[AUH] expat: upgrading to 2.10.0 SUCCEEDED

Hello,

this email is a notification from the Auto Upgrade Helper
that the automatic attempt to upgrade the recipe(s) *expat* to *2.10.0* has Succeeded.

Next steps:
    - apply the patch: git am 0001-expat-upgrade-2.9.0-2.10.0.patch
    - check the changes to upstream patches and summarize them in the commit message,
    - compile an image that contains the package
    - perform some basic sanity tests
    - amend the patch and sign it off: git commit -s --reset-author --amend
    - send it to the appropriate mailing list

Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.

Please review the attached files for further information and build/update failures.
Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler

Regards,
The Upgrade Helper

-- >8 --
From f6c5c572c1c839d097e7af229d9e7117a4f8224f Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 3 Nov 2026 05:31:47 +0000
Subject: [PATCH] expat: upgrade 2.9.0 -> 2.10.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Release 2.10.0 Mon November 2 2026
        Security fixes:
           #1431  CVE-2026-113351 -- Fix denial of service with use of
                    `XML_ParserReset`
  #1433 #1436 ..
  #1438 #1439 ..
           #1442  CVE-2026-115506 -- Detect billion laughs attacks quicker
                    and more of its variations. Related payload fuzzer at:
                      https://github.com/hannob/lololol
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    In case of backporting, please note pull request #1439
                    in particular.
           #1444  CVE-2026-117610 -- Fix initial non-final empty subparser
                    parse calls. Was segfaulting previously.
           #1450  CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
                    function `storeAtts` from signed integer overflow

        Bug fixes:
           #1452  lib: Initialize `m_parsingStatus.finalBuffer` in `parserInit`
                    to fix calling `XML_GetParsingStatus` right after
                    parser creation
     #1457 #1459  lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES == 0`
                    including NULL pointer arithmetic undefined behavior
                    and uninitialized variable access
           #1458  lib: Use C99 length modifiers for `ptrdiff_t` and `size_t`
                    to fix support for CHERI-RISC-V
           #1461  lib: Check `isCalledFromInsideHandler` first in `XML_Parse`
           #1467  lib: Add missing check for a character handler reset

        Other changes:
           #1441  Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD
                    to better support compilation with `-Wl,--as-needed`
           #1412  CMake: Support repeated `find_package` calls
           #1413  lib: Address warning `XML_GE is not defined [-Werror=undef]`
           #1415  lib: Stop delaying `callStoreEntityValue` error handling
           #1415  lib: Add missing call to `poolDiscard`
           #1437  lib: Add missing `NULL` check for `m_startDoctypeDeclHandler`
           #1417  lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from
                         `int` to `size_t`
           #1463  lib: Fix integer truncation in `XmlGetAttributes`/`getAtts`
           #1420  lib: Some more `XML_Bool` to `bool` migration
     #1449 #1460  lib: Document the memory reuse black magic that function
                    `storeAtts` is doing
           #1453  lib: Document failure to reject bad redefinitions of
                    predefined entities
           #1432  tests: Replace `XML_SetHashSalt` with
                    `XML_SetHashSalt16Bytes`
     #1416 #1435  Version info bumped from 14:0:13 (libexpat*.so.1.13.0)
                    to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
           #1414  CI: Stop using about-to-be-removed image "macos-14"
     #1418 #1434  CI: Bump MinGW Clang from 23.1.2 to 23.1.4
           #1443  CI: Bump Fil-C from 0.686 to 0.687
           #1456  Drop a `lib/xcsinc.c` leftover

        Special thanks to:
            Alexander Bluhm
            Bartłomiej Dmitruk
            Berkay Eren Ürün
            Brooks Davis
            brspoon
            Funda Wang
            Hanno Böck
            Matthew Fernandez
            Minkyung Park
            Mirko Swillus
            Pu Cheng
            Scott Moore
            Shani Yosef
            Xisco Fauli
                 and
            City of Munich Open Source Sabbatical
            echo.ai
            Siemens
            Striga
            VulnCheck

            Siemens
            Siemens
                 and
            Siemens
            Siemens
            Siemens
            Siemens
                 and
            Siemens
---
 meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} (92%)