CVS commit: pkgsrc/textproc/expat

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Oct  5 18:38:06 UTC 2026

Modified Files:
        pkgsrc/textproc/expat: Makefile distinfo

Log Message:
expat: update to 2.9.0.

Release 2.9.0 Mon October 5 2026
        Security fixes:
           #1392  CVE-2026-102633 -- Integer overflow in function
                    expat_realloc on 32bit platforms
           #1393  CVE-2026-77214 -- Validate parameter `len` against available
                    buffer capacity in XML_ParseBuffer

        Bug fixes:
           #1387  lib: Handle OOM when copying encodingName in XML_ParserReset

        New features:
           #1327  lib: Introduce new "Properties API" to get and set
                    scalar properties for a single parser instance.
                    There are six new functions:
                    - XML_GetPropertyBool
                    - XML_GetPropertyDouble
                    - XML_GetPropertyUInt64
                    - XML_SetPropertyBool
                    - XML_SetPropertyDouble
                    - XML_SetPropertyUInt64
                    And two new enums:
                    - XML_Prop_Error
                    - XML_Parser_Property
           #1323  lib: Introduce five new 64bit location API functions:
                    - XML_GetCurrentByteCount64
                    - XML_GetCurrentByteIndex64
                    - XML_GetCurrentColumnNumber64
                    - XML_GetCurrentLineNumber64
                    - XML_GetInputContext64
                    These five functions closely mirror their predecessors
                    but are not prone to 32bit integer wrap-around.

        Other changes:
           #1391  docs: Document the scope of function XML_GetErrorCode
           #1395  docs: Document length expectations for XML_ParseBuffer
           #1394  lib: Call unknown encoding release before parser teardown
     #1370 #1373  lib: Drop (disabled-by-default) attribute info feature
                    These things are now gone:
                    - Public function XML_GetAttributeInfo
                    - Public struct XML_AttrInfo
                    - Macro XML_ATTR_INFO
                    These things are now causing build errors:
                    - Configure option --enable-xml-attr-info
                    - CMake option -DEXPAT_ATTR_INFO=ON
     #1379 #1382  lib: Drop (disabled-by-default) minimum size feature
                    These things are now gone:
                    - Macro XML_MIN_SIZE
                    These things are now causing build errors:
                    - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS
                    - CMake option -DEXPAT_MIN_SIZE=ON
     #1323 #1411  lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit
                    location API functions instead please)
           #1323  lib: Deprecate five location API functions that are cursed
                    with integer wrap-around:
                    - XML_GetCurrentByteCount
                    - XML_GetCurrentByteIndex
                    - XML_GetCurrentColumnNumber
                    - XML_GetCurrentLineNumber
                    - XML_GetInputContext
           #1399  lib: Guard against out-of-handler use of XML_DefaultCurrent
           #1400  lib: Use size_t for bytesAllocated and peakBytesAllocated
  #1401 #1402 ..
     #1404 #1405  lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp
           #1406  xmlwf: Add missing `#include "expat.h"`
     #1389 #1396  Version info bumped from 13:5:12 (libexpat*.so.1.12.5)
                    to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/
                    for what these numbers do


To generate a diff of this commit:
cvs rdiff -u -r1.69 -r1.70 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.63 -r1.64 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.69 pkgsrc/textproc/expat/Makefile:1.70
--- pkgsrc/textproc/expat/Makefile:1.69 Wed Sep 23 05:31:06 2026
+++ pkgsrc/textproc/expat/Makefile      Mon Oct  5 18:38:06 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.69 2026/09/23 05:31:06 adam Exp $
+# $NetBSD: Makefile,v 1.70 2026/10/05 18:38:06 wiz Exp $
 
-DISTNAME=      expat-2.8.5
+DISTNAME=      expat-2.9.0
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.63 pkgsrc/textproc/expat/distinfo:1.64
--- pkgsrc/textproc/expat/distinfo:1.63 Wed Sep 23 05:31:06 2026
+++ pkgsrc/textproc/expat/distinfo      Mon Oct  5 18:38:06 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.63 2026/09/23 05:31:06 adam Exp $
+$NetBSD: distinfo,v 1.64 2026/10/05 18:38:06 wiz Exp $
 
-BLAKE2s (expat-2.8.5.tar.gz) = ccdc5ad5b74b398cb9ec7e0268121bc5442a1a9092635f26612a3f10881f9479
-SHA512 (expat-2.8.5.tar.gz) = 9ebd87922feaa609ca223d5b1083ec7d905826cdec1aa51a016177abe87cdfe1b5ab27f6872c929817898a2bd00867685c8dea43720d2b457056cb96555ca577
-Size (expat-2.8.5.tar.gz) = 838183 bytes
+BLAKE2s (expat-2.9.0.tar.gz) = 4aa81ba1e91a74cea7383810b26a194d3f85083fac3c60eb210f545702c26f6c
+SHA512 (expat-2.9.0.tar.gz) = 8874a1904fdbeeb657a64fbcf6e9159d70d238672046592b5e89c18cc7d09c093d411f447d41d54c45d98c7ae8b46616747708e9e94ae07d57363dbf0c5df657
+Size (expat-2.9.0.tar.gz) = 847314 bytes