CVS commit: pkgsrc/textproc/expat

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Tue Aug 11 16:18:02 UTC 2026

Modified Files:
        pkgsrc/textproc/expat: Makefile builtin.mk distinfo

Log Message:
expat: update to 2.8.3.

Release 2.8.3 Mon August 10 2026
        Security fixes:
           #1296  CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
                    infinite loop caused by treating low surrogates (Unicode)
                    the same as high surrogates in functions *_toUtf16.
                    Needs Expat compiled with 16bit character support
                    (e.g. with Firefox and/or on Windows) to be affected.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote, the "AV:L" in NVD by
                    Mitre is mistaken.)
                    Original bug report from Mozilla at:
                    https://bugzilla.mozilla.org/show_bug.cgi?id=2053153

        Bug fixes:
     #1297 #1300  lib: Fix support for 2+ GiB documents (regression from 2.8.2)
           #1286  lib: Reject empty version in the XML declaration
     #1305 #1306  lib: Fix printf format for AIX

        Other changes:
           #1309  CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
           #1295  CMake|Windows: Add a 64bit MinGW toolchain file
     #1287 #1289  CMake|Windows: Start invoking MSVC with /source-charset:utf-8
           #1289  CMake|Windows: Start requiring MSVC 2015 Update 2 or later
           #1300  Document the current wrap-around issues with functions
                    - XML_GetCurrentByteIndex
                    - XML_GetCurrentColumnNumber
                    - XML_GetCurrentLineNumber
                    - XML_GetAttributeInfo
                    explicitly.
           #1303  Address Clang Static Analyzer 22 warning
                    `core.NullPointerArithm`
     #1313 #1314  Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
                    to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
           #1311  CI: Limit workflow runtime and package installation runtime
           #1310  CI: Pin Cppcheck version for a robust CI
           #1310  CI: Migrate Cppcheck CI from macOS to Linux
           #1312  CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
                    and WASI SDK
           #1304  CI: Activate AddressSanitizer for MSVC Windows CI
           #1308  CI: Introduce zizmor static analysis for GitHub Actions
           #1308  CI: Start using `persist-credentials: false` with Git checkout
           #1219  CI: Add a 7 day cooldown to Dependabot for GitHub Actions
     #1302 #1303  CI: Bump Clang from 21 to 22
     #1293 #1294  Update project status for 2026-08
     #1301 #1307  Add SPDX license identifiers to the source code

Fix some pkglint while here.


To generate a diff of this commit:
cvs rdiff -u -r1.66 -r1.67 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.27 -r1.28 pkgsrc/textproc/expat/builtin.mk
cvs rdiff -u -r1.60 -r1.61 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.66 pkgsrc/textproc/expat/Makefile:1.67
--- pkgsrc/textproc/expat/Makefile:1.66 Thu Jun 25 20:59:15 2026
+++ pkgsrc/textproc/expat/Makefile      Tue Aug 11 16:18:02 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.66 2026/06/25 20:59:15 wiz Exp $
+# $NetBSD: Makefile,v 1.67 2026/08/11 16:18:02 wiz Exp $
 
-DISTNAME=      expat-2.8.2
+DISTNAME=      expat-2.8.3
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/builtin.mk
diff -u pkgsrc/textproc/expat/builtin.mk:1.27 pkgsrc/textproc/expat/builtin.mk:1.28
--- pkgsrc/textproc/expat/builtin.mk:1.27       Sat Jan 31 17:39:20 2026
+++ pkgsrc/textproc/expat/builtin.mk    Tue Aug 11 16:18:02 2026
@@ -1,4 +1,4 @@
-# $NetBSD: builtin.mk,v 1.27 2026/01/31 17:39:20 wiz Exp $
+# $NetBSD: builtin.mk,v 1.28 2026/08/11 16:18:02 wiz Exp $
 
 BUILTIN_PKG:=  expat
 
@@ -97,6 +97,7 @@ pre-configure: override-expat-pkgconfig
 BLKDIR_PKGCFG= ${BUILDLINK_DIR}/lib/pkgconfig
 EXPAT_PKGCFGF= expat.pc
 
+.PHONY: override-expat-pkgconfig override-message-expat-pkgconfig override-expat-pkgconfig
 override-expat-pkgconfig: override-message-expat-pkgconfig
 override-message-expat-pkgconfig:
        @${STEP_MSG} "Generating pkg-config file for builtin expat package."

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.60 pkgsrc/textproc/expat/distinfo:1.61
--- pkgsrc/textproc/expat/distinfo:1.60 Thu Jun 25 20:59:15 2026
+++ pkgsrc/textproc/expat/distinfo      Tue Aug 11 16:18:02 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.60 2026/06/25 20:59:15 wiz Exp $
+$NetBSD: distinfo,v 1.61 2026/08/11 16:18:02 wiz Exp $
 
-BLAKE2s (expat-2.8.2.tar.gz) = 7c09ddc0193f920b8f670caf6ca41538b0fa379ea9f154697959d56a21328a3f
-SHA512 (expat-2.8.2.tar.gz) = 378fe8b8319d1654dae09e2ce15e0dcff68e735eb9e28728b7bee7f60c81781025c3fccd6b620589529a6e63d94d0812474dc4c09721e5a3ea64dbc1efb623dd
-Size (expat-2.8.2.tar.gz) = 818391 bytes
+BLAKE2s (expat-2.8.3.tar.gz) = e160e47939e6b2cbd3bc9f9ef9537cf64e6418793ecbd1736b62a112506fbf4c
+SHA512 (expat-2.8.3.tar.gz) = 7ccf7e9a30cfcba1fc977695447e7fcbbf70b3e659098b9db7d4e317a1ce401362668c0b03ae0fea0e1305d38d540019529940fabd1e581dc90ca79233c14d0b
+Size (expat-2.8.3.tar.gz) = 822096 bytes