CVS commit: [pkgsrc-2026Q3] pkgsrc/textproc/expat

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Thu Oct  1 18:53:09 UTC 2026

Modified Files:
        pkgsrc/textproc/expat [pkgsrc-2026Q3]: Makefile builtin.mk distinfo

Log Message:
Pullup ticket #7251 - requested by taca
textproc/expat: security fix

Revisions pulled up:
- textproc/expat/Makefile                                       1.69
- textproc/expat/builtin.mk                                     1.29
- textproc/expat/distinfo                                       1.63

---
   Module Name: pkgsrc
   Committed By:        adam
   Date:                Wed Sep 23 05:31:06 UTC 2026

   Modified Files:
        pkgsrc/textproc/expat: Makefile builtin.mk distinfo

   Log Message:
   expat: updated to 2.8.5

   Release 2.8.5 Tue September 22 2026

   Security fixes:
        CVE-2026-93990 -- Reject high surrogates not followed by a
               low surrogate during UTF-16 decoding; previously, malformed
               UTF-16 could be smuggled into the application using Expat
               and could cause arbitrary damage there, depending on how
               malformed UTF-16 was handled inside the application;
               validation was not their job but Expat's. This is similar
               to past vulnerability CVE-2022-25235.
               Upstream CVSS 3.1 vector:
               AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)

   Bug fixes:
        lib: Fix OOM-related memory leak on a failed overflow check
        lib: Fix memory alignment for architectures with 128bit
               pointers like CHERI-RISC-V
        xmlwf: Handle errors when closing output files

   Other changes:
        lib: Reject an XML declaration version other than `1.[0-9]+`
               (which is less strict than XML 1.0r4 (fourth edition)
               and matches XML 1.0r5 (fifth edition))
        lib: Make Clang, GCC and MSVC warn about use of function
               XML_SetHashSalt that is deprecated since Expat 2.8.0
        lib: Drop internal macros FASTCALL, PTRCALL, PTRFASTCALL
        xmlwf: Document that with `-k` the last error determines the
               xmlwf exit code in `--help` output
        xmlwf: Make exit code 3 documentation match exit code 2 more
               closely in `--help` output
   CMake|Windows: Refrain from adding `/source-charset:utf-8`
               for MSVC
   Autotools: Be explicit about the minimum required version of
               GNU Automake, currently version 1.13 of 2012-12-28
        Autotools|macOS: Sync CMake templates with CMake 4.4.3
        Replace some internal use of XML_Bool with standard bool
        tests: Propagate xmltest.sh failures via exit status
        tests|xmlwf: Add `include "expat_config.h"` where missing
        tests: Start covering hash table operation
   tests: Drop __cplusplus leftovers
        tests: Fix tail pointer when unlinking the last tracked
               allocation
        docs: Emphasize that XML_StopParser is not immediate
        docs: Sync XML_FeatureEnum value list in doc/reference.html
   Version info bumped from 13:4:12 (libexpat*.so.1.12.4)
               to 13:5:12 (libexpat*.so.1.12.5); see https://verbump.de/
               for what these numbers do

   Infrastructure:
        Add missing .gitignore entries
        CI: Detect missing `include "expat_config.h"`
        CI: Bump MinGW Clang from 23.0.1 to 23.1.1
        CI: Bump Fil-C from 0.684 to 0.685
        CI: Bump Cppcheck from 2.21.0 to 2.22.0
        CI: Extract helper script `apply-htmltidy.sh`
   Autotools: Start to also produce .tar.bz3 release tarballs


To generate a diff of this commit:
cvs rdiff -u -r1.68 -r1.68.2.1 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.28 -r1.28.2.1 pkgsrc/textproc/expat/builtin.mk
cvs rdiff -u -r1.62 -r1.62.2.1 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.68 pkgsrc/textproc/expat/Makefile:1.68.2.1
--- pkgsrc/textproc/expat/Makefile:1.68 Mon Aug 31 18:16:39 2026
+++ pkgsrc/textproc/expat/Makefile      Thu Oct  1 18:53:09 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.68 2026/08/31 18:16:39 wiz Exp $
+# $NetBSD: Makefile,v 1.68.2.1 2026/10/01 18:53:09 bsiegert Exp $
 
-DISTNAME=      expat-2.8.4
+DISTNAME=      expat-2.8.5
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/builtin.mk
diff -u pkgsrc/textproc/expat/builtin.mk:1.28 pkgsrc/textproc/expat/builtin.mk:1.28.2.1
--- pkgsrc/textproc/expat/builtin.mk:1.28       Tue Aug 11 16:18:02 2026
+++ pkgsrc/textproc/expat/builtin.mk    Thu Oct  1 18:53:09 2026
@@ -1,9 +1,9 @@
-# $NetBSD: builtin.mk,v 1.28 2026/08/11 16:18:02 wiz Exp $
+# $NetBSD: builtin.mk,v 1.28.2.1 2026/10/01 18:53:09 bsiegert Exp $
 
 BUILTIN_PKG:=  expat
 
 BUILTIN_FIND_HEADERS_VAR:=     H_EXPAT
-BUILTIN_FIND_HEADERS.H_EXPAT=  expat.h
+BUILTIN_FIND_HEADERS.H_EXPAT=  expat.h expat_config.h
 
 .include "../../mk/buildlink3/bsd.builtin.mk"
 

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.62 pkgsrc/textproc/expat/distinfo:1.62.2.1
--- pkgsrc/textproc/expat/distinfo:1.62 Mon Aug 31 18:16:39 2026
+++ pkgsrc/textproc/expat/distinfo      Thu Oct  1 18:53:09 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.62 2026/08/31 18:16:39 wiz Exp $
+$NetBSD: distinfo,v 1.62.2.1 2026/10/01 18:53:09 bsiegert Exp $
 
-BLAKE2s (expat-2.8.4.tar.gz) = d61d96fd4a73f3e8ca6f6e5974bce90899dd52ffbe322b13a438048e7d535511
-SHA512 (expat-2.8.4.tar.gz) = 9e4f2af334a91784c0e84faf090073cab45639d1ecbf5747cf6582501d6c111c20c5bf2607925a277aca42931b2b0512cdcb4dfcde0d68171a546b30414a8442
-Size (expat-2.8.4.tar.gz) = 825689 bytes
+BLAKE2s (expat-2.8.5.tar.gz) = ccdc5ad5b74b398cb9ec7e0268121bc5442a1a9092635f26612a3f10881f9479
+SHA512 (expat-2.8.5.tar.gz) = 9ebd87922feaa609ca223d5b1083ec7d905826cdec1aa51a016177abe87cdfe1b5ab27f6872c929817898a2bd00867685c8dea43720d2b457056cb96555ca577
+Size (expat-2.8.5.tar.gz) = 838183 bytes