download.lst                                                      |    4 
 external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 |   64 ++++++
 external/libxml2/UnpackedTarball_libxml2.mk                       |    1 
 external/libxslt/UnpackedTarball_libxslt.mk                       |    1 
 external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1           |   99 
++++++++++
 include/sfx2/childwin.hxx                                         |    4 
 officecfg/registry/schema/org/openoffice/Office/Writer.xcs        |    7 
 sc/source/filter/oox/worksheethelper.cxx                          |   16 +
 sfx2/source/appl/childwin.cxx                                     |    4 
 sw/CppunitTest_sw_unowriter.mk                                    |    4 
 sw/qa/extras/unowriter/unowriter.cxx                              |   14 +
 sw/qa/uitest/ui/frmdlg/frmdlg.py                                  |    3 
 sw/source/core/frmedt/fecopy.cxx                                  |   27 +-
 sw/source/core/text/txttab.cxx                                    |    5 
 sw/source/uibase/lingu/olmenu.cxx                                 |   14 -
 15 files changed, 231 insertions(+), 36 deletions(-)

New commits:
commit d508437ad2f963483dff27db2df5259cb4475e98
Author:     Michael Stahl <michael.st...@collabora.com>
AuthorDate: Mon Aug 11 17:20:52 2025 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:39:30 2025 +0200

    sw: prevent negative width SwTabLeftPortion
    
    This will eventually assert in SwTabPortion::Paint():
    
      sal/rtl/strtmpl.hxx:801: void rtl::str::new_WithLength(rtl_tString**, 
sal_Int32): Assertion `nLen >= 0' failed.
    
    Also move a comment from its current misleading position (this one is
    using TAB_OVER_SPACING).
    
    Change-Id: I0a8b347f7467fcd7176b75a5a7e5e672ad5e13d9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189382
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Miklos Vajna <vmik...@collabora.com>

diff --git a/sw/source/core/text/txttab.cxx b/sw/source/core/text/txttab.cxx
index 14d8b9072693..8511571ac753 100644
--- a/sw/source/core/text/txttab.cxx
+++ b/sw/source/core/text/txttab.cxx
@@ -424,12 +424,11 @@ bool SwTabPortion::PreFormat(SwTextFormatInfo &rInf, 
SwTabPortion const*const pL
             }
             case PortionType::TabLeft:
             {
-                // handle this case in PostFormat
                 if ((bTabOverMargin || bTabOverSpacing) && GetTabPos() > 
rInf.Width()
                     && (!m_bAutoTabStop || rInf.Width() <= rInf.X()))
                 {
                     if (bTabOverMargin || GetTabPos() < nTextFrameWidth)
-                    {
+                    {   // handle this case in PostFormat
                         rInf.SetLastTab(this);
                         break;
                     }
@@ -471,7 +470,7 @@ bool SwTabPortion::PreFormat(SwTextFormatInfo &rInf, 
SwTabPortion const*const pL
             // line if there is a fly reducing the line width:
             !rInf.GetFly() )
         {
-            PrtWidth(rInf.Width() - rInf.X());
+            PrtWidth(std::max(SwTwips{0}, rInf.Width() - rInf.X()));
             SetFixWidth( PrtWidth() );
         }
         else
commit a21d21d5571d4a55dd6008f41ebbfb0135939680
Author:     Michael Stahl <michael.st...@collabora.com>
AuthorDate: Wed Aug 6 18:04:50 2025 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:39:30 2025 +0200

    sfx2: fix mysterious -Werror=shadow
    
    GCC 14 now mysteriously finds a -Wshadow here but not in the many other
    SfxChildWindow subclass member functions that have a parameter named
    "pParent":
    
