From patchwork Tue Nov 3 06:26:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: auh@yoctoproject.org X-Patchwork-Id: 102713 Received: from a27-193.smtp-out.us-west-2.amazonses.com (a27-193.smtp-out.us-west-2.amazonses.com [54.240.27.193]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.5333.1793687199635678658 for ; Mon, 02 Nov 2026 22:26:39 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@yoctoproject.org header.s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky header.b=VCmzDVAC; dkim=pass header.i=@amazonses.com header.s=hsbnp7p3ensaochzwyq5wwmceodymuwv header.b=Ky1QCkVL; spf=pass (domain: us-west-2.amazonses.com, ip: 54.240.27.193, mailfrom: 010101a1a0169acc-6f8d9173-8fb0-46e4-9b12-52aaa0690a0c-000000@us-west-2.amazonses.com) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=lvjh2tk576v2ro5mi6k4dt3mc6wpqbky; d=yoctoproject.org; t=1793687198; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date; bh=Y6GY2T9qG25yGjXGH4UPS+IRbB60CyER3x+3V4f/YSQ=; b=VCmzDVACcrMsWLf+tAKwXesPro4eScsoNOm32E7dGQ4RM+RRjHRYauoEw1omsZhq DLFlhH6cbN+EJqxkkaEhcnfhFRyq9kUm3QAvH8hao2hmDXOcoyO9PVjjqJqsl3IbZR7 HWnjzsELm+iCHFWIizdVmQ2GRPW3ixh5zUu2JSCA= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=hsbnp7p3ensaochzwyq5wwmceodymuwv; d=amazonses.com; t=1793687198; h=Content-Type:MIME-Version:From:To:Cc:Subject:Message-Id:Date:Feedback-ID; bh=Y6GY2T9qG25yGjXGH4UPS+IRbB60CyER3x+3V4f/YSQ=; b=Ky1QCkVL2kXoB3AzlVY7JEkGzRfy+V3eVsWC2l3h9ykopCMgY1XIjyBeXDNLY4kZ TI/NIj7+O7i0l3Uc3izk2g3Hb3rNuj/Tw4RkOLLkhvyEqdNXjhtM0FPWXw/apP6Tx6Y RmaNa02pRQm3bEiUrAUp7E7iBO9Mva6eAHqA1BUE= MIME-Version: 1.0 From: auh@yoctoproject.org To: Yi Zhao Cc: openembedded-core@lists.openembedded.org Subject: [AUH] expat: upgrading to 2.10.0 SUCCEEDED Message-ID: <010101a1a0169acc-6f8d9173-8fb0-46e4-9b12-52aaa0690a0c-000000@us-west-2.amazonses.com> Date: Tue, 3 Nov 2026 06:26:38 +0000 Feedback-ID: ::1.us-west-2.9np3MYPs3fEaOBysGKSlUD4KtcmPijcmS9Az2Hwf7iQ=:AmazonSES X-SES-Outgoing: 2026.11.03-54.240.27.193 List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by lin-tor-korg-lkml-alma10-1 with HTTPS for ; Tue, 03 Nov 2026 06:26:44 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/249232 Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *expat* to *2.10.0* has Succeeded. Next steps: - apply the patch: git am 0001-expat-upgrade-2.9.0-2.10.0.patch - check the changes to upstream patches and summarize them in the commit message, - compile an image that contains the package - perform some basic sanity tests - amend the patch and sign it off: git commit -s --reset-author --amend - send it to the appropriate mailing list Alternatively, if you believe the recipe should not be upgraded at this time, you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that automatic upgrades would no longer be attempted. Please review the attached files for further information and build/update failures. Any problem please file a bug at https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler Regards, The Upgrade Helper -- >8 -- From f6c5c572c1c839d097e7af229d9e7117a4f8224f Mon Sep 17 00:00:00 2001 From: Upgrade Helper Date: Tue, 3 Nov 2026 05:31:47 +0000 Subject: [PATCH] expat: upgrade 2.9.0 -> 2.10.