[AUH] expat: upgrading to 2.8.4 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *expat* to *2.8.4* has Succeeded.

Next steps:
    - apply the patch: git am 0001-expat-upgrade-2.8.3-2.8.4.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From 201c6767d9a44110ec72deae5bef0a31e14d1430 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 1 Sep 2026 05:26:17 +0000
Subject: [PATCH] expat: upgrade 2.8.3 -> 2.8.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Source: Changes

Release 2.8.4 Mon August 31 2026
        Security fixes:
     #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
                    "attribute isCdata lookups" that allowed denial of service
                    attacks through moderately sized crafted XML input
                    (CWE-407).
                    The vulnerability is closely related to past CVE-2026-45186
                    that was fixed with Expat 2.8.1.
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote.)
           #1322  CVE-2026-76957 -- Protect custom encoding callbacks from
                    parser re-entry. The vulnerability is closely related to
                    past issues CVE-2026-50219, CVE-2026-56131 and
                    CVE-2026-56412 that were all fixed with Expat 2.8.2.
           #1326  CVE-2026-76956 -- Fix inverted getentropy() return handling
                    Allows for hash flooding denial of services in
                    configurations where getentropy is configured or detected
                    as the only high quality entropy extractor.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9)
                    (Note the "AV:N" for network/remote.)

        Other changes:
     #1332 #1333  CMake: Only add `/source-charset:utf-8` when `/utf-8` is not
                    present
           #1315  lib: Resolve (currently unreachable) undefined behavior from
                    overshifting a signed int to the left
     #1325 #1334  lib: Support read-only hash table lookup with keys that are
                    not zero-terminated
           #1340  lib: Use a C99 bool for `ENTITY.open`
           #1319  Fix typo in comment
           #1320  Sync file headers
     #1328 #1329  Version info bumped from 13:3:12 (libexpat*.so.1.12.3)
                    to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
     #1317 #1335  CI: Cover compilation and execution with Fil-C
           #1337  CI: Cover compilation and execution on riscv64
           #1338  CI: Cover compilation and execution with Clang-based MinGW
           #1339  CI: Cover compilation and execution on (big-endian) s390x
           #1316  CI: Run test suite with musl, also
           #1336  CI: Bump WASI SDK from 33 to 34
           #1345  CI: Bump Clang from 22 to 23

        Special thanks to:
            Alberto Maschietto
            Alexander Bluhm
            Berkay Eren Ürün
            Darren Carreras
            Fabian Wahle (Hap Security)
            Matteo Forzan
            Matthew Fernandez
            Sorrashut Kaewtaworn

[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} (92%)