CVS commit: [pkgsrc-2026Q2] pkgsrc/textproc/expat

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Sun Aug 16 21:28:42 UTC 2026

Modified Files:
        pkgsrc/textproc/expat [pkgsrc-2026Q2]: Makefile builtin.mk distinfo

Log Message:
Pullup ticket #7231 - requested by taca
textproc/expat: Security fix

Revisions pulled up:
- textproc/expat/Makefile                                       1.67
- textproc/expat/builtin.mk                                     1.28
- textproc/expat/distinfo                                       1.61

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Tue Aug 11 16:18:02 UTC 2026

   Modified Files:
        pkgsrc/textproc/expat: Makefile builtin.mk distinfo

   Log Message:
   expat: update to 2.8.3.

   Release 2.8.3 Mon August 10 2026
           Security fixes:
              #1296  CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
                       infinite loop caused by treating low surrogates (Unicode)
                       the same as high surrogates in functions *_toUtf16.
                       Needs Expat compiled with 16bit character support
                       (e.g. with Firefox and/or on Windows) to be affected.
                       Upstream CVSS 3.1 vector:
                       AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                       (Note the "AV:N" for network/remote, the "AV:L" in NVD by
                       Mitre is mistaken.)
                       Original bug report from Mozilla at:
                       https://bugzilla.mozilla.org/show_bug.cgi?id=2053153

           Bug fixes:
        #1297 #1300  lib: Fix support for 2+ GiB documents (regression from 2.8.2)
              #1286  lib: Reject empty version in the XML declaration
        #1305 #1306  lib: Fix printf format for AIX

           Other changes:
              #1309  CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
              #1295  CMake|Windows: Add a 64bit MinGW toolchain file
        #1287 #1289  CMake|Windows: Start invoking MSVC with /source-charset:utf-8
              #1289  CMake|Windows: Start requiring MSVC 2015 Update 2 or later
              #1300  Document the current wrap-around issues with functions
                       - XML_GetCurrentByteIndex
                       - XML_GetCurrentColumnNumber
                       - XML_GetCurrentLineNumber
                       - XML_GetAttributeInfo
                       explicitly.
              #1303  Address Clang Static Analyzer 22 warning
                       `core.NullPointerArithm`
        #1313 #1314  Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
                       to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
                       for what these numbers do

           Infrastructure:
              #1311  CI: Limit workflow runtime and package installation runtime
              #1310  CI: Pin Cppcheck version for a robust CI
              #1310  CI: Migrate Cppcheck CI from macOS to Linux
              #1312  CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
                       and WASI SDK
              #1304  CI: Activate AddressSanitizer for MSVC Windows CI
              #1308  CI: Introduce zizmor static analysis for GitHub Actions
              #1308  CI: Start using `persist-credentials: false` with Git checkout
              #1219  CI: Add a 7 day cooldown to Dependabot for GitHub Actions
        #1302 #1303  CI: Bump Clang from 21 to 22
        #1293 #1294  Update project status for 2026-08
        #1301 #1307  Add SPDX license identifiers to the source code

   Fix some pkglint while here.


To generate a diff of this commit:
cvs rdiff -u -r1.65.2.1 -r1.65.2.2 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.27 -r1.27.4.1 pkgsrc/textproc/expat/builtin.mk
cvs rdiff -u -r1.59.2.1 -r1.59.2.2 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.65.2.1 pkgsrc/textproc/expat/Makefile:1.65.2.2
--- pkgsrc/textproc/expat/Makefile:1.65.2.1     Sun Jun 28 17:54:40 2026
+++ pkgsrc/textproc/expat/Makefile      Sun Aug 16 21:28:42 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.65.2.1 2026/06/28 17:54:40 bsiegert Exp $
+# $NetBSD: Makefile,v 1.65.2.2 2026/08/16 21:28:42 maya Exp $
 
-DISTNAME=      expat-2.8.2
+DISTNAME=      expat-2.8.3
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/builtin.mk
diff -u pkgsrc/textproc/expat/builtin.mk:1.27 pkgsrc/textproc/expat/builtin.mk:1.27.4.1
--- pkgsrc/textproc/expat/builtin.mk:1.27       Sat Jan 31 17:39:20 2026
+++ pkgsrc/textproc/expat/builtin.mk    Sun Aug 16 21:28:42 2026
@@ -1,4 +1,4 @@
-# $NetBSD: builtin.mk,v 1.27 2026/01/31 17:39:20 wiz Exp $
+# $NetBSD: builtin.mk,v 1.27.4.1 2026/08/16 21:28:42 maya Exp $
 
 BUILTIN_PKG:=  expat
 
@@ -97,6 +97,7 @@ pre-configure: override-expat-pkgconfig
 BLKDIR_PKGCFG= ${BUILDLINK_DIR}/lib/pkgconfig
 EXPAT_PKGCFGF= expat.pc
 
+.PHONY: override-expat-pkgconfig override-message-expat-pkgconfig override-expat-pkgconfig
 override-expat-pkgconfig: override-message-expat-pkgconfig
 override-message-expat-pkgconfig:
        @${STEP_MSG} "Generating pkg-config file for builtin expat package."

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.59.2.1 pkgsrc/textproc/expat/distinfo:1.59.2.2
--- pkgsrc/textproc/expat/distinfo:1.59.2.1     Sun Jun 28 17:54:40 2026
+++ pkgsrc/textproc/expat/distinfo      Sun Aug 16 21:28:42 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.59.2.1 2026/06/28 17:54:40 bsiegert Exp $
+$NetBSD: distinfo,v 1.59.2.2 2026/08/16 21:28:42 maya Exp $
 
-BLAKE2s (expat-2.8.2.tar.gz) = 7c09ddc0193f920b8f670caf6ca41538b0fa379ea9f154697959d56a21328a3f
-SHA512 (expat-2.8.2.tar.gz) = 378fe8b8319d1654dae09e2ce15e0dcff68e735eb9e28728b7bee7f60c81781025c3fccd6b620589529a6e63d94d0812474dc4c09721e5a3ea64dbc1efb623dd
-Size (expat-2.8.2.tar.gz) = 818391 bytes
+BLAKE2s (expat-2.8.3.tar.gz) = e160e47939e6b2cbd3bc9f9ef9537cf64e6418793ecbd1736b62a112506fbf4c
+SHA512 (expat-2.8.3.tar.gz) = 7ccf7e9a30cfcba1fc977695447e7fcbbf70b3e659098b9db7d4e317a1ce401362668c0b03ae0fea0e1305d38d540019529940fabd1e581dc90ca79233c14d0b
+Size (expat-2.8.3.tar.gz) = 822096 bytes