      sw/source/uibase/sidebar/QuickFindPanel.cxx: In constructor 
‘sw::sidebar::QuickFindPanelWrapper::QuickFindPanelWrapper(vcl::Window*, 
sal_uInt16, SfxBindings*, SfxChildWinInfo*)’:
      sw/source/uibase/sidebar/QuickFindPanel.cxx:115:59: error: declaration of 
‘pParent’ shadows a member of ‘sw::sidebar::QuickFindPanelWrapper’ 
[-Werror=shadow]
      115 | QuickFindPanelWrapper::QuickFindPanelWrapper(vcl::Window* pParent, 
sal_uInt16 nId,
          |                                              ~~~~~~~~~~~~~^~~~~~~
      In file included from include/sfx2/quickfind.hxx:13,
                     from sw/source/uibase/inc/QuickFindPanel.hxx:13,
                     from sw/source/uibase/sidebar/QuickFindPanel.cxx:11:
      include/sfx2/childwin.hxx:102:32: note: shadowed declaration is here
      102 |     VclPtr<vcl::Window>        pParent;         // parent window ( 
Topwindow )
          |                                ^~~~~~~
    
    Change-Id: I98228f312308ee69a17af34bb31a5d4109b06ad9
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189017
    Reviewed-by: Stephan Bergmann <stephan.bergm...@collabora.com>
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>

diff --git a/include/sfx2/childwin.hxx b/include/sfx2/childwin.hxx
index 216b101923d4..464016e2770e 100644
--- a/include/sfx2/childwin.hxx
+++ b/include/sfx2/childwin.hxx
@@ -99,7 +99,7 @@ extern SFX2_DLLPUBLIC bool ParentIsFloatingWindow(const 
vcl::Window *pParent);
 
 class SFX2_DLLPUBLIC SfxChildWindow
 {
-    VclPtr<vcl::Window>        pParent;         // parent window ( Topwindow )
+    VclPtr<vcl::Window>        m_pParent;       // parent window (Topwindow)
     VclPtr<vcl::Window>        pWindow;         // actual contents
     std::unique_ptr< SfxChildWindow_Impl>       pImpl;            // 
Implementation data
     std::shared_ptr<SfxDialogController> xController;     // actual contents
@@ -122,7 +122,7 @@ public:
     std::shared_ptr<SfxDialogController>& GetController() { return 
xController; }
     const std::shared_ptr<SfxDialogController>& GetController() const { return 
xController; }
     vcl::Window*        GetParent() const
-                        { return pParent; }
+                        { return m_pParent; }
     SfxChildAlignment   GetAlignment() const
                         { return eChildAlignment; }
     void                SetAlignment(SfxChildAlignment eAlign);
diff --git a/sfx2/source/appl/childwin.cxx b/sfx2/source/appl/childwin.cxx
index 24b114a706b3..14c04f2b05e6 100644
--- a/sfx2/source/appl/childwin.cxx
+++ b/sfx2/source/appl/childwin.cxx
@@ -143,8 +143,8 @@ bool GetSplitSizeFromString( std::u16string_view rStr, 
Size& rSize )
     return false;
 }
 
-SfxChildWindow::SfxChildWindow(vcl::Window *pParentWindow, sal_uInt16 nId)
-    : pParent(pParentWindow)
+SfxChildWindow::SfxChildWindow(vcl::Window *const pParent, sal_uInt16 nId)
+    : m_pParent(pParent)
     , pImpl(new SfxChildWindow_Impl)
     , eChildAlignment(SfxChildAlignment::NOALIGNMENT)
     , nType(nId)
commit ab35ad20beb7b27948dfe52747bdab531ce75fc2
Author:     Michael Stahl <michael.st...@collabora.com>
AuthorDate: Wed Aug 6 12:59:26 2025 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:39:30 2025 +0200

    tdf#167833 sw: if an anchored object is pasted, don't select it
    
    Instead, leave the cursor in the text at the paste location, like
    (reportedly) some version of Word does.
    
