/08/16 21:28:42 maya Exp $
BUILTIN_PKG:= expat
@@ -97,6 +97,7 @@ pre-configure: override-expat-pkgconfig
BLKDIR_PKGCFG= ${BUILDLINK_DIR}/lib/pkgconfig
EXPAT_PKGCFGF= expat.pc
+.PHONY: override-expat-pkgconfig override-message-expat-pkgconfig override-expat-pkgconfig
override-expat-pkgconfig: override-message-expat-pkgconfig
override-message-expat-pkgconfig:
@${STEP_MSG} "Generating pkg-config file for builtin expat package."
Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.59.2.1 pkgsrc/textproc/expat/distinfo:1.59.2.2
--- pkgsrc/textproc/expat/distinfo:1.59.2.1 Sun Jun 28 17:54:40 2026
+++ pkgsrc/textproc/expat/distinfo Sun Aug 16 21:28:42 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.59.2.1 2026/06/28 17:54:40 bsiegert Exp $
+$NetBSD: distinfo,v 1.59.2.2 2026/08/16 21:28:42 maya Exp $
-BLAKE2s (expat-2.8.2.tar.gz) = 7c09ddc0193f920b8f670caf6ca41538b0fa379ea9f154697959d56a21328a3f
-SHA512 (expat-2.8.2.tar.gz) = 378fe8b8319d1654dae09e2ce15e0dcff68e735eb9e28728b7bee7f60c81781025c3fccd6b620589529a6e63d94d0812474dc4c09721e5a3ea64dbc1efb623dd
-Size (expat-2.8.2.tar.gz) = 818391 bytes
+BLAKE2s (expat-2.8.3.tar.gz) = e160e47939e6b2cbd3bc9f9ef9537cf64e6418793ecbd1736b62a112506fbf4c
+SHA512 (expat-2.8.3.tar.gz) = 7ccf7e9a30cfcba1fc977695447e7fcbbf70b3e659098b9db7d4e317a1ce401362668c0b03ae0fea0e1305d38d540019529940fabd1e581dc90ca79233c14d0b
+Size (expat-2.8.3.tar.gz) = 822096 bytes