From patchwork Wed Sep 23 06:27:45 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 98937 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66448C9830E for ; Wed, 23 Sep 2026 06:27:49 +0000 (UTC) Received: from a27-23.smtp-out.us-west-2.amazonses.com (a27-23.smtp-out.us-west-2.amazonses.com [54.240.27.23]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1208.1790144866639665114 for ; Tue, 22 Sep 2026 23:27:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=MqNE3NFB; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=1M+YHONd; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.23, mailfrom: 010101a0ccf2e5a9-90494f28-4a70-4bd2-b272-b6ef9cd6e039-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1790144865; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=5aQQ2alstdTBkYhPn+wJ2HhVMNgMFJLqhjd2GDOnJPU=; b=MqNE3NFBXa4ggLcbMkQNCbAANUZCiD8Y+U3Pa+KEcYDuV4/XC8io/iayEyC8tKhN c3opox/jQC0JVx/3Nrn7pUvz9AnhX4Yv0vJvawiQSvbAQS3G/Jo6Je9hKe6wkeSf3nL r7Q0lIkxJdLXR3uU52qWUXDRlcYhfTr7w+EqkcHA= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1790144865; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=5aQQ2alstdTBkYhPn+wJ2HhVMNgMFJLqhjd2GDOnJPU=; b=1M+YHONdyfABynTV+uFSabSaxDkWwplzcmdPNIiwIuNRBjb04z+4V7KPVZaVGmg1 4HVuHozI+KtU2/s9WBTRzpSSeGnZFU1b8hvqFC3z51Qdhk0dp70I42YHU9+g5X4bNGX +FHPCv1Vwx4OpjaR2T7TvDHXCOP+DnZFjGx2hR+E= MIME-Version: 1.0 From: auh@yoctoproject.org To: Yi Zhao Cc: openembedded-core@lists.openembedded.org Subject: [AUH] expat: upgrading to 2.8.5 SUCCEEDED Message-ID: <010101a0ccf2e5a9-90494f28-4a70-4bd2-b272-b6ef9cd6e039-000000@us-west-2.amazonses.com> Date: Wed, 23 Sep 2026 06:27:45 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.09.23-54.240.27.23 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 23 Sep 2026 06:27:49 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/246440 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *expat* to *2.8.5* has Succeeded. Next steps: - apply the patch: git am 0001-expat-upgrade-2.8.4-2.8.5.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From 0d6766a2a7a83dcef09be748809f8def0aaa74fd Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Wed, 23 Sep 2026 05:39:14 +0000 Subject: [PATCH] expat: upgrade 2.8.4 -> 2.8.5 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit !! !! !! If your business relies on Expat beyond January 2027, please consider !! !! funding the maintenance of Expat to ensure its health and security for !! !! you and others. Thank you! !! !! !! !! Sebastian Pipping -- Berlin, 2026-09-22 !! Release 2.8.5 Tue September 22 2026 Security fixes: #1282 CVE-2026-93990 -- Reject high surrogates not followed by a low surrogate during UTF-16 decoding; previously, malformed UTF-16 could be smuggled into the application using Expat and could cause arbitrary damage there, depending on how malformed UTF-16 was handled inside the application; validation was not their job but Expat's. This is similar to past vulnerability CVE-2022-25235. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8) /////////////////////////////////////////////////////////////////////////////// // The next release will drop two (disabled-by-default) features: // // // // - ATTR_INFO (-DXML_ATTR_INFO, -DEXPAT_ATTR_INFO, --enable-xml-attr-info, // // function XML_GetAttributeInfo, struct XML_AttrInfo) // // - MIN_SIZE (-DXML_MIN_SIZE, -DEXPAT_MIN_SIZE) // // // // If you need them in 2026 and beyond, please share your scenario at // // GitHub issues #1370 (for ATTR_INFO) and/or #1379 (for MIN_SIZE). Thanks! // /////////////////////////////////////////////////////////////////////////////// Bug fixes: #1346 lib: Fix OOM-related memory leak on a failed overflow check #1371 lib: Fix memory alignment for architectures with 128bit pointers like CHERI-RISC-V #1367 xmlwf: Handle errors when closing output files Other changes: #1354 lib: Reject an XML declaration version other than `1.[0-9]+` (which is less strict than XML 1.0r4 (fourth edition) and matches XML 1.0r5 (fifth edition)) #1362 lib: Make Clang, GCC and MSVC warn about use of function XML_SetHashSalt that is deprecated since Expat 2.8.0 #1357 lib: Drop internal macros FASTCALL, PTRCALL, PTRFASTCALL #1367 xmlwf: Document that with `-k` the last error determines the xmlwf exit code in `--help` output #1367 xmlwf: Make exit code 3 documentation match exit code 2 more closely in `--help` output #1352 #1353 CMake|Windows: Refrain from adding `/source-charset:utf-8` for MSVC #1366 #1374 Autotools: Be explicit about the minimum required version of GNU Automake, currently version 1.13 of 2012-12-28 #1351 Autotools|macOS: Sync CMake templates with CMake 4.4.3 #1349 Replace some internal use of XML_Bool with standard bool #1364 tests: Propagate xmltest.sh failures via exit status #1360 tests|xmlwf: Add `#include "expat_config.h"` where missing #1355 tests: Start covering hash table operation #1350 #1369 tests: Drop __cplusplus leftovers #1378 tests: Fix tail pointer when unlinking the last tracked allocation #1376 docs: Emphasize that XML_StopParser is not immediate #1381 docs: Sync XML_FeatureEnum value list in doc/reference.html #1356 #1361 Version info bumped from 13:4:12 (libexpat*.so.1.12.4) to 13:5:12 (libexpat*.so.1.12.5); see https://verbump.de/ for what these numbers do Infrastructure: #1347 Add missing .gitignore entries #1360 CI: Detect missing `#include "expat_config.h"` #1368 CI: Bump MinGW Clang from 23.0.1 to 23.1.1 #1377 CI: Bump Fil-C from 0.684 to 0.685 #1380 CI: Bump Cppcheck from 2.21.0 to 2.22.0 #1372 CI: Extract helper script `apply-htmltidy.sh` #1366 #1374 Autotools: Start to also produce .tar.bz3 release tarballs Special thanks to: Afonso Januário Braian Plaku Florian Schmaus Huang Wenbin Kamila Szewczyk Kartik Kenchi Leo Camus Matthew Fernandez Stan Ulbrych and City of Munich Open Source Sabbatical --- meta/recipes-core/expat/{expat_2.8.4.bb => expat_2.8.5.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-core/expat/{expat_2.8.4.bb => expat_2.8.5.bb} (92%) diff --git a/meta/recipes-core/expat/expat_2.8.4.bb b/meta/recipes-core/expat/expat_2.8.5.bb similarity index 92% rename from meta/recipes-core/expat/expat_2.8.4.bb rename to meta/recipes-core/expat/expat_2.8.5.bb index 050f148b07..c032e18c77 100644 --- a/meta/recipes-core/expat/expat_2.8.4.bb +++ b/meta/recipes-core/expat/expat_2.8.5.bb @@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \ GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P.+)" -SRC_URI[sha256sum] = "963250a823c16a498582b4ad82ad0f88926be0769675d3b6956be4d769a1cd8f" +SRC_URI[sha256sum] = "952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454" EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"