CVS commit: [pkgsrc-2026Q2] pkgsrc/textproc/libxml2

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Sun Aug 16 21:52:27 UTC 2026

Modified Files:
        pkgsrc/textproc/libxml2 [pkgsrc-2026Q2]: Makefile.common distinfo

Log Message:
Pullup ticket #7237 - requested by wiz
textproc/libxml2: Security fix

Revisions pulled up:
- textproc/libxml2/Makefile.common                              1.32
- textproc/libxml2/distinfo                                     1.158

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Sat Aug 15 02:24:28 UTC 2026

   Modified Files:
        pkgsrc/textproc/libxml2: Makefile.common distinfo

   Log Message:
   libxml2: update to 2.15.3.

   From Showta Ishizaki in PR 60591.

   v2.15.3: Apr 15 2026

   ### Security

   - parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
   - entities: copy children in xmlCopyEntity
   - c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
   - python: Do not decref string after adding to the list (double-free / use-after-free)
   - c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)

   ### Improvements

   - schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode
   - xmlreader: propagate reader resource loaders to validator parsers
   - python: Make python bindings python2 compatible
   - xmlregexp: Fix escape-sequence character range matching
   - xmlreader: Free input in xmlReaderForFd (memory-leak)
   - xmlstring: Free cur on every error for xmlStrncat (memory-leak)
   - catalog: Free xmlCatalogResolveCache on cleanup (memory leak)
   - Fix nanohttp.c build when --without-output
   - test: fix mismatched signed/unsigned comparison

   v2.15.2: Mar 03 2026

   ### Security

   - CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c
   - CVE-2026-0990 fix: Prevent infinite recursion in
     xmlCatalogListXMLResolve
   - CVE-2026-0992 fix: Exponential behavior when handling
   - parser: Fix infinite loop in xmlCtxtParseContent
   - CVE-2025-10911 libxslt related: Ignore next/prev of documents when
     traversing XPath
   - CVE-2026-0989 fix: Add RelaxNG include limit
   - xmlIO: use size_t for buffer size reallocation
   - uri: fix signed integer overflow in xmlBuildRelativeURISafe
   - schematron: fix memory leaks on error paths in xmlSchematronParseRule
   - catalog: fix stack overflow from self-referencing SGML CATALOG entries

   ### Improvements

   - fuzz: Make fuzzy encoding match more lenient
   - Fix C14N type confusion
   - meson: Fix build with Meson < 1.3
   - xmllint: Use zlib directly
   - xmllint: New option to separate xpath results using null, --xpath0
   - autotools: Make valgrind actually check for leaks
   - meson: Add valgrind test setup
   - Fix xmlOutputBufferGetContent output when encoder is set
   - threads: don't force _WIN32_WINNT to Vista if it's set to a higher value
   - dist: Add generated documentation to the dist as "dist-doc" folder
     to simplify downstream packaging of doc
   - Fix xmlRemoveEntity removing from wrong hash table
   - use duplicating variant in relaxng to mitigate UAF
   - Fix memory leak in xmlTextWriterStartAttributeNS on OOM
   - meson: remove hardcoded buildtype=debug default
   - Fix memory leak of prefix in xmlTextWriterStartElementNS()
   - writer: Add a few extra NULL checks to avoid memory leaks on corrupt
     writer path.


To generate a diff of this commit:
cvs rdiff -u -r1.31 -r1.31.4.1 pkgsrc/textproc/libxml2/Makefile.common
cvs rdiff -u -r1.157 -r1.157.4.1 pkgsrc/textproc/libxml2/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/libxml2/Makefile.common
diff -u pkgsrc/textproc/libxml2/Makefile.common:1.31 pkgsrc/textproc/libxml2/Makefile.common:1.31.4.1
--- pkgsrc/textproc/libxml2/Makefile.common:1.31        Thu Feb 19 15:09:47 2026
+++ pkgsrc/textproc/libxml2/Makefile.common     Sun Aug 16 21:52:27 2026
@@ -1,9 +1,9 @@
-# $NetBSD: Makefile.common,v 1.31 2026/02/19 15:09:47 wiz Exp $
+# $NetBSD: Makefile.common,v 1.31.4.1 2026/08/16 21:52:27 maya Exp $
 #
 # used by textproc/libxml2/Makefile
 # used by textproc/py-libxml2/Makefile
 
-DISTNAME=      libxml2-2.15.1
+DISTNAME=      libxml2-2.15.3
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GNOME:=sources/libxml2/${PKGVERSION_NOREV:R}/}
 EXTRACT_SUFX=  .tar.xz

Index: pkgsrc/textproc/libxml2/distinfo
diff -u pkgsrc/textproc/libxml2/distinfo:1.157 pkgsrc/textproc/libxml2/distinfo:1.157.4.1
--- pkgsrc/textproc/libxml2/distinfo:1.157      Thu Feb 19 15:09:47 2026
+++ pkgsrc/textproc/libxml2/distinfo    Sun Aug 16 21:52:27 2026
@@ -1,6 +1,6 @@
-$NetBSD: distinfo,v 1.157 2026/02/19 15:09:47 wiz Exp $
+$NetBSD: distinfo,v 1.157.4.1 2026/08/16 21:52:27 maya Exp $
 
-BLAKE2s (libxml2-2.15.1.tar.xz) = 07a7d911cd5af651a4d962435158252c611d9c866736f42e4e87364044047f57
-SHA512 (libxml2-2.15.1.tar.xz) = 429c7d0dc3cbcb8de1bf6eb588fb8025fee009c9b25e87c96ecc5de57cc12b558b0ab8141f333d73ca687109335f297c9f9776abbb9da9afc9d8e79041c86b7f
-Size (libxml2-2.15.1.tar.xz) = 2004588 bytes
+BLAKE2s (libxml2-2.15.3.tar.xz) = b770d0d524330ec9bb0c319f751bc4a4f0376aaff51d30bf35a7e28205292f86
+SHA512 (libxml2-2.15.3.tar.xz) = 6f7f1aabd012454553e851bd1ee548fbd14d21c576f2b2ab9eeedab3dfba51392083f74b34f060e9b538baeea212cdb462b8669c214c711771fb9a897fdc1c60
+Size (libxml2-2.15.3.tar.xz) = 3152452 bytes
 SHA1 (patch-configure) = 1f94becea5804e89d32b4e600753aa4dc7527045