Hello, this email is a notification from the Auto Upgrade Helper that the automatic attempt to upgrade the recipe(s) *expat* to *2.9.0* has Succeeded.
Next steps:
- apply the patch: git am 0001-expat-upgrade-2.8.5-2.9.0.patch
- check the changes to upstream patches and summarize them in the commit
message,
- compile an image that contains the package
- perform some basic sanity tests
- amend the patch and sign it off: git commit -s --reset-author --amend
- send it to the appropriate mailing list
Alternatively, if you believe the recipe should not be upgraded at this time,
you can fill RECIPE_NO_UPDATE_REASON in respective recipe file so that
automatic upgrades would no longer be attempted.
Please review the attached files for further information and build/update
failures.
Any problem please file a bug at
https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Automated%20Update%20Handler
Regards,
The Upgrade Helper
-- >8 --
From 8e52a65b8e817312917432f6b8e0b30a51926f17 Mon Sep 17 00:00:00 2001
From: Upgrade Helper <[email protected]>
Date: Tue, 6 Oct 2026 05:32:19 +0000
Subject: [PATCH] expat: upgrade 2.8.5 -> 2.9.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
///////////////////////////////////////////////////////////////////////////////
// <blink>Expat has UNFIXED SECURITY ISSUES!</blink> //
// Please see for details. //
// //
// Starting 2026-08-01, for up to six months my work maintaining libexpat //
// will be funded by the City of Munich as part of their //
// Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) //
// — thank you! //
// //
// If your business relies on Expat beyond January 2027, please consider //
// funding the maintenance of Expat to ensure its health and security for //
// you and others. Thank you! //
// //
// Sebastian Pipping -- Berlin, 2026-09-22 //
///////////////////////////////////////////////////////////////////////////////
Release 2.9.0 Mon October 5 2026
Security fixes:
#1392 CVE-2026-102633 -- Integer overflow in function
expat_realloc on 32bit platforms
#1393 CVE-2026-77214 -- Validate parameter `len` against available
buffer capacity in XML_ParseBuffer
Bug fixes:
#1387 lib: Handle OOM when copying encodingName in XML_ParserReset
New features:
#1327 lib: Introduce new "Properties API" to get and set
scalar properties for a single parser instance.
There are six new functions:
- XML_GetPropertyBool
- XML_GetPropertyDouble
- XML_GetPropertyUInt64
- XML_SetPropertyBool
- XML_SetPropertyDouble
- XML_SetPropertyUInt64
And two new enums:
- XML_Prop_Error
- XML_Parser_Property
#1323 lib: Introduce five new 64bit location API functions:
- XML_GetCurrentByteCount64
- XML_GetCurrentByteIndex64
- XML_GetCurrentColumnNumber64
- XML_GetCurrentLineNumber64
- XML_GetInputContext64
These five functions closely mirror their predecessors
but are not prone to 32bit integer wrap-around.
Other changes:
#1391 docs: Document the scope of function XML_GetErrorCode
#1395 docs: Document length expectations for XML_ParseBuffer
#1394 lib: Call unknown encoding release before parser teardown
#1370 #1373 lib: Drop (disabled-by-default) attribute info feature
These things are now gone:
- Public function XML_GetAttributeInfo
- Public struct XML_AttrInfo
- Macro XML_ATTR_INFO
These things are now causing build errors:
- Configure option --enable-xml-attr-info
- CMake option -DEXPAT_ATTR_INFO=ON
#1379 #1382 lib: Drop (disabled-by-default) minimum size feature
These things are now gone:
- Macro XML_MIN_SIZE
These things are now causing build errors:
- Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS
- CMake option -DEXPAT_MIN_SIZE=ON
#1323 #1411 lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit
location API functions instead please)
#1323 lib: Deprecate five location API functions that are cursed
with integer wrap-around:
- XML_GetCurrentByteCount
- XML_GetCurrentByteIndex
- XML_GetCurrentColumnNumber
- XML_GetCurrentLineNumber
- XML_GetInputContext
#1399 lib: Guard against out-of-handler use of XML_DefaultCurrent
#1400 lib: Use size_t for bytesAllocated and peakBytesAllocated
#1401 #1402 ..