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Release 2.10.0 Mon November 2 2026 Security fixes: #1431 CVE-2026-113351 -- Fix denial of service with use of `XML_ParserReset` #1433 #1436 .. #1438 #1439 .. #1442 CVE-2026-115506 -- Detect billion laughs attacks quicker and more of its variations. Related payload fuzzer at: https://github.com/hannob/lololol Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. In case of backporting, please note pull request #1439 in particular. #1444 CVE-2026-117610 -- Fix initial non-final empty subparser parse calls. Was segfaulting previously. #1450 CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in function `storeAtts` from signed integer overflow Bug fixes: #1452 lib: Initialize `m_parsingStatus.finalBuffer` in `parserInit` to fix calling `XML_GetParsingStatus` right after parser creation #1457 #1459 lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES == 0` including NULL pointer arithmetic undefined behavior and uninitialized variable access #1458 lib: Use C99 length modifiers for `ptrdiff_t` and `size_t` to fix support for CHERI-RISC-V #1461 lib: Check `isCalledFromInsideHandler` first in `XML_Parse` #1467 lib: Add missing check for a character handler reset Other changes: #1441 Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD to better support compilation with `-Wl,--as-needed` #1412 CMake: Support repeated `find_package` calls #1413 lib: Address warning `XML_GE is not defined [-Werror=undef]` #1415 lib: Stop delaying `callStoreEntityValue` error handling #1415 lib: Add missing call to `poolDiscard` #1437 lib: Add missing `NULL` check for `m_startDoctypeDeclHandler` #1417 lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from `int` to `size_t` #1463 lib: Fix integer truncation in `XmlGetAttributes`/`getAtts` #1420 lib: Some more `XML_Bool` to `bool` migration #1449 #1460 lib: Document the memory reuse black magic that function `storeAtts` is doing #1453 lib: Document failure to reject bad redefinitions of predefined entities #1432 tests: Replace `XML_SetHashSalt` with `XML_SetHashSalt16Bytes` #1416 #1435 Version info bumped from 14:0:13 (libexpat*.so.1.13.0) to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.de/ for what these numbers do Infrastructure: #1414 CI: Stop using about-to-be-removed image "macos-14" #1418 #1434 CI: Bump MinGW Clang from 23.1.2 to 23.1.4 #1443 CI: Bump Fil-C from 0.686 to 0.687 #1456 Drop a `lib/xcsinc.c` leftover Special thanks to: Alexander Bluhm Bartłomiej Dmitruk Berkay Eren Ürün Brooks Davis brspoon Funda Wang Hanno Böck Matthew Fernandez Minkyung Park Mirko Swillus Pu Cheng Scott Moore Shani Yosef Xisco Fauli and City of Munich Open Source Sabbatical echo.ai Siemens Striga VulnCheck Siemens Siemens and Siemens Siemens Siemens Siemens and Siemens --- meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) rename meta/recipes-core/expat/{expat_2.9.0.bb => expat_2.10.0.bb} (92%) diff --git a/meta/recipes-core/expat/expat_2.9.0.bb b/meta/recipes-core/expat/expat_2.10.0.bb similarity index 92% rename from meta/recipes-core/expat/expat_2.9.0.bb rename to meta/recipes-core/expat/expat_2.10.0.bb index 9b33764839..5b252f6146 100644 --- a/meta/recipes-core/expat/expat_2.9.0.bb +++ b/meta/recipes-core/expat/expat_2.10.0.bb @@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.xz \ GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/" UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P.+)" -SRC_URI[sha256sum] = "1e6371862cc31999b368c3b89b49994f0677e1bab5f1b2b85ae3741f5d803051" +SRC_URI[sha256sum] = "c624ba2998fc65df1163a49641ff3f9ab73138b11641d92c86bee0fb01b1bc7f" EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"