From patchwork Tue Sep 1 05:53:07 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 96923 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79A9AC624CE for ; Tue, 1 Sep 2026 05:53:12 +0000 (UTC) Received: from a27-31.smtp-out.us-west-2.amazonses.com (a27-31.smtp-out.us-west-2.amazonses.com [54.240.27.31]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1375.1788241988925003237 for ; Mon, 31 Aug 2026 22:53:09 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=LwdrElto; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=fzyvRpWw; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.31, mailfrom: 010101a05b874983-425d1327-86f3-4518-946c-062930ebe044-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1788241988; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=t4E67cger/HOWLxXr2NkAQO7Jn9oS2PVM+H/PYyri2s=; b=LwdrEltoKCcTgtb1I59T/CfCc4dN066K960ZANiZcxwL5LFv4RH0zjmxvD44+CD4 VXDa7+WqwefbQLGd0oLenJJQKNqctH1b2+W5ZC4DJvi7mtzu7b88n43jGGzi8wOM8aC enITmzObnCnKTpThC+pAn7ZjoXutcnVWZNO+Vj88= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1788241988; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=t4E67cger/HOWLxXr2NkAQO7Jn9oS2PVM+H/PYyri2s=; b=fzyvRpWwERMjWCnegI+oKtWyHmQn3S310G6LfOJqQ7xuhTuFF9YY49Bsom2uFqBU RpNkPZbZi2D/Ykx5E1mET2d1cXmYLlSF6a2zZ6gzPv+aIhf3ZfJR5kILN9w9BeHYHt8 PzYifzS5fO6mWgYGpJNL0X7a5SUHYj4Wb7xu5fOU= MIME-Version: 1.0 From: auh@yoctoproject.org To: Yi Zhao Cc: openembedded-core@lists.openembedded.org Subject: [AUH] expat: upgrading to 2.8.4 SUCCEEDED Message-ID: <010101a05b874983-425d1327-86f3-4518-946c-062930ebe044-000000@us-west-2.amazonses.com> Date: Tue, 1 Sep 2026 05:53:07 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.09.01-54.240.27.31 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 01 Sep 2026 05:53:12 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/244786 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *expat* to *2.8.4* has Succeeded. Next steps: - apply the patch: git am 0001-expat-upgrade-2.8.3-2.8.4.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 201c6767d9a44110ec72deae5bef0a31e14d1430 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 1 Sep 2026 05:26:17 +0000 Subject: [PATCH] expat: upgrade 2.8.3 -> 2.8.4 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Source: Changes Release 2.8.4 Mon August 31 2026 Security fixes: #1321 #1331 CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from "attribute isCdata lookups" that allowed denial of service attacks through moderately sized crafted XML input (CWE-407). The vulnerability is closely related to past CVE-2026-45186 that was fixed with Expat 2.8.1. Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) (Note the "AV:N" for network/remote.) #1322 CVE-2026-76957 -- Protect custom encoding callbacks from parser re-entry. The vulnerability is closely related to past issues CVE-2026-50219, CVE-2026-56131 and CVE-2026-56412 that were all fixed with Expat 2.8.2. #1326 CVE-2026-76956 -- Fix inverted getentropy() return handling Allows for hash flooding denial of services in configurations where getentropy is configured or detected as the only high quality entropy extractor. Upstream CVSS 3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9) (Note the "AV:N" for network/remote.) Other changes: #1332 #1333 CMake: Only add `/source-charset:utf-8` when `/utf-8` is not present #1315 lib: Resolve (currently unreachable) undefined behavior from overshifting a signed int to the left #1325 #1334 lib: Support read-only hash table lookup with keys that are not zero-terminated #1340 lib: Use a C99 bool for `ENTITY.open` #1319 Fix typo in comment #1320 Sync file headers #1328 #1329 Version info bumped from 13:3:12 (libexpat*.so.1.12.3) to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/ for what these numbers do Infrastructure: #1317 #1335 CI: Cover compilation and execution with Fil-C #1337 CI: Cover compilation and execution on riscv64 #1338 CI: Cover compilation and execution with Clang-based MinGW #1339 CI: Cover compilation and execution on (big-endian) s390x #1316 CI: Run test suite with musl, also #1336 CI: Bump WASI SDK from 33 to 34 #1345 CI: Bump Clang from 22 to 23 Special thanks to: Alberto Maschietto Alexander Bluhm Berkay Eren Ürün Darren Carreras Fabian Wahle (Hap Security) Matteo Forzan Matthew Fernandez Sorrashut Kaewtaworn [Changelog truncated as it exceeds 3000 characters; the full changelog can be found in an attachment to the AUH email] --- meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} (92%) diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.4.bb similarity index 92% rename from meta/recipes-core/expat/expat_2.8.3.bb rename to meta/recipes-core/expat/expat_2.8.4.bb index 79e8c15227..050f148b07 100644 --- a/meta/recipes-core/expat/expat_2.8.3.bb +++ b/meta/recipes-core/expat/expat_2.8.4.bb @@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P.+)" -SRC_URI[sha256sum] = "b4cc2483927d5e90bf8c40b44a6b95b368b42a8a96e25883fce188b48a92b670" +SRC_URI[sha256sum] = "963250a823c16a498582b4ad82ad0f88926be0769675d3b6956be4d769a1cd8f" EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"