#1404 #1405 lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp
#1406 xmlwf: Add missing `#include "expat.h"`
#1389 #1396 Version info bumped from 13:5:12 (libexpat*.so.1.12.5)
to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/
for what these numbers do
Infrastructure:
#1386 CI: Bump MinGW Clang from 23.1.1 to 23.1.2
#1410 CI: Bump Fil-C from 0.685 to 0.686
#1388 CI: Adapt to breaking changes regarding windows-11-arm image
#1403 CI: Limit package cache download runtime
Special thanks to:
Bénédikt Tran
Berkay Eren Ürün
[Changelog truncated as it exceeds 5000 characters;
the full changelog can be found in an attachment to the AUH email]
---
meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
rename meta/recipes-core/expat/{expat_2.8.5.bb => expat_2.9.0.bb} (92%)
diff --git a/meta/recipes-core/expat/expat_2.8.5.bb
b/meta/recipes-core/expat/expat_2.9.0.bb
similarity index 92%
rename from meta/recipes-core/expat/expat_2.8.5.bb
rename to meta/recipes-core/expat/expat_2.9.0.bb
index c032e18c77..e9bb21bd55 100644
--- a/meta/recipes-core/expat/expat_2.8.5.bb
+++ b/meta/recipes-core/expat/expat_2.9.0.bb
@@ -15,7 +15,7 @@ SRC_URI =
"${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2 \
GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/";
UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
-SRC_URI[sha256sum] =
"952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454"
+SRC_URI[sha256sum] =
"775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984"
EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
--
2.47.1
0001-expat-upgrade-2.8.5-2.9.0.patch
Description: Binary data
packages/x86-64-v3-poky-linux/expat/expat-dev: FILELIST: directory renamed /usr/lib/cmake/expat-2.8.5 -> /usr/lib/cmake/expat-2.9.0 packages/x86-64-v3-poky-linux/expat/expat: FILELIST: removed "/usr/lib/libexpat.so.1.12.5", added "/usr/lib/libexpat.so.1.13.0" Changes to packages/x86-64-v3-poky-linux/expat (sysroot): /usr/lib/libexpat.so.1 changed symlink target from libexpat.so.1.12.5 to libexpat.so.1.13.0 /usr/lib/cmake/expat-2.8.5 moved to /usr/lib/cmake/expat-2.9.0 /usr/lib/libexpat.so.1.12.5 moved to /usr/lib/libexpat.so.1.13.0 Changes to packages/x86_64-linux/elfutils-native (sysroot): /usr/bin/eu-stackprof was added Changes to packages/x86_64-linux/expat-native (sysroot): /usr/lib/libexpat.so.1 changed symlink target from libexpat.so.1.12.5 to libexpat.so.1.13.0 /usr/lib/cmake/expat-2.8.5 moved to /usr/lib/cmake/expat-2.9.0 /usr/lib/libexpat.so.1.12.5 moved to /usr/lib/libexpat.so.1.13.0
packages/x86-64-v3-poky-linux/expat/expat-bin: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-bin: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat-dbg: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-dbg: FILELIST: removed "/usr/lib/.debug/libexpat.so.1.12.5", added "/usr/lib/.debug/libexpat.so.1.13.0" packages/x86-64-v3-poky-linux/expat/expat-dbg: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat-dbg: PKGSIZE changed from 1849920 to 1907944 (+3%) packages/x86-64-v3-poky-linux/expat/expat-dev: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-dev: FILELIST: directory renamed /usr/lib/cmake/expat-2.8.5 -> /usr/lib/cmake/expat-2.9.0 packages/x86-64-v3-poky-linux/expat/expat-dev: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat-dev: PKGSIZE changed from 68043 to 70270 (+3%) packages/x86-64-v3-poky-linux/expat/expat-doc: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-doc: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat-doc: PKGSIZE changed from 128635 to 131946 (+3%) packages/x86-64-v3-poky-linux/expat/expat-locale: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-locale: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat-ptest: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-ptest: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat-ptest: PKGSIZE changed from 551872 to 576448 (+4%) packages/x86-64-v3-poky-linux/expat/expat-src: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-src: FILELIST: directory renamed /usr/src/debug/expat/2.8.5/xmlwf -> /usr/src/debug/expat/2.9.0/xmlwf, directory renamed /usr/src/debug/expat/2.8.5/tests/benchmark -> /usr/src/debug/expat/2.9.0/tests/benchmark, removed "/usr/src/debug/expat/2.8.5/tests/minicheck.h /usr/src/debug/expat/2.8.5/lib/siphash.h /usr/src/debug/expat/2.8.5/tests/handlers.c /usr/src/debug/expat/2.8.5/lib/xmltok_ns.c /usr/src/debug/expat/2.8.5/tests/minicheck.c /usr/src/debug/expat/2.8.5/tests/acc_tests.h /usr/src/debug/expat/2.8.5/tests/chardata.c /usr/src/debug/expat/2.8.5/tests/nsalloc_tests.c /usr/src/debug/expat/2.8.5/lib/expat.h /usr/src/debug/expat/2.8.5/tests/chardata.h /usr/src/debug/expat/2.8.5/tests/nsalloc_tests.h /usr/src/debug/expat/2.8.5/tests/handlers.h /usr/src/debug/expat/2.8.5/tests/acc_tests.c /usr/src/debug/expat/2.8.5/lib/hash_table.h /usr/src/debug/expat/2.8.5/lib/xmltok_impl.h /usr/src/debug/expat/2.8.5/lib/xmlparse.c /usr/src/debug/expat/2.8.5/t ests/dummy.c /usr/src/debug/expat/2.8.5/lib/nametab.h /usr/src/debug/expat/2.8.5/lib/xmltok_impl.c /usr/src/debug/expat/2.8.5/lib/expat_external.h /usr/src/debug/expat/2.8.5/tests/dummy.h /usr/src/debug/expat/2.8.5/lib/xmlrole.h /usr/src/debug/expat/2.8.5/lib/xmltok.h /usr/src/debug/expat/2.8.5/lib/xmlrole.c /usr/src/debug/expat/2.8.5/tests/alloc_tests.h /usr/src/debug/expat/2.8.5/lib/random_arc4random_buf.h /usr/src/debug/expat/2.8.5/lib/xmltok.c /usr/src/debug/expat/2.8.5/lib/random_getrandom.c /usr/src/debug/expat/2.8.5/tests/structdata.c /usr/src/debug/expat/2.8.5/lib/random_arc4random.c /usr/src/debug/expat/2.8.5/lib/xcsinc.c /usr/src/debug/expat/2.8.5/tests/structdata.h /usr/src/debug/expat/2.8.5/lib/random_getentropy.c /usr/src/debug/expat/2.8.5/tests/hash_tests.c /usr/src/debug/expat/2.8.5/tests/misc_tests.c /usr/src/debug/expat/2.8.5/tests/hash_tests.h /usr/src/debug/expat/2.8.5/tests/misc_tests.h /usr/src/debug/expat/2.8.5/tests/runtests.c /usr/src/debug/expat/2.8.5/tests/ common.c /usr/src/debug/expat/2.8.5/lib/random_arc4random_buf.c /usr/src/debug/expat/2.8.5/tests/alloc_tests.c /usr/src/debug/expat/2.8.5/tests/basic_tests.c /usr/src/debug/expat/2.8.5/tests/memcheck.h /usr/src/debug/expat/2.8.5/tests/ns_tests.c /usr/src/debug/expat/2.8.5/lib/internal.h /usr/src/debug/expat/2.8.5/tests/basic_tests.h /usr/src/debug/expat/2.8.5/tests/common.h /usr/src/debug/expat/2.8.5/tests/ns_tests.h /usr/src/debug/expat/2.8.5/tests/memcheck.c", added "/usr/src/debug/expat/2.9.0/lib/siphash.h /usr/src/debug/expat/2.9.0/tests/minicheck.h /usr/src/debug/expat/2.9.0/tests/props_tests.h /usr/src/debug/expat/2.9.0/lib/xmltok_ns.c /usr/src/debug/expat/2.9.0/tests/minicheck.c /usr/src/debug/expat/2.9.0/lib/random_arc4random_buf.h /usr/src/debug/expat/2.9.0/tests/xcs_tests.h /usr/src/debug/expat/2.9.0/tests/chardata.c /usr/src/debug/expat/2.9.0/tests/nsalloc_tests.c /usr/src/debug/expat/2.9.0/lib/expat.h /usr/src/debug/expat/2.9.0/tests/basic_tests.h /usr/src/debug/expat/2. 