    This can be configured with the new
    Office::Writer::Cursor::Option::SelectPastedAnchoredObject
    
    Change-Id: Id1ddeb0e17c5cd568100d5a8169d929487d16749
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189001
    Reviewed-by: Michael Stahl <michael.st...@collabora.com>
    Tested-by: Jenkins
    (cherry picked from commit 6204dfeb53aefbc4de1c82a6bfc2f6903565f5c1)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189014
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>

diff --git a/officecfg/registry/schema/org/openoffice/Office/Writer.xcs 
b/officecfg/registry/schema/org/openoffice/Office/Writer.xcs
index fa70c5444328..0f8adc306c13 100644
--- a/officecfg/registry/schema/org/openoffice/Office/Writer.xcs
+++ b/officecfg/registry/schema/org/openoffice/Office/Writer.xcs
@@ -2158,6 +2158,13 @@
           </info>
           <value>false</value>
         </prop>
+        <prop oor:name="SelectPastedAnchoredObject" oor:type="xs:boolean" 
oor:nillable="false">
+          <info>
+            <desc>Specifies if pasted anchored objects will be selected; 
otherwise, the text cursor will remain at the location of the paste.</desc>
+            <label>Select pasted anchored objects</label>
+          </info>
+          <value>false</value>
+        </prop>
       </group>
     </group>
     <group oor:name="FmtAidsAutocomplete">
diff --git a/sw/CppunitTest_sw_unowriter.mk b/sw/CppunitTest_sw_unowriter.mk
index 9ed2a7522ec6..6be1fb825361 100644
--- a/sw/CppunitTest_sw_unowriter.mk
+++ b/sw/CppunitTest_sw_unowriter.mk
@@ -65,6 +65,10 @@ $(eval $(call gb_CppunitTest_use_vcl,sw_unowriter))
 
 $(eval $(call gb_CppunitTest_use_rdb,sw_unowriter,services))
 
+$(eval $(call gb_CppunitTest_use_custom_headers,sw_unowriter,\
+    officecfg/registry \
+))
+
 $(eval $(call gb_CppunitTest_use_configuration,sw_unowriter))
 
 $(eval $(call gb_CppunitTest_use_uiconfigs,sw_unowriter, \
diff --git a/sw/qa/extras/unowriter/unowriter.cxx 
b/sw/qa/extras/unowriter/unowriter.cxx
index 186e613cbc9b..07431f880876 100644
--- a/sw/qa/extras/unowriter/unowriter.cxx
+++ b/sw/qa/extras/unowriter/unowriter.cxx
@@ -39,7 +39,10 @@
 #include <com/sun/star/text/XTextTable.hpp>
 #include <com/sun/star/text/XPageCursor.hpp>
 
+#include <officecfg/Office/Writer.hxx>
+
 #include <comphelper/propertyvalue.hxx>
+#include <comphelper/scopeguard.hxx>
 #include <tools/UnitConversion.hxx>
 #include <toolkit/helper/vclunohelper.hxx>
 #include <vcl/graphicfilter.hxx>
@@ -970,6 +973,17 @@ CPPUNIT_TEST_FIXTURE(SwUnoWriter, 
testRenderablePagePosition)
 
 CPPUNIT_TEST_FIXTURE(SwUnoWriter, testPasteListener)
 {
+    comphelper::ScopeGuard g([]() {
+        std::shared_ptr<comphelper::ConfigurationChanges> pBatch(
+            comphelper::ConfigurationChanges::create());
+        
officecfg::Office::Writer::Cursor::Option::SelectPastedAnchoredObject::set(false,
 pBatch);
+        return pBatch->commit();
+    });
+    std::shared_ptr<comphelper::ConfigurationChanges> pBatch(
+        comphelper::ConfigurationChanges::create());
+    
officecfg::Office::Writer::Cursor::Option::SelectPastedAnchoredObject::set(true,
 pBatch);
+    pBatch->commit();
+
     createSwDoc();
 
     // Insert initial string.
diff --git a/sw/qa/uitest/ui/frmdlg/frmdlg.py b/sw/qa/uitest/ui/frmdlg/frmdlg.py
index a37062c1d392..c08b662027a6 100644
--- a/sw/qa/uitest/ui/frmdlg/frmdlg.py
+++ b/sw/qa/uitest/ui/frmdlg/frmdlg.py
@@ -116,7 +116,8 @@ class Test(UITestCase):
             self.assertTrue(to_char_enabled)
 
