Thanks, applied as 6ef2e7198ca4a891de66675bdaa0875382d82216. Michael
[sent from post-receive hook] On Thu, 15 Oct 2026 07:58:00 +0200, Christian Melki <[email protected]> wrote: > A few changes, nothing over the top. > https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes