CVS commit: pkgsrc/textproc/expat

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Mon Nov  2 12:11:20 UTC 2026

Modified Files:
        pkgsrc/textproc/expat: Makefile distinfo

Log Message:
expat: updated to 2.10.0

Release 2.10.0 Mon November 2 2026
        Security fixes:
           1431  CVE-2026-113351 -- Fix denial of service with use of
                    `XML_ParserReset`
  1433 1436 ..
  1438 1439 ..
           1442  CVE-2026-115506 -- Detect billion laughs attacks quicker
                    and more of its variations. Related payload fuzzer at:
                      https://github.com/hannob/lololol
                    Please note that a layer of compression around XML can
                    significantly reduce the minimum attack payload size.
                    In case of backporting, please note pull request 1439
                    in particular.
           1444  CVE-2026-117610 -- Fix initial non-final empty subparser
                    parse calls. Was segfaulting previously.
           1450  CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
                    function `storeAtts` from signed integer overflow

        Bug fixes:
           1452  lib: Initialize `m_parsingStatus.finalBuffer` in `parserInit`
                    to fix calling `XML_GetParsingStatus` right after
                    parser creation
     1457 1459  lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES == 0`
                    including NULL pointer arithmetic undefined behavior
                    and uninitialized variable access
           1458  lib: Use C99 length modifiers for `ptrdiff_t` and `size_t`
                    to fix support for CHERI-RISC-V
           1461  lib: Check `isCalledFromInsideHandler` first in `XML_Parse`
           1467  lib: Add missing check for a character handler reset

        Other changes:
           1441  Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD
                    to better support compilation with `-Wl,--as-needed`
           1412  CMake: Support repeated `find_package` calls
           1413  lib: Address warning `XML_GE is not defined [-Werror=undef]`
           1415  lib: Stop delaying `callStoreEntityValue` error handling
           1415  lib: Add missing call to `poolDiscard`
           1437  lib: Add missing `NULL` check for `m_startDoctypeDeclHandler`
           1417  lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from
                         `int` to `size_t`
           1463  lib: Fix integer truncation in `XmlGetAttributes`/`getAtts`
           1420  lib: Some more `XML_Bool` to `bool` migration
     1449 1460  lib: Document the memory reuse black magic that function
                    `storeAtts` is doing
           1453  lib: Document failure to reject bad redefinitions of
                    predefined entities
           1432  tests: Replace `XML_SetHashSalt` with
                    `XML_SetHashSalt16Bytes`
     1416 1435  Version info bumped from 14:0:13 (libexpat*.so.1.13.0)
                    to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.de/
                    for what these numbers do


To generate a diff of this commit:
cvs rdiff -u -r1.70 -r1.71 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.64 -r1.65 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.70 pkgsrc/textproc/expat/Makefile:1.71
--- pkgsrc/textproc/expat/Makefile:1.70 Mon Oct  5 18:38:06 2026
+++ pkgsrc/textproc/expat/Makefile      Mon Nov  2 12:11:20 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.70 2026/10/05 18:38:06 wiz Exp $
+# $NetBSD: Makefile,v 1.71 2026/11/02 12:11:20 adam Exp $
 
-DISTNAME=      expat-2.9.0
+DISTNAME=      expat-2.10.0
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.64 pkgsrc/textproc/expat/distinfo:1.65
--- pkgsrc/textproc/expat/distinfo:1.64 Mon Oct  5 18:38:06 2026
+++ pkgsrc/textproc/expat/distinfo      Mon Nov  2 12:11:20 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.64 2026/10/05 18:38:06 wiz Exp $
+$NetBSD: distinfo,v 1.65 2026/11/02 12:11:20 adam Exp $
 
-BLAKE2s (expat-2.9.0.tar.gz) = 4aa81ba1e91a74cea7383810b26a194d3f85083fac3c60eb210f545702c26f6c
-SHA512 (expat-2.9.0.tar.gz) = 8874a1904fdbeeb657a64fbcf6e9159d70d238672046592b5e89c18cc7d09c093d411f447d41d54c45d98c7ae8b46616747708e9e94ae07d57363dbf0c5df657
-Size (expat-2.9.0.tar.gz) = 847314 bytes
+BLAKE2s (expat-2.10.0.tar.gz) = 3f0fad7f2d831e4320e04b80807b24bb654ab5d95bcd913ff96546ad4fa9e472
+SHA512 (expat-2.10.0.tar.gz) = 34c97db9c885371c0d2e7b7f2d99ff8bf700f50927d1029335e6c6f2b71d990f30aab80b178def683a5d5901d0c2ef49ea9156414f918f0f8c5c904f2cb0bdc1
+Size (expat-2.10.0.tar.gz) = 860532 bytes