diff mbox series

[1/4] expat: upgrade 2.8.3 -> 2.8.4

Message ID 20260901062125.37994-2-jaipaul.cheernam@est.tech
State New
Headers show
Series upgrades: expat, libpcre2, gnupg, librepo | expand

Commit Message

Jaipaul Cheernam Sept. 1, 2026, 6:21 a.m. UTC 
Source: Changes [1]

Release 2.8.4 Mon August 31 2026
        Security fixes:
     #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
                    "attribute isCdata lookups" that allowed denial of service
                    attacks through moderately sized crafted XML input
                    (CWE-407).
                    The vulnerability is closely related to past CVE-2026-45186
                    that was fixed with Expat 2.8.1.
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote.)
           #1322  CVE-2026-76957 -- Protect custom encoding callbacks from
                    parser re-entry. The vulnerability is closely related to
                    past issues CVE-2026-50219, CVE-2026-56131 and
                    CVE-2026-56412 that were all fixed with Expat 2.8.2.
           #1326  CVE-2026-76956 -- Fix inverted getentropy() return handling
                    Allows for hash flooding denial of services in
                    configurations where getentropy is configured or detected
                    as the only high quality entropy extractor.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9)
                    (Note the "AV:N" for network/remote.)

        Other changes:
     #1332 #1333  CMake: Only add `/source-charset:utf-8` when `/utf-8` is not
                    present
           #1315  lib: Resolve (currently unreachable) undefined behavior from
                    overshifting a signed int to the left
     #1325 #1334  lib: Support read-only hash table lookup with keys that are
                    not zero-terminated
           #1340  lib: Use a C99 bool for `ENTITY.open`
           #1319  Fix typo in comment
           #1320  Sync file headers
     #1328 #1329  Version info bumped from 13:3:12 (libexpat*.so.1.12.3)
                    to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
     #1317 #1335  CI: Cover compilation and execution with Fil-C
           #1337  CI: Cover compilation and execution on riscv64
           #1338  CI: Cover compilation and execution with Clang-based MinGW
           #1339  CI: Cover compilation and execution on (big-endian) s390x
           #1316  CI: Run test suite with musl, also
           #1336  CI: Bump WASI SDK from 33 to 34
           #1345  CI: Bump Clang from 22 to 23

 - Complete Changes at [1]

[1] https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.8.3.bb => expat_2.8.4.bb} (92%)
diff mbox series

Patch

diff --git a/meta/recipes-core/expat/expat_2.8.3.bb b/meta/recipes-core/expat/expat_2.8.4.bb
similarity index 92%
rename from meta/recipes-core/expat/expat_2.8.3.bb
rename to meta/recipes-core/expat/expat_2.8.4.bb
index 79e8c15227..050f148b07 100644
--- a/meta/recipes-core/expat/expat_2.8.3.bb
+++ b/meta/recipes-core/expat/expat_2.8.4.bb
@@ -15,7 +15,7 @@  SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
 UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
 
-SRC_URI[sha256sum] = "b4cc2483927d5e90bf8c40b44a6b95b368b42a8a96e25883fce188b48a92b670"
+SRC_URI[sha256sum] = "963250a823c16a498582b4ad82ad0f88926be0769675d3b6956be4d769a1cd8f"
 
 EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"