9.0/tests/nsalloc_tests.h /usr/src/debug/expat/2.9.0/tests/chardata.h /usr/src/debug/expat/2.9.0/tests/runtests.c /usr/src/debug/expat/2.9.0/lib/hash_table.h /usr/src/debug/expat/2.9.0/lib/xmltok_impl.h /usr/src/debug/expat/2.9.0/lib/xmlparse.c /usr/src/debug/expat/2.9.0/tests/dummy.c /usr/src/debug/expat/2.9.0/lib/random_getentropy.c /usr/src/debug/expat/2.9.0/lib/nametab.h /usr/src/debug/expat/2.9.0/lib/xmltok_impl.c /usr/src/debug/expat/2.9.0/tests/acc_tests.h /usr/src/debug/expat/2.9.0/lib/expat_external.h /usr/src/debug/expat/2.9.0/tests/dummy.h /usr/src/debug/expat/2.9.0/tests/ns_tests.c /usr/src/debug/expat/2.9.0/lib/xmlrole.h /usr/src/debug/expat/2.9.0/lib/xmltok.h /usr/src/debug/expat/2.9.0/tests/handlers.h /usr/src/debug/expat/2.9.0/lib/xmlrole.c /usr/src/debug/expat/2.9.0/lib/xmltok.c /usr/src/debug/expat/2.9.0/lib/random_getrandom.c /usr/src/debug/expat/2.9.0/tests/structdata.c /usr/src/debug/expat/2.9.0/lib/random_arc4random.c /usr/src/debug/expat/2.9.0/tests/acc_tests. c /usr/src/debug/expat/2.9.0/lib/xcs.h /usr/src/debug/expat/2.9.0/tests/ns_tests.h /usr/src/debug/expat/2.9.0/tests/structdata.h /usr/src/debug/expat/2.9.0/lib/xcs.c /usr/src/debug/expat/2.9.0/tests/hash_tests.c /usr/src/debug/expat/2.9.0/tests/misc_tests.c /usr/src/debug/expat/2.9.0/tests/hash_tests.h /usr/src/debug/expat/2.9.0/tests/misc_tests.h /usr/src/debug/expat/2.9.0/tests/common.c /usr/src/debug/expat/2.9.0/lib/random_arc4random_buf.c /usr/src/debug/expat/2.9.0/tests/alloc_tests.c /usr/src/debug/expat/2.9.0/tests/basic_tests.c /usr/src/debug/expat/2.9.0/tests/memcheck.h /usr/src/debug/expat/2.9.0/tests/props_tests.c /usr/src/debug/expat/2.9.0/tests/handlers.c /usr/src/debug/expat/2.9.0/lib/internal.h /usr/src/debug/expat/2.9.0/tests/alloc_tests.h /usr/src/debug/expat/2.9.0/tests/common.h /usr/src/debug/expat/2.9.0/tests/xcs_tests.c /usr/src/debug/expat/2.9.0/tests/memcheck.c" packages/x86-64-v3-poky-linux/expat/expat-src: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat-src: PKGSIZE changed from 1390028 to 1440924 (+4%) packages/x86-64-v3-poky-linux/expat/expat-staticdev: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat-staticdev: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat/expat: FILELIST: removed "/usr/lib/libexpat.so.1.12.5", added "/usr/lib/libexpat.so.1.13.0" packages/x86-64-v3-poky-linux/expat/expat: PV changed from "2.8.5" to "2.9.0" packages/x86-64-v3-poky-linux/expat/expat: PKGSIZE changed from 198642 to 202738 (+2%) packages/x86-64-v3-poky-linux/expat: PKGV changed from 2.8.5 [default] to 2.9.0 [default] packages/x86-64-v3-poky-linux/expat: SRC_URI changed from "https://github.com/libexpat/libexpat/releases//download/R_2_8_5/expat-2.8.5.tar.bz2 file://run-ptest" to "https://github.com/libexpat/libexpat/releases//download/R_2_9_0/expat-2.9.0.tar.bz2 file://run-ptest" packages/x86-64-v3-poky-linux/expat: PV changed from "2.8.5" to "2.9.0" Changes to packages/x86-64-v3-poky-linux/expat (sysroot): /usr/lib/libexpat.so.1 changed symlink target from libexpat.so.1.12.5 to libexpat.so.1.13.0 /usr/lib/cmake/expat-2.8.5 moved to /usr/lib/cmake/expat-2.9.0 /usr/lib/libexpat.so.1.12.5 moved to /usr/lib/libexpat.so.1.13.0 Changes to packages/x86_64-linux/elfutils-native (sysroot): /usr/bin/eu-stackprof was added Changes to packages/x86_64-linux/expat-native (sysroot): /usr/lib/libexpat.so.1 changed symlink target from libexpat.so.1.12.5 to libexpat.so.1.13.0 /usr/lib/cmake/expat-2.8.5 moved to /usr/lib/cmake/expat-2.9.0 /usr/lib/libexpat.so.1.12.5 moved to /usr/lib/libexpat.so.1.13.0
