CVS commit: [pkgsrc-2026Q3] pkgsrc/textproc/expat

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Tue Oct 20 23:51:14 UTC 2026

Modified Files:
        pkgsrc/textproc/expat [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7287 - requested by taca
textproc/expat: Security fix

Revisions pulled up:
- textproc/expat/Makefile                                       1.70
- textproc/expat/distinfo                                       1.64

---
   Module Name: pkgsrc
   Committed By:        wiz
   Date:                Mon Oct  5 18:38:06 UTC 2026

   Modified Files:
        pkgsrc/textproc/expat: Makefile distinfo

   Log Message:
   expat: update to 2.9.0.

   Release 2.9.0 Mon October 5 2026
           Security fixes:
              #1392  CVE-2026-102633 -- Integer overflow in function
                       expat_realloc on 32bit platforms
              #1393  CVE-2026-77214 -- Validate parameter `len` against available
                       buffer capacity in XML_ParseBuffer

           Bug fixes:
              #1387  lib: Handle OOM when copying encodingName in XML_ParserReset

           New features:
              #1327  lib: Introduce new "Properties API" to get and set
                       scalar properties for a single parser instance.
                       There are six new functions:
                       - XML_GetPropertyBool
                       - XML_GetPropertyDouble
                       - XML_GetPropertyUInt64
                       - XML_SetPropertyBool
                       - XML_SetPropertyDouble
                       - XML_SetPropertyUInt64
                       And two new enums:
                       - XML_Prop_Error
                       - XML_Parser_Property
              #1323  lib: Introduce five new 64bit location API functions:
                       - XML_GetCurrentByteCount64
                       - XML_GetCurrentByteIndex64
                       - XML_GetCurrentColumnNumber64
                       - XML_GetCurrentLineNumber64
                       - XML_GetInputContext64
                       These five functions closely mirror their predecessors
                       but are not prone to 32bit integer wrap-around.

           Other changes:
              #1391  docs: Document the scope of function XML_GetErrorCode
              #1395  docs: Document length expectations for XML_ParseBuffer
              #1394  lib: Call unknown encoding release before parser teardown
        #1370 #1373  lib: Drop (disabled-by-default) attribute info feature
                       These things are now gone:
                       - Public function XML_GetAttributeInfo
                       - Public struct XML_AttrInfo
                       - Macro XML_ATTR_INFO
                       These things are now causing build errors:
                       - Configure option --enable-xml-attr-info
                       - CMake option -DEXPAT_ATTR_INFO=ON
        #1379 #1382  lib: Drop (disabled-by-default) minimum size feature
                       These things are now gone:
                       - Macro XML_MIN_SIZE
                       These things are now causing build errors:
                       - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS
                       - CMake option -DEXPAT_MIN_SIZE=ON
        #1323 #1411  lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit
                       location API functions instead please)
              #1323  lib: Deprecate five location API functions that are cursed
                       with integer wrap-around:
                       - XML_GetCurrentByteCount
                       - XML_GetCurrentByteIndex
                       - XML_GetCurrentColumnNumber
                       - XML_GetCurrentLineNumber
                       - XML_GetInputContext
              #1399  lib: Guard against out-of-handler use of XML_DefaultCurrent
              #1400  lib: Use size_t for bytesAllocated and peakBytesAllocated
     #1401 #1402 ..
        #1404 #1405  lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp
              #1406  xmlwf: Add missing `#include "expat.h"`
        #1389 #1396  Version info bumped from 13:5:12 (libexpat*.so.1.12.5)
                       to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/
                       for what these numbers do


To generate a diff of this commit:
cvs rdiff -u -r1.68.2.1 -r1.68.2.2 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.62.2.1 -r1.62.2.2 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.68.2.1 pkgsrc/textproc/expat/Makefile:1.68.2.2
--- pkgsrc/textproc/expat/Makefile:1.68.2.1     Thu Oct  1 18:53:09 2026
+++ pkgsrc/textproc/expat/Makefile      Tue Oct 20 23:51:14 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.68.2.1 2026/10/01 18:53:09 bsiegert Exp $
+# $NetBSD: Makefile,v 1.68.2.2 2026/10/20 23:51:14 maya Exp $
 
-DISTNAME=      expat-2.8.5
+DISTNAME=      expat-2.9.0
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.62.2.1 pkgsrc/textproc/expat/distinfo:1.62.2.2
--- pkgsrc/textproc/expat/distinfo:1.62.2.1     Thu Oct  1 18:53:09 2026
+++ pkgsrc/textproc/expat/distinfo      Tue Oct 20 23:51:14 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.62.2.1 2026/10/01 18:53:09 bsiegert Exp $
+$NetBSD: distinfo,v 1.62.2.2 2026/10/20 23:51:14 maya Exp $
 
-BLAKE2s (expat-2.8.5.tar.gz) = ccdc5ad5b74b398cb9ec7e0268121bc5442a1a9092635f26612a3f10881f9479
-SHA512 (expat-2.8.5.tar.gz) = 9ebd87922feaa609ca223d5b1083ec7d905826cdec1aa51a016177abe87cdfe1b5ab27f6872c929817898a2bd00867685c8dea43720d2b457056cb96555ca577
-Size (expat-2.8.5.tar.gz) = 838183 bytes
+BLAKE2s (expat-2.9.0.tar.gz) = 4aa81ba1e91a74cea7383810b26a194d3f85083fac3c60eb210f545702c26f6c
+SHA512 (expat-2.9.0.tar.gz) = 8874a1904fdbeeb657a64fbcf6e9159d70d238672046592b5e89c18cc7d09c093d411f447d41d54c45d98c7ae8b46616747708e9e94ae07d57363dbf0c5df657
+Size (expat-2.9.0.tar.gz) = 847314 bytes