     def test_floattable_in_shape_text(self):
-        with 
self.ui_test.load_file(get_url_for_data_file("floattable-in-shape-text.docx")) 
as xComponent:
+        with 
self.ui_test.set_config('/org.openoffice.Office.Writer/Cursor/Option/SelectPastedAnchoredObject',
 True):
+          with 
self.ui_test.load_file(get_url_for_data_file("floattable-in-shape-text.docx")) 
as xComponent:
             # Given a table in a frame, anchored in shape text (TextBox case):
             self.xUITest.executeCommand(".uno:SelectAll")
             # Insert frame around the selected table:
diff --git a/sw/source/core/frmedt/fecopy.cxx b/sw/source/core/frmedt/fecopy.cxx
index 4e6ee39aa20d..956efcc9b33c 100644
--- a/sw/source/core/frmedt/fecopy.cxx
+++ b/sw/source/core/frmedt/fecopy.cxx
@@ -20,6 +20,7 @@
 #include <memory>
 #include <hintids.hxx>
 
+#include <officecfg/Office/Writer.hxx>
 #include <vcl/graph.hxx>
 #include <sot/formats.hxx>
 #include <svx/xfillit0.hxx>
@@ -801,7 +802,8 @@ namespace {
         return pNew;
     }
 
-    void lcl_SelectFlyFormat(SwFrameFormat *const pNew, SwFEShell& rSh)
+    void lcl_InitSelectFlyOrDrawFormat(SwFrameFormat *const pNew,
+            SwFEShell & rSh, bool const isSelect)
     {
         if(!pNew)
             return;
@@ -810,21 +812,27 @@ namespace {
             case RES_FLYFRMFMT:
             {
                 assert(dynamic_cast<SwFlyFrameFormat*>(pNew));
-                const Point aPt(rSh.GetCursorDocPos());
-                SwFlyFrame* pFlyFrame = 
static_cast<SwFlyFrameFormat*>(pNew)->GetFrame(&aPt);
-                if(pFlyFrame)
-                    rSh.SelectFlyFrame(*pFlyFrame);
+                if (isSelect)
+                {
+                    const Point aPt(rSh.GetCursorDocPos());
+                    SwFlyFrame* pFlyFrame = 
static_cast<SwFlyFrameFormat*>(pNew)->GetFrame(&aPt);
+                    if (pFlyFrame)
+                        rSh.SelectFlyFrame(*pFlyFrame);
+                }
                 break;
             }
             case RES_DRAWFRMFMT:
             {
-                auto& rDrawView = *rSh.Imp()->GetDrawView();
                 assert(dynamic_cast<SwDrawFrameFormat*>(pNew));
                 SwDrawFrameFormat* pDrawFormat = 
static_cast<SwDrawFrameFormat*>(pNew);
                 // #i52780# - drawing object has to be made visible on paste.
                 
pDrawFormat->CallSwClientNotify(sw::DrawFrameFormatHint(sw::DrawFrameFormatHintId::PREPPASTING));
-                SdrObject* pObj = pDrawFormat->FindSdrObject();
-                rDrawView.MarkObj(pObj, rDrawView.GetSdrPageView());
+                if (isSelect)
+                {
+                    auto& rDrawView = *rSh.Imp()->GetDrawView();
+                    SdrObject* pObj = pDrawFormat->FindSdrObject();
+                    rDrawView.MarkObj(pObj, rDrawView.GetSdrPageView());
+                }
                 // #i47455# - notify draw frame format
                 // that position attributes are already set.
                 pDrawFormat->PosAttrSet();
@@ -1063,9 +1071,10 @@ bool SwFEShell::Paste(SwDoc& rClpDoc, bool bNestedTable)
                             lcl_PasteFlyOrDrawFormat(rPaM, pFlyFormat, *this));
                     }
                 }
+                bool const 
isSelect{officecfg::Office::Writer::Cursor::Option::SelectPastedAnchoredObject::get()};
                 for (auto const pFlyFormat : inserted)
                 {
-                    lcl_SelectFlyFormat(pFlyFormat, *this);
+                    lcl_InitSelectFlyOrDrawFormat(pFlyFormat, *this, isSelect);
                 }
             }
             else
commit 1960e27c10caafa0d397c716e88fe6f43e88b101
Author:     Michael Stahl <michael.st...@collabora.com>
AuthorDate: Thu Aug 7 16:50:26 2025 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:39:30 2025 +0200

