diff mbox series

[01/12] expat: upgrade 2.9.0 -> 2.10.0

Message ID 20261103092800.39286-2-jaipaul.cheernam@est.tech
State New
Headers show
Series Upgrades on 3rd Nov | expand

Commit Message

Jaipaul Cheernam Nov. 3, 2026, 9:27 a.m. UTC 
Changes: https://github.com/libexpat/libexpat/blob/R_2_10_0/expat/Changes

Release 2.10.0 Mon November 2 2026
        Security fixes:
           #1431  CVE-2026-113351 -- Fix denial of service with use of
                    `XML_ParserReset`
  #1433 #1436 ..
  #1438 #1439 ..
           #1442  CVE-2026-115506 -- Detect billion laughs attacks quicker
                    and more of its variations. Related payload fuzzer at:
                      https://github.com/hannob/lololol
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    In case of backporting, please note pull request #1439
                    in particular.
           #1444  CVE-2026-117610 -- Fix initial non-final empty subparser
                    parse calls. Was segfaulting previously.
           #1450  CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
                    function `storeAtts` from signed integer overflow

        Bug fixes:
           #1452  lib: Initialize `m_parsingStatus.finalBuffer` in `parserInit`
                    to fix calling `XML_GetParsingStatus` right after
                    parser creation
     #1457 #1459  lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES == 0`
                    including NULL pointer arithmetic undefined behavior
                    and uninitialized variable access
           #1458  lib: Use C99 length modifiers for `ptrdiff_t` and `size_t`
                    to fix support for CHERI-RISC-V
           #1461  lib: Check `isCalledFromInsideHandler` first in `XML_Parse`
           #1467  lib: Add missing check for a character handler reset

        Other changes:
           #1441  Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD
                    to better support compilation with `-Wl,--as-needed`
           #1412  CMake: Support repeated `find_package` calls
           #1413  lib: Address warning `XML_GE is not defined [-Werror=undef]`
           #1415  lib: Stop delaying `callStoreEntityValue` error handling
           #1415  lib: Add missing call to `poolDiscard`
           #1437  lib: Add missing `NULL` check for `m_startDoctypeDeclHandler`
           #1417  lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from
                         `int` to `size_t`
           #1463  lib: Fix integer truncation in `XmlGetAttributes`/`getAtts`
           #1420  lib: Some more `XML_Bool` to `bool` migration
     #1449 #1460  lib: Document the memory reuse black magic that function
                    `storeAtts` is doing
           #1453  lib: Document failure to reject bad redefinitions of
                    predefined entities
           #1432  tests: Replace `XML_SetHashSalt` with
                    `XML_SetHashSalt16Bytes`
     #1416 #1435  Version info bumped from 14:0:13 (libexpat*.so.1.13.0)
                    to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
           #1414  CI: Stop using about-to-be-removed image "macos-14"
     #1418 #1434  CI: Bump MinGW Clang from 23.1.2 to 23.1.4
           #1443  CI: Bump Fil-C from 0.686 to 0.687
           #1456  Drop a `lib/xcsinc.c` leftover

        Special thanks to:
            Alexander Bluhm
            Bartłomiej Dmitruk
            Berkay Eren Ürün
            Brooks Davis
            brspoon
            Funda Wang
            Hanno Böck
            Matthew Fernandez
            Minkyung Park
            Mirko Swillus
            Pu Cheng
            Scott Moore
            Shani Yosef
            Xisco Fauli
                 and
            City of Munich Open Source Sabbatical
            echo.ai
            Siemens
            Striga
            VulnCheck

Signed-off-by: Jaipaul Cheernam <jaipaul.cheernam@est.tech>
---
 meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} (92%)
diff mbox series

Patch

diff --git a/meta/recipes-core/expat/expat_2.9.0.bb b/meta/recipes-core/expat/expat_2.10.0.bb
similarity index 92%
rename from meta/recipes-core/expat/expat_2.9.0.bb
rename to meta/recipes-core/expat/expat_2.10.0.bb
index 9b33764839..5b252f6146 100644
--- a/meta/recipes-core/expat/expat_2.9.0.bb
+++ b/meta/recipes-core/expat/expat_2.10.0.bb
@@ -15,7 +15,7 @@  SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.xz  \
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
 UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
 
-SRC_URI[sha256sum] = "1e6371862cc31999b368c3b89b49994f0677e1bab5f1b2b85ae3741f5d803051"
+SRC_URI[sha256sum] = "c624ba2998fc65df1163a49641ff3f9ab73138b11641d92c86bee0fb01b1bc7f"
 
 EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"