/////////////////////////////////////////////////////////////////////////////// // <blink>Expat has UNFIXED SECURITY ISSUES!</blink> // // Please see for details. // // // // Starting 2026-08-01, for up to six months my work maintaining libexpat // // will be funded by the City of Munich as part of their // // Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) // // — thank you! // // // // If your business relies on Expat beyond January 2027, please consider // // funding the maintenance of Expat to ensure its health and security for // // you and others. Thank you! // // // // Sebastian Pipping -- Berlin, 2026-09-22 // /////////////////////////////////////////////////////////////////////////////// Release 2.9.0 Mon October 5 2026 Security fixes: #1392 CVE-2026-102633 -- Integer overflow in function expat_realloc on 32bit platforms #1393 CVE-2026-77214 -- Validate parameter `len` against available buffer capacity in XML_ParseBuffer Bug fixes: #1387 lib: Handle OOM when copying encodingName in XML_ParserReset New features: #1327 lib: Introduce new "Properties API" to get and set scalar properties for a single parser instance. There are six new functions: - XML_GetPropertyBool - XML_GetPropertyDouble - XML_GetPropertyUInt64 - XML_SetPropertyBool - XML_SetPropertyDouble - XML_SetPropertyUInt64 And two new enums: - XML_Prop_Error - XML_Parser_Property #1323 lib: Introduce five new 64bit location API functions: - XML_GetCurrentByteCount64 - XML_GetCurrentByteIndex64 - XML_GetCurrentColumnNumber64 - XML_GetCurrentLineNumber64 - XML_GetInputContext64 These five functions closely mirror their predecessors but are not prone to 32bit integer wrap-around. Other changes: #1391 docs: Document the scope of function XML_GetErrorCode #1395 docs: Document length expectations for XML_ParseBuffer #1394 lib: Call unknown encoding release before parser teardown #1370 #1373 lib: Drop (disabled-by-default) attribute info feature These things are now gone: - Public function XML_GetAttributeInfo - Public struct XML_AttrInfo - Macro XML_ATTR_INFO These things are now causing build errors: - Configure option --enable-xml-attr-info - CMake option -DEXPAT_ATTR_INFO=ON #1379 #1382 lib: Drop (disabled-by-default) minimum size feature These things are now gone: - Macro XML_MIN_SIZE These things are now causing build errors: - Configuring with -DXML_MIN_SIZE for CPPFLAGS/CFLAGS - CMake option -DEXPAT_MIN_SIZE=ON #1323 #1411 lib: Deprecate macro XML_LARGE_SIZE (use the new 64bit location API functions instead please) #1323 lib: Deprecate five location API functions that are cursed with integer wrap-around: - XML_GetCurrentByteCount - XML_GetCurrentByteIndex - XML_GetCurrentColumnNumber - XML_GetCurrentLineNumber - XML_GetInputContext #1399 lib: Guard against out-of-handler use of XML_DefaultCurrent #1400 lib: Use size_t for bytesAllocated and peakBytesAllocated #1401 #1402 .. #1404 #1405 lib|xmlwf|tests: Unify use of xcslen, xcscmp and xcsncmp #1406 xmlwf: Add missing `#include "expat.h"` #1389 #1396 Version info bumped from 13:5:12 (libexpat*.so.1.12.5) to 14:0:13 (libexpat*.so.1.13.0); see https://verbump.de/ for what these numbers do Infrastructure: #1386 CI: Bump MinGW Clang from 23.1.1 to 23.1.2 #1410 CI: Bump Fil-C from 0.685 to 0.686 #1388 CI: Adapt to breaking changes regarding windows-11-arm image #1403 CI: Limit package cache download runtime Special thanks to: Bénédikt Tran Berkay Eren Ürün Fabian Wahle (Hap Security) Filippo Tedeschi Junki Lee Matthew Fernandez Scott Moore Wade Sparks III and City of Munich Open Source Sabbatical VulnCheck
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#247264): https://lists.openembedded.org/g/openembedded-core/message/247264 Mute This Topic: https://lists.openembedded.org/mt/121605898/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
