similarity index 92%
rename from meta/recipes-core/expat/expat_2.8.5.bb
rename to meta/recipes-core/expat/expat_2.9.0.bb
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
-SRC_URI[sha256sum] = "952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454"
+SRC_URI[sha256sum] = "775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984"
EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
Release 2.9.0 Mon October 5 2026 Security fixes: #1392 CVE-2026-102633 -- Integer overflow in function expat_realloc on 32bit platforms #1393 CVE-2026-77214 -- Validate parameter `len` against available buffer capacity in XML_ParseBuffer Bug fixes: #1387 lib: Handle OOM when copying encodingName in XML_ParserReset New features: #1327 lib: Introduce new "Properties API" to get and set scalar properties for a single parser instance. There are six new functions: - XML_GetPropertyBool - XML_GetPropertyDouble - XML_GetPropertyUInt64 - XML_SetPropertyBool - XML_SetPropertyDouble - XML_SetPropertyUInt64 And two new enums: - XML_Prop_Error - XML_Parser_Property #1323 lib: Introduce five new 64bit location API functions: - XML_GetCurrentByteCount64 - XML_GetCurrentByteIndex64 - XML_GetCurrentColumnNumber64 - XML_GetCurrentLineNumber64 - XML_GetInputContext64 These five functions closely mirror their predecessors but are not prone to 32bit integer wrap-around. Other changes: #1391 docs: Document the scope of function XML_GetErrorCode #1395 docs: Document length expectations for XML_ParseBuffer #1394 lib: Call unknown encoding release before parser teardown #1370 #1373 lib: Drop (disabled-by-default) attribute info feature These things are now gone: - Public function XML_GetAttributeInfo - Public struct XML_AttrInfo - Macro XML_ATTR_INFO These things are now causing build errors: - Configure option --enable-xml-attr-info - CMake option -DEXPAT_ATTR_INFO=ON #1379 #1382 lib: Drop (disabled-by-default) minimum size feature These things are now gone: - Macro XML_MIN_SIZE These things are now causing build errors: - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS - CMake option -DEXPAT_MIN_SIZE=ON #1323 #1411 lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit location API functions instead please) #1323 lib: Deprecate five location API functions that are cursed with integer wrap-around: - XML_GetCurrentByteCount - XML_GetCurrentByteIndex - XML_GetCurrentColumnNumber - XML_GetCurrentLineNumber - XML_GetInputContext #1399 lib: Guard against out-of-handler use of XML_DefaultCurrent #1400 lib: Use size_t for bytesAllocated and peakBytesAllocated #1401 #1402 .. #1404 #1405 lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp #1406 xmlwf: Add missing `#include "expat.h"` #1389 #1396 Version info bumped from 13:5:12 (libexpat*.so.1.12.5) to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/ for what these numbers do Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> --- meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} (92%)