CVS commit: pkgsrc/textproc/expat

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Wed Sep 23 05:31:06 UTC 2026

Modified Files:
        pkgsrc/textproc/expat: Makefile builtin.mk distinfo

Log Message:
expat: updated to 2.8.5

Release 2.8.5 Tue September 22 2026

Security fixes:
     CVE-2026-93990 -- Reject high surrogates not followed by a
            low surrogate during UTF-16 decoding; previously, malformed
            UTF-16 could be smuggled into the application using Expat
            and could cause arbitrary damage there, depending on how
            malformed UTF-16 was handled inside the application;
            validation was not their job but Expat's. This is similar
            to past vulnerability CVE-2022-25235.
            Upstream CVSS 3.1 vector:
            AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)

Bug fixes:
     lib: Fix OOM-related memory leak on a failed overflow check
     lib: Fix memory alignment for architectures with 128bit
            pointers like CHERI-RISC-V
     xmlwf: Handle errors when closing output files

Other changes:
     lib: Reject an XML declaration version other than `1.[0-9]+`
            (which is less strict than XML 1.0r4 (fourth edition)
            and matches XML 1.0r5 (fifth edition))
     lib: Make Clang, GCC and MSVC warn about use of function
            XML_SetHashSalt that is deprecated since Expat 2.8.0
     lib: Drop internal macros FASTCALL, PTRCALL, PTRFASTCALL
     xmlwf: Document that with `-k` the last error determines the
            xmlwf exit code in `--help` output
     xmlwf: Make exit code 3 documentation match exit code 2 more
            closely in `--help` output
CMake|Windows: Refrain from adding `/source-charset:utf-8`
            for MSVC
Autotools: Be explicit about the minimum required version of
            GNU Automake, currently version 1.13 of 2012-12-28
     Autotools|macOS: Sync CMake templates with CMake 4.4.3
     Replace some internal use of XML_Bool with standard bool
     tests: Propagate xmltest.sh failures via exit status
     tests|xmlwf: Add `include "expat_config.h"` where missing
     tests: Start covering hash table operation
tests: Drop __cplusplus leftovers
     tests: Fix tail pointer when unlinking the last tracked
            allocation
     docs: Emphasize that XML_StopParser is not immediate
     docs: Sync XML_FeatureEnum value list in doc/reference.html
Version info bumped from 13:4:12 (libexpat*.so.1.12.4)
            to 13:5:12 (libexpat*.so.1.12.5); see https://verbump.de/
            for what these numbers do

Infrastructure:
     Add missing .gitignore entries
     CI: Detect missing `include "expat_config.h"`
     CI: Bump MinGW Clang from 23.0.1 to 23.1.1
     CI: Bump Fil-C from 0.684 to 0.685
     CI: Bump Cppcheck from 2.21.0 to 2.22.0
     CI: Extract helper script `apply-htmltidy.sh`
Autotools: Start to also produce .tar.bz3 release tarballs


To generate a diff of this commit:
cvs rdiff -u -r1.68 -r1.69 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.28 -r1.29 pkgsrc/textproc/expat/builtin.mk
cvs rdiff -u -r1.62 -r1.63 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.68 pkgsrc/textproc/expat/Makefile:1.69
--- pkgsrc/textproc/expat/Makefile:1.68 Mon Aug 31 18:16:39 2026
+++ pkgsrc/textproc/expat/Makefile      Wed Sep 23 05:31:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.68 2026/08/31 18:16:39 wiz Exp $
+# $NetBSD: Makefile,v 1.69 2026/09/23 05:31:06 adam Exp $
 
-DISTNAME=      expat-2.8.4
+DISTNAME=      expat-2.8.5
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/builtin.mk
diff -u pkgsrc/textproc/expat/builtin.mk:1.28 pkgsrc/textproc/expat/builtin.mk:1.29
--- pkgsrc/textproc/expat/builtin.mk:1.28       Tue Aug 11 16:18:02 2026
+++ pkgsrc/textproc/expat/builtin.mk    Wed Sep 23 05:31:06 2026
@@ -1,9 +1,9 @@
-# $NetBSD: builtin.mk,v 1.28 2026/08/11 16:18:02 wiz Exp $
+# $NetBSD: builtin.mk,v 1.29 2026/09/23 05:31:06 adam Exp $
 
 BUILTIN_PKG:=  expat
 
 BUILTIN_FIND_HEADERS_VAR:=     H_EXPAT
-BUILTIN_FIND_HEADERS.H_EXPAT=  expat.h
+BUILTIN_FIND_HEADERS.H_EXPAT=  expat.h expat_config.h
 
 .include "../../mk/buildlink3/bsd.builtin.mk"
 

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.62 pkgsrc/textproc/expat/distinfo:1.63
--- pkgsrc/textproc/expat/distinfo:1.62 Mon Aug 31 18:16:39 2026
+++ pkgsrc/textproc/expat/distinfo      Wed Sep 23 05:31:06 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.62 2026/08/31 18:16:39 wiz Exp $
+$NetBSD: distinfo,v 1.63 2026/09/23 05:31:06 adam Exp $
 
-BLAKE2s (expat-2.8.4.tar.gz) = d61d96fd4a73f3e8ca6f6e5974bce90899dd52ffbe322b13a438048e7d535511
-SHA512 (expat-2.8.4.tar.gz) = 9e4f2af334a91784c0e84faf090073cab45639d1ecbf5747cf6582501d6c111c20c5bf2607925a277aca42931b2b0512cdcb4dfcde0d68171a546b30414a8442
-Size (expat-2.8.4.tar.gz) = 825689 bytes
+BLAKE2s (expat-2.8.5.tar.gz) = ccdc5ad5b74b398cb9ec7e0268121bc5442a1a9092635f26612a3f10881f9479
+SHA512 (expat-2.8.5.tar.gz) = 9ebd87922feaa609ca223d5b1083ec7d905826cdec1aa51a016177abe87cdfe1b5ab27f6872c929817898a2bd00867685c8dea43720d2b457056cb96555ca577
+Size (expat-2.8.5.tar.gz) = 838183 bytes