    libxslt: add patch for CVE-2025-7424
    
    See https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
    
    Change-Id: I68f01dcb6b540ddf3d2e74927ec21c0ca4fc865f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189105
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>

diff --git a/external/libxslt/UnpackedTarball_libxslt.mk 
b/external/libxslt/UnpackedTarball_libxslt.mk
index edfb266f2f17..06519e74ae4b 100644
--- a/external/libxslt/UnpackedTarball_libxslt.mk
+++ b/external/libxslt/UnpackedTarball_libxslt.mk
@@ -20,6 +20,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxslt,\
                external/libxslt/libxslt-msvc-sym.patch.2, \
                external/libxslt/libxslt-msvc.patch.2) \
        external/libxslt/rpath.patch.0 \
+       external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 
b/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1
new file mode 100644
index 000000000000..62a34fa61d39
--- /dev/null
+++ b/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1
@@ -0,0 +1,99 @@
+From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
+From: David Kilzer <ddkil...@apple.com>
+Date: Sat, 24 May 2025 15:06:42 -0700
+Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
+ and source nodes
+
+* libxslt/functions.c:
+(xsltDocumentFunctionLoadDocument):
+- Implement fix suggested by Ivan Fratric.  This copies the xmlDoc,
+  calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
+  xmlDoc to tctxt->docList.
+- Add error handling for functions that may return NULL.
+* libxslt/transform.c:
+- Remove static keyword so this can be called from
+  xsltDocumentFunctionLoadDocument().
+* libxslt/transformInternals.h: Add.
+(xsltCleanupSourceDoc): Add declaration.
+
+Fixes #139.
+---
+ libxslt/functions.c          | 16 +++++++++++++++-
+ libxslt/transform.c          |  3 ++-
+ libxslt/transformInternals.h |  9 +++++++++
+ 3 files changed, 26 insertions(+), 2 deletions(-)
+ create mode 100644 libxslt/transformInternals.h
+
+diff --git a/libxslt/functions.c b/libxslt/functions.c
+index 72a58dc4..11ec039f 100644
+--- a/libxslt/functions.c
++++ b/libxslt/functions.c
+@@ -34,6 +34,7 @@
+ #include "numbersInternals.h"
+ #include "keys.h"
+ #include "documents.h"
++#include "transformInternals.h"
+ 
+ #ifdef WITH_XSLT_DEBUG
+ #define WITH_XSLT_DEBUG_FUNCTION
+@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr 
ctxt,
+           /*
+           * This selects the stylesheet's doc itself.
+           */
+-          doc = tctxt->style->doc;
++          doc = xmlCopyDoc(tctxt->style->doc, 1);
++          if (doc == NULL) {
++              xsltTransformError(tctxt, NULL, NULL,
++                  "document() : failed to copy style doc
");
++              goto out_fragment;
++          }
++          xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
++          idoc = xsltNewDocument(tctxt, doc);
++          if (idoc == NULL) {
++              xsltTransformError(tctxt, NULL, NULL,
++                  "document() : failed to create xsltDocument
");
++              xmlFreeDoc(doc);
++              goto out_fragment;
++          }
+       } else {
+             goto out_fragment;
+       }
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 54ef821b..38c2dce6 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -43,6 +43,7 @@
+ #include "xsltlocale.h"
+ #include "pattern.h"
+ #include "transform.h"
++#include "transformInternals.h"
+ #include "variables.h"
+ #include "numbersInternals.h"
+ #include "namespaces.h"
+@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
+  *
+  * Resets source node flags and ids stored in 'psvi' member.
+  */
+-static void
++void
+ xsltCleanupSourceDoc(xmlDocPtr doc) {
+     xmlNodePtr cur = (xmlNodePtr) doc;
+     void **psviPtr;
+diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
+new file mode 100644
+index 00000000..d0f42823
+--- /dev/null
++++ b/libxslt/transformInternals.h
+@@ -0,0 +1,9 @@
++/*
++ * Summary: set of internal interfaces for the XSLT engine transformation 
part.
++ *
++ * Copy: See Copyright for the status of this software.
++ *
++ * Author: David Kilzer <ddkil...@apple.com>
++ */
++
++void xsltCleanupSourceDoc(xmlDocPtr doc);
+-- 
+2.39.5 (Apple Git-154)
+
commit 6bd0eb1e5fc862c62ebca8e8b49d141bb83b5c77
Author:     Michael Stahl <michael.st...@collabora.com>
AuthorDate: Thu Aug 7 16:28:20 2025 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:39:30 2025 +0200

