From patchwork Tue Oct 6 06:24:52 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 100025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E62C8CA5FED for ; Tue, 6 Oct 2026 06:24:55 +0000 (UTC) Received: from a27-191.smtp-out.us-west-2.amazonses.com (a27-191.smtp-out.us-west-2.amazonses.com [54.240.27.191]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.39322.1791267893946213691 for ; Mon, 05 Oct 2026 23:24:54 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=IexKarGU; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=OdHUGNtj; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.191, mailfrom: 010101a10fe2ee65-21d221ea-f9ca-4c44-acdb-8ce2833fdecc-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1791267893; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=DHCNoeVg3+ryS6O/Szdu0q2ATPfFxpGUJU99a1yRCF0=; b=IexKarGUpMjbFR8ay9jnOR4iPttWyTiiVErk4vKr0VVZv8hxX41njzDxDJ9TieCK F/PL8vytulKbPDYfNI6JbKekpRNOlLfgj+4IWHUz1NdA7041r3dZkVPQf+ucJ/TCdmN JW5FW7l8X0Gp4lPYwHrQ+leVlz9ovqOR8BH3K7lU= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1791267893; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=DHCNoeVg3+ryS6O/Szdu0q2ATPfFxpGUJU99a1yRCF0=; b=OdHUGNtje7/DwPRgsPvQ09ekhm5NGdeQHQ4GkAMM0kjUCLe1YW6389wRoeOXQTui B+cHGjHrIHwKMvsGzmrx0wLhrx73/LYkTga9aobRWYPo/UcEY2+XQ/QEvGiSHcQMZhg iWbszfKotUbHAc4x+oH3mHRu4Tax7fNMNU2ZKZ04= MIME-Version: 1.0 From: auh@yoctoproject.org To: Yi Zhao Cc: openembedded-core@lists.openembedded.org Subject: [AUH] expat: upgrading to 2.9.0 SUCCEEDED Message-ID: <010101a10fe2ee65-21d221ea-f9ca-4c44-acdb-8ce2833fdecc-000000@us-west-2.amazonses.com> Date: Tue, 6 Oct 2026 06:24:52 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.10.06-54.240.27.191 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Tue, 06 Oct 2026 06:24:55 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/247264 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *expat* to *2.9.0* has Succeeded. Next steps: - apply the patch: git am 0001-expat-upgrade-2.8.5-2.9.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 8e52a65b8e817312917432f6b8e0b30a51926f17 Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 6 Oct 2026 05:32:19 +0000 Subject: [PATCH] expat: upgrade 2.8.5 -> 2.9.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /////////////////////////////////////////////////////////////////////////////// // Expat has UNFIXED SECURITY ISSUES! // // Please see for details. // // // // Starting 2026-08-01, for up to six months my work maintaining libexpat // // will be funded by the City of Munich as part of their // // Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) // // — thank you! // // // // If your business relies on Expat beyond January 2027, please consider // // funding the maintenance of Expat to ensure its health and security for // // you and others. Thank you! // // // // Sebastian Pipping -- Berlin, 2026-09-22 // /////////////////////////////////////////////////////////////////////////////// Release 2.9.0 Mon October 5 2026 Security fixes: #1392 CVE-2026-102633 -- Integer overflow in function expat_realloc on 32bit platforms #1393 CVE-2026-77214 -- Validate parameter `len` against available buffer capacity in XML_ParseBuffer Bug fixes: #1387 lib: Handle OOM when copying encodingName in XML_ParserReset New features: #1327 lib: Introduce new "Properties API" to get and set scalar properties for a single parser instance. There are six new functions: - XML_GetPropertyBool - XML_GetPropertyDouble - XML_GetPropertyUInt64 - XML_SetPropertyBool - XML_SetPropertyDouble - XML_SetPropertyUInt64 And two new enums: - XML_Prop_Error - XML_Parser_Property #1323 lib: Introduce five new 64bit location API functions: - XML_GetCurrentByteCount64 - XML_GetCurrentByteIndex64 - XML_GetCurrentColumnNumber64 - XML_GetCurrentLineNumber64 - XML_GetInputContext64 These five functions closely mirror their predecessors but are not prone to 32bit integer wrap-around. Other changes: #1391 docs: Document the scope of function XML_GetErrorCode #1395 docs: Document length expectations for XML_ParseBuffer #1394 lib: Call unknown encoding release before parser teardown #1370 #1373 lib: Drop (disabled-by-default) attribute info feature These things are now gone: - Public function XML_GetAttributeInfo - Public struct XML_AttrInfo - Macro XML_ATTR_INFO These things are now causing build errors: - Configure option --enable-xml-attr-info - CMake option -DEXPAT_ATTR_INFO=ON #1379 #1382 lib: Drop (disabled-by-default) minimum size feature These things are now gone: - Macro XML_MIN_SIZE These things are now causing build errors: - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS - CMake option -DEXPAT_MIN_SIZE=ON #1323 #1411 lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit location API functions instead please) #1323 lib: Deprecate five location API functions that are cursed with integer wrap-around: - XML_GetCurrentByteCount - XML_GetCurrentByteIndex - XML_GetCurrentColumnNumber - XML_GetCurrentLineNumber - XML_GetInputContext #1399 lib: Guard against out-of-handler use of XML_DefaultCurrent #1400 lib: Use size_t for bytesAllocated and peakBytesAllocated #1401 #1402 .. #1404 #1405 lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp #1406 xmlwf: Add missing `#include "expat.h"` #1389 #1396 Version info bumped from 13:5:12 (libexpat*.so.1.12.5) to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/ for what these numbers do Infrastructure: #1386 CI: Bump MinGW Clang from 23.1.1 to 23.1.2 #1410 CI: Bump Fil-C from 0.685 to 0.686 #1388 CI: Adapt to breaking changes regarding windows-11-arm image #1403 CI: Limit package cache download runtime Special thanks to: Bénédikt Tran Berkay Eren Ürün [Changelog truncated as it exceeds 5000 characters; the full changelog can be found in an attachment to the AUH email] --- meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} (92%) diff --git a/meta/recipes-core/expat/expat_2.8.5.bb b/meta/recipes-core/expat/expat_2.9.0.bb similarity index 92% rename from meta/recipes-core/expat/expat_2.8.5.bb rename to meta/recipes-core/expat/expat_2.9.0.bb index c032e18c77..e9bb21bd55 100644 --- a/meta/recipes-core/expat/expat_2.8.5.bb +++ b/meta/recipes-core/expat/expat_2.9.0.bb @@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P.+)" -SRC_URI[sha256sum] = "952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454" +SRC_URI[sha256sum] = "775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984" EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"