CVS commit: pkgsrc/textproc/expat

["Thomas Klausner" <wiz%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   wiz
Date:           Mon Aug 31 18:16:39 UTC 2026

Modified Files:
        pkgsrc/textproc/expat: Makefile distinfo

Log Message:
expat: update to 2.8.4.

Release 2.8.4 Mon August 31 2026
        Security fixes:
     #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
                    "attribute isCdata lookups" that allowed denial of service
                    attacks through moderately sized crafted XML input
                    (CWE-407).
                    The vulnerability is closely related to past CVE-2026-45186
                    that was fixed with Expat 2.8.1.
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote.)
           #1322  CVE-2026-76957 -- Protect custom encoding callbacks from
                    parser re-entry. The vulnerability is closely related to
                    past issues CVE-2026-50219, CVE-2026-56131 and
                    CVE-2026-56412 that were all fixed with Expat 2.8.2.
           #1326  CVE-2026-76956 -- Fix inverted getentropy() return handling
                    Allows for hash flooding denial of services in
                    configurations where getentropy is configured or detected
                    as the only high quality entropy extractor.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9)
                    (Note the "AV:N" for network/remote.)

        Other changes:
     #1332 #1333  CMake: Only add `/source-charset:utf-8` when `/utf-8` is not
                    present
           #1315  lib: Resolve (currently unreachable) undefined behavior from
                    overshifting a signed int to the left
     #1325 #1334  lib: Support read-only hash table lookup with keys that are
                    not zero-terminated
           #1340  lib: Use a C99 bool for `ENTITY.open`
           #1319  Fix typo in comment
           #1320  Sync file headers
     #1328 #1329  Version info bumped from 13:3:12 (libexpat*.so.1.12.3)
                    to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
     #1317 #1335  CI: Cover compilation and execution with Fil-C
           #1337  CI: Cover compilation and execution on riscv64
           #1338  CI: Cover compilation and execution with Clang-based MinGW
           #1339  CI: Cover compilation and execution on (big-endian) s390x
           #1316  CI: Run test suite with musl, also
           #1336  CI: Bump WASI SDK from 33 to 34
           #1345  CI: Bump Clang from 22 to 23

        Special thanks to:
            Alberto Maschietto
            Alexander Bluhm
            Berkay Eren Ürün
            Darren Carreras
            Fabian Wahle (Hap Security)
            Matteo Forzan
            Matthew Fernandez
            Sorrashut Kaewtaworn
            Wade Sparks III
            Zeyou Liu
                 and
            City of Munich Open Source Sabbatical
            Moonshot AI
            VulnCheck
            Z.ai


To generate a diff of this commit:
cvs rdiff -u -r1.67 -r1.68 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.61 -r1.62 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.67 pkgsrc/textproc/expat/Makefile:1.68
--- pkgsrc/textproc/expat/Makefile:1.67 Tue Aug 11 16:18:02 2026
+++ pkgsrc/textproc/expat/Makefile      Mon Aug 31 18:16:39 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.67 2026/08/11 16:18:02 wiz Exp $
+# $NetBSD: Makefile,v 1.68 2026/08/31 18:16:39 wiz Exp $
 
-DISTNAME=      expat-2.8.3
+DISTNAME=      expat-2.8.4
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.61 pkgsrc/textproc/expat/distinfo:1.62
--- pkgsrc/textproc/expat/distinfo:1.61 Tue Aug 11 16:18:02 2026
+++ pkgsrc/textproc/expat/distinfo      Mon Aug 31 18:16:39 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.61 2026/08/11 16:18:02 wiz Exp $
+$NetBSD: distinfo,v 1.62 2026/08/31 18:16:39 wiz Exp $
 
-BLAKE2s (expat-2.8.3.tar.gz) = e160e47939e6b2cbd3bc9f9ef9537cf64e6418793ecbd1736b62a112506fbf4c
-SHA512 (expat-2.8.3.tar.gz) = 7ccf7e9a30cfcba1fc977695447e7fcbbf70b3e659098b9db7d4e317a1ce401362668c0b03ae0fea0e1305d38d540019529940fabd1e581dc90ca79233c14d0b
-Size (expat-2.8.3.tar.gz) = 822096 bytes
+BLAKE2s (expat-2.8.4.tar.gz) = d61d96fd4a73f3e8ca6f6e5974bce90899dd52ffbe322b13a438048e7d535511
+SHA512 (expat-2.8.4.tar.gz) = 9e4f2af334a91784c0e84faf090073cab45639d1ecbf5747cf6582501d6c111c20c5bf2607925a277aca42931b2b0512cdcb4dfcde0d68171a546b30414a8442
+Size (expat-2.8.4.tar.gz) = 825689 bytes