    libxml2: add upstream patch for CVE-2025-7425
    
    Change-Id: I84110fc1ed54eac4a0ce4d8b8070a031c761fb39
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189104
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 
b/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
new file mode 100644
index 000000000000..5984d25e957d
--- /dev/null
+++ b/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
@@ -0,0 +1,64 @@
+From 9de92ed78d8495527c5d7a4d0cc76c1f83768195 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <wellnho...@aevum.de>
+Date: Tue, 5 Aug 2025 22:26:27 +0200
+Subject: [PATCH] tree: Guard against atype corruption
+
+Always remove ids if `id` member is set.
+
+Untested, but this should fix CVE-2025-7425 reported against libxslt:
+
+https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
+---
+ tree.c  | 8 ++++----
+ valid.c | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tree.c b/tree.c
+index 2e8df00b8..ddb8bdb3b 100644
+--- a/tree.c
++++ b/tree.c
+@@ -1892,8 +1892,8 @@ xmlFreeProp(xmlAttrPtr cur) {
+       xmlDeregisterNodeDefaultValue((xmlNodePtr)cur);
+ 
+     /* Check for ID removal -> leading to invalid references ! */
+-    if ((cur->doc != NULL) && (cur->atype == XML_ATTRIBUTE_ID)) {
+-          xmlRemoveID(cur->doc, cur);
++    if (cur->doc != NULL && cur->id != NULL) {
++        xmlRemoveID(cur->doc, cur);
+     }
+     if (cur->children != NULL) xmlFreeNodeList(cur->children);
+     DICT_FREE(cur->name)
+@@ -2736,7 +2736,7 @@ xmlNodeSetDoc(xmlNodePtr node, xmlDocPtr doc) {
+              * TODO: ID attributes should also be added to the new
+              * document, but it's not clear how to handle clashes.
+              */
+-            if (attr->atype == XML_ATTRIBUTE_ID)
++            if (attr->id != NULL)
+                 xmlRemoveID(oldDoc, attr);
+ 
+             break;
+@@ -6919,7 +6919,7 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar 
*name,
+                 return(NULL);
+         }
+ 
+-      if (prop->atype == XML_ATTRIBUTE_ID) {
++      if (prop->id != NULL) {
+           xmlRemoveID(node->doc, prop);
+           prop->atype = XML_ATTRIBUTE_ID;
+       }
+diff --git a/valid.c b/valid.c
+index 34b6757cb..e625f0c1b 100644
+--- a/valid.c
++++ b/valid.c
+@@ -4296,7 +4296,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr 
doc,
+              attr->name, elem->name, NULL);
+       return(0);
+     }
+-    if (attr->atype == XML_ATTRIBUTE_ID)
++    if (attr->id != NULL)
+         xmlRemoveID(doc, attr);
+     attr->atype = attrDecl->atype;
+ 
+-- 
+GitLab
+
diff --git a/external/libxml2/UnpackedTarball_libxml2.mk 
b/external/libxml2/UnpackedTarball_libxml2.mk
index 223577f7c037..593556dbc532 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -23,6 +23,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
        $(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
                external/libxml2/libxml2-icu-sym.patch.0, \
                external/libxml2/libxml2-icu.patch.0) \
+       external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 \
 ))
 
 $(eval $(call 
gb_UnpackedTarball_add_file,libxml2,xml2-config.in,external/libxml2/xml2-config.in))
commit 067d1a243df614ef9c001cc55834cab51c34ffe6
Author:     Xisco Fauli <xiscofa...@libreoffice.org>
AuthorDate: Tue Jul 15 16:37:01 2025 +0200
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:39:30 2025 +0200

    libxml2: upgrade to 2.14.5
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.14/libxml2-2.14.5.tar.xz
    
