[AUH] expat: upgrading to 2.9.0 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *expat* to *2.9.0* has Succeeded.

Next steps:
    - apply the patch: git am 0001-expat-upgrade-2.8.5-2.9.0.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From 8e52a65b8e817312917432f6b8e0b30a51926f17 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 6 Oct 2026 05:32:19 +0000
Subject: [PATCH] expat: upgrade 2.8.5 -> 2.9.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

///////////////////////////////////////////////////////////////////////////////
// <blink>Expat has UNFIXED SECURITY ISSUES!</blink>                         //
// Please see for details.  //
//                                                                           //
// Starting 2026-08-01, for up to six months my work maintaining libexpat    //
// will be funded by the City of Munich as part of their                     //
// Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html)   //
// — thank you!                                                              //
//                                                                           //
// If your business relies on Expat beyond January 2027, please consider     //
// funding the maintenance of Expat to ensure its health and security for    //
// you and others. Thank you!                                                //
//                                                                           //
//                                   Sebastian Pipping -- Berlin, 2026-09-22 //
///////////////////////////////////////////////////////////////////////////////

Release 2.9.0 Mon October 5 2026
        Security fixes:
           #1392  CVE-2026-102633 -- Integer overflow in function
                    expat_realloc on 32bit platforms
           #1393  CVE-2026-77214 -- Validate parameter `len` against available
                    buffer capacity in XML_ParseBuffer

        Bug fixes:
           #1387  lib: Handle OOM when copying encodingName in XML_ParserReset

        New features:
           #1327  lib: Introduce new "Properties API" to get and set
                    scalar properties for a single parser instance.
                    There are six new functions:
                    - XML_GetPropertyBool
                    - XML_GetPropertyDouble
                    - XML_GetPropertyUInt64
                    - XML_SetPropertyBool
                    - XML_SetPropertyDouble
                    - XML_SetPropertyUInt64
                    And two new enums:
                    - XML_Prop_Error
                    - XML_Parser_Property
           #1323  lib: Introduce five new 64bit location API functions:
                    - XML_GetCurrentByteCount64
                    - XML_GetCurrentByteIndex64
                    - XML_GetCurrentColumnNumber64
                    - XML_GetCurrentLineNumber64
                    - XML_GetInputContext64
                    These five functions closely mirror their predecessors
                    but are not prone to 32bit integer wrap-around.

        Other changes:
           #1391  docs: Document the scope of function XML_GetErrorCode
           #1395  docs: Document length expectations for XML_ParseBuffer
           #1394  lib: Call unknown encoding release before parser teardown
     #1370 #1373  lib: Drop (disabled-by-default) attribute info feature
                    These things are now gone:
                    - Public function XML_GetAttributeInfo
                    - Public struct XML_AttrInfo
                    - Macro XML_ATTR_INFO
                    These things are now causing build errors:
                    - Configure option --enable-xml-attr-info
                    - CMake option -DEXPAT_ATTR_INFO=ON
     #1379 #1382  lib: Drop (disabled-by-default) minimum size feature
                    These things are now gone:
                    - Macro XML_MIN_SIZE
                    These things are now causing build errors:
                    - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS
                    - CMake option -DEXPAT_MIN_SIZE=ON
     #1323 #1411  lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit
                    location API functions instead please)
           #1323  lib: Deprecate five location API functions that are cursed
                    with integer wrap-around:
                    - XML_GetCurrentByteCount
                    - XML_GetCurrentByteIndex
                    - XML_GetCurrentColumnNumber
                    - XML_GetCurrentLineNumber
                    - XML_GetInputContext
           #1399  lib: Guard against out-of-handler use of XML_DefaultCurrent
           #1400  lib: Use size_t for bytesAllocated and peakBytesAllocated
  #1401 #1402 ..
     #1404 #1405  lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp
           #1406  xmlwf: Add missing `#include "expat.h"`
     #1389 #1396  Version info bumped from 13:5:12 (libexpat*.so.1.12.5)
                    to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
           #1386  CI: Bump MinGW Clang from 23.1.1 to 23.1.2
           #1410  CI: Bump Fil-C from 0.685 to 0.686
           #1388  CI: Adapt to breaking changes regarding windows-11-arm image
           #1403  CI: Limit package cache download runtime

        Special thanks to:
            Bénédikt Tran
            Berkay Eren Ürün

[Changelog truncated as it exceeds 5000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} (92%)