CVS commit: [pkgsrc-2026Q3] pkgsrc/textproc/expat

["Maya Rashish" <maya%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   maya
Date:           Sat Nov  7 17:11:38 UTC 2026

Modified Files:
        pkgsrc/textproc/expat [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7330 - requested by bsiegert
textproc/expat: Security fix

Revisions pulled up:
- textproc/expat/Makefile                                       1.71
- textproc/expat/distinfo                                       1.65

---
   Module Name:    pkgsrc
   Committed By:   adam
   Date:           Mon Nov  2 12:11:20 UTC 2026

   Modified Files:
           pkgsrc/textproc/expat: Makefile distinfo

   Log Message:
   expat: updated to 2.10.0

   Release 2.10.0 Mon November 2 2026
           Security fixes:
              1431  CVE-2026-113351 -- Fix denial of service with use of
                       `XML_ParserReset`
     1433 1436 ..
     1438 1439 ..
              1442  CVE-2026-115506 -- Detect billion laughs attacks quicker
                       and more of its variations. Related payload fuzzer at:
                         https://github.com/hannob/lololol
                       Please note that a layer of compression around XML can
                       significantly reduce the minimum attack payload size.
                       In case of backporting, please note pull request 1439
                       in particular.
              1444  CVE-2026-117610 -- Fix initial non-final empty subparser
                       parse calls. Was segfaulting previously.
              1450  CVE-2026-118370 -- Protect `attIndex` and `nPrefixes` in
                       function `storeAtts` from signed integer overflow

           Bug fixes:
              1452  lib: Initialize `m_parsingStatus.finalBuffer` in `parserIn=
   it`
                       to fix calling `XML_GetParsingStatus` right after
                       parser creation
        1457 1459  lib: Improve `XML_Parse` for `XML_CONTEXT_BYTES =3D=3D 0`
                       including NULL pointer arithmetic undefined behavior
                       and uninitialized variable access
              1458  lib: Use C99 length modifiers for `ptrdiff_t` and `size_t`
                       to fix support for CHERI-RISC-V
              1461  lib: Check `isCalledFromInsideHandler` first in `XML_Parse=
   `
              1467  lib: Add missing check for a character handler reset

           Other changes:
              1441  Autotools: Move `-lm` from LDFLAGS to LIBADD/LDADD
                       to better support compilation with `-Wl,--as-needed`
              1412  CMake: Support repeated `find_package` calls
              1413  lib: Address warning `XML_GE is not defined [-Werror=3Dund=
   ef]`
              1415  lib: Stop delaying `callStoreEntityValue` error handling
              1415  lib: Add missing call to `poolDiscard`
              1437  lib: Add missing `NULL` check for `m_startDoctypeDeclHandl=
   er`
              1417  lib: Migrate `ENTITY.textLen` and `ENTITY.processed` from
                            `int` to `size_t`
              1463  lib: Fix integer truncation in `XmlGetAttributes`/`getAtts=
   `
              1420  lib: Some more `XML_Bool` to `bool` migration
        1449 1460  lib: Document the memory reuse black magic that function
                       `storeAtts` is doing
              1453  lib: Document failure to reject bad redefinitions of
                       predefined entities
              1432  tests: Replace `XML_SetHashSalt` with
                       `XML_SetHashSalt16Bytes`
        1416 1435  Version info bumped from 14:0:13 (libexpat*.so.1.13.0)
                       to 14:1:13 (libexpat*.so.1.13.1); see https://verbump.d=
   e/
                       for what these numbers do


To generate a diff of this commit:
cvs rdiff -u -r1.68.2.2 -r1.68.2.3 pkgsrc/textproc/expat/Makefile
cvs rdiff -u -r1.62.2.2 -r1.62.2.3 pkgsrc/textproc/expat/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/textproc/expat/Makefile
diff -u pkgsrc/textproc/expat/Makefile:1.68.2.2 pkgsrc/textproc/expat/Makefile:1.68.2.3
--- pkgsrc/textproc/expat/Makefile:1.68.2.2     Tue Oct 20 23:51:14 2026
+++ pkgsrc/textproc/expat/Makefile      Sat Nov  7 17:11:38 2026
@@ -1,6 +1,6 @@
-# $NetBSD: Makefile,v 1.68.2.2 2026/10/20 23:51:14 maya Exp $
+# $NetBSD: Makefile,v 1.68.2.3 2026/11/07 17:11:38 maya Exp $
 
-DISTNAME=      expat-2.9.0
+DISTNAME=      expat-2.10.0
 CATEGORIES=    textproc
 MASTER_SITES=  ${MASTER_SITE_GITHUB:=libexpat/}
 GITHUB_PROJECT=        libexpat

Index: pkgsrc/textproc/expat/distinfo
diff -u pkgsrc/textproc/expat/distinfo:1.62.2.2 pkgsrc/textproc/expat/distinfo:1.62.2.3
--- pkgsrc/textproc/expat/distinfo:1.62.2.2     Tue Oct 20 23:51:14 2026
+++ pkgsrc/textproc/expat/distinfo      Sat Nov  7 17:11:38 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.62.2.2 2026/10/20 23:51:14 maya Exp $
+$NetBSD: distinfo,v 1.62.2.3 2026/11/07 17:11:38 maya Exp $
 
-BLAKE2s (expat-2.9.0.tar.gz) = 4aa81ba1e91a74cea7383810b26a194d3f85083fac3c60eb210f545702c26f6c
-SHA512 (expat-2.9.0.tar.gz) = 8874a1904fdbeeb657a64fbcf6e9159d70d238672046592b5e89c18cc7d09c093d411f447d41d54c45d98c7ae8b46616747708e9e94ae07d57363dbf0c5df657
-Size (expat-2.9.0.tar.gz) = 847314 bytes
+BLAKE2s (expat-2.10.0.tar.gz) = 3f0fad7f2d831e4320e04b80807b24bb654ab5d95bcd913ff96546ad4fa9e472
+SHA512 (expat-2.10.0.tar.gz) = 34c97db9c885371c0d2e7b7f2d99ff8bf700f50927d1029335e6c6f2b71d990f30aab80b178def683a5d5901d0c2ef49ea9156414f918f0f8c5c904f2cb0bdc1
+Size (expat-2.10.0.tar.gz) = 860532 bytes