    Change-Id: I4e2e3f19479ae3c28801f0aa92adf918d633b6d5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187923
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <xiscofa...@libreoffice.org>
    (cherry picked from commit 79034b63b142b3f8bcc5d13ab4a16c0e9c42587a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189103
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Michael Stahl <michael.st...@collabora.com>

diff --git a/download.lst b/download.lst
index 8581d87d94fc..53c74be88c08 100644
--- a/download.lst
+++ b/download.lst
@@ -527,8 +527,8 @@ XMLSEC_TARBALL := xmlsec1-1.3.6.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
24175ec30a97cfa86bdf9befb7ccf4613f8f4b2713c5103e0dd0bc9c711a2773
-LIBXML_VERSION_MICRO := 4
+LIBXML_SHA256SUM := 
03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b
+LIBXML_VERSION_MICRO := 5
 LIBXML_TARBALL := libxml2-2.14.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 4aa5ad5234bf8f74439fca80ce8a98139c98b721
Author:     Rashesh Padia <rashesh.pa...@collabora.com>
AuthorDate: Mon Aug 11 16:00:59 2025 +0530
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:33:35 2025 +0200

    sw: lokit: enable standard.dic
    
    - always have option to add words to standard.dic
    - it would make things easier for user if they haven't uploaded the
    custom dictionaries.
    
    Change-Id: Id1eb1936e57fc77756cfa87b983fb506dd83e63e
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189359
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Caolán McNamara <caolan.mcnam...@collabora.com>

diff --git a/sw/source/uibase/lingu/olmenu.cxx 
b/sw/source/uibase/lingu/olmenu.cxx
index 7e9aed2e04bd..1bb4dbdd07a3 100644
--- a/sw/source/uibase/lingu/olmenu.cxx
+++ b/sw/source/uibase/lingu/olmenu.cxx
@@ -320,7 +320,7 @@ SwSpellPopup::SwSpellPopup(
         // words could be added.
         uno::Reference< linguistic2::XDictionary >  xDic( 
LinguMgr::GetStandardDic() );
         if (xDic.is())
-            xDic->setActive(!comphelper::LibreOfficeKit::isActive());
+            xDic->setActive(true);
 
         m_aDics = xDicList->getDictionaries();
 
@@ -363,16 +363,8 @@ SwSpellPopup::SwSpellPopup(
     }
 
     sal_uInt16 nDiff = nItemId - MN_DICTIONARIES_START;
-    if (comphelper::LibreOfficeKit::isActive())
-    {
-        m_xPopupMenu->EnableItem(m_nAddMenuId, nDiff > 2);
-        m_xPopupMenu->EnableItem(m_nAddId, nDiff == 2);
-    }
-    else
-    {
-        m_xPopupMenu->EnableItem(m_nAddMenuId, nDiff > 1);
-        m_xPopupMenu->EnableItem(m_nAddId, nDiff == 1);
-    }
+    m_xPopupMenu->EnableItem(m_nAddMenuId, nDiff > 1);
+    m_xPopupMenu->EnableItem(m_nAddId, nDiff == 1);
 
     //ADD NEW LANGUAGE MENU ITEM
 
commit c3a1ea2626a02e49662b042d799bd82e0b50f81e
Author:     Caolán McNamara <caolan.mcnam...@collabora.com>
AuthorDate: Sun Aug 17 20:24:14 2025 +0100
Commit:     Andras Timar <andras.ti...@collabora.com>
CommitDate: Wed Aug 20 06:31:07 2025 +0200

    null deref of StyleSheetPool seen
    
     #0  0x00007fca2fa09df2 in std::__shared_ptr<svl::IndexedStyleSheets, 
(__gnu_cxx::_Lock_policy)2>::get (this=<optimized out>)
         at 
/opt/rh/devtoolset-12/root/usr/include/c++/12/bits/shared_ptr_base.h:1665
     #1  std::__shared_ptr_access<svl::IndexedStyleSheets, 
(__gnu_cxx::_Lock_policy)2, false, false>::_M_get (this=<optimized out>)
         at 
/opt/rh/devtoolset-12/root/usr/include/c++/12/bits/shared_ptr_base.h:1363
     #2  std::__shared_ptr_access<svl::IndexedStyleSheets, 
(__gnu_cxx::_Lock_policy)2, false, false>::operator-> (
         this=<optimized out>) at 
/opt/rh/devtoolset-12/root/usr/include/c++/12/bits/shared_ptr_base.h:1357
     #3  SfxStyleSheetIterator::Find(rtl::OUString const&) () at 
svl/source/items/style.cxx:525
     #4  0x00007fca2fa0b406 in SfxStyleSheetBasePool::Find(rtl::OUString 
const&, SfxStyleFamily, SfxStyleSearchBits) [clone .localalias] () at 
svl/source/items/style.cxx:722
     #5  0x00007fca1f228c76 in oox::xls::CellStyle::createCellStyle() ()
         at include/unotools/resmgr.hxx:41
     #6  0x00007fca1f229c11 in oox::xls::CellStyleBuffer::createCellStyle (
         rxCellStyle=std::shared_ptr<oox::xls::CellStyle> (use count 3, weak 
count 0) = {...})
         at sc/source/filter/oox/stylesbuffer.cxx:2804
     #7  oox::xls::CellStyleBuffer::getDefaultStyleName (this=0x3c4ea458)
         at sc/source/filter/oox/stylesbuffer.cxx:2759
     #8  oox::xls::StylesBuffer::getDefaultStyleName (this=0x3c4ea350)
         at sc/source/filter/oox/stylesbuffer.cxx:3008
     #9  0x00007fca1f26c762 in 
oox::xls::WorksheetGlobals::initializeWorksheetImport() ()
         at sc/source/filter/oox/worksheethelper.cxx:923
     #10 0x00007fca1f26c7dd in 
oox::xls::WorksheetHelper::initializeWorksheetImport 
(this=this@entry=0x3c594168)
         at sc/source/filter/oox/worksheethelper.cxx:1614
     #11 0x00007fca1f262e34 in oox::xls::WorksheetFragment::initializeImport() 
()
        at sc/source/filter/oox/worksheetfragment.cxx:616
    
    Change-Id: I5bc25e361da17b811af4e552ca74b4becf0181ca
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189831
    Tested-by: Jenkins CollaboraOffice <jenkinscollaboraoff...@gmail.com>
    Reviewed-by: Mike Kaganski <mike.kagan...@collabora.com>

diff --git a/sc/source/filter/oox/worksheethelper.cxx 
b/sc/source/filter/oox/worksheethelper.cxx
index fe9dd4e9320d..6fd9bc5750ea 100644
--- a/sc/source/filter/oox/worksheethelper.cxx
+++ b/sc/source/filter/oox/worksheethelper.cxx
@@ -920,12 +920,16 @@ void WorksheetGlobals::initializeWorksheetImport()
     // set default cell style for unused cells
     ScDocumentImport& rDoc = getDocImport();
 
-    ScStyleSheet* pStyleSheet =
-        static_cast<ScStyleSheet*>(rDoc.getDoc().GetStyleSheetPool()->Find(
-            getStyles().getDefaultStyleName(), SfxStyleFamily::Para));
-
-    if (pStyleSheet)
-        rDoc.setCellStyleToSheet(getSheetIndex(), *pStyleSheet);
+    ScStyleSheetPool* pStylePool = rDoc.getDoc().GetStyleSheetPool();
+    SAL_WARN_IF(!pStylePool, "sc.filter", "Unusual lack of style pool");
+    if (pStylePool)
+    {
+        ScStyleSheet* pStyleSheet =
+            static_cast<ScStyleSheet*>(pStylePool->Find(
+                getStyles().getDefaultStyleName(), SfxStyleFamily::Para));
+        if (pStyleSheet)
+            rDoc.setCellStyleToSheet(getSheetIndex(), *pStyleSheet);
+    }
 
     /*  Remember the current sheet index in global data, needed by global
         objects, e.g. the chart converter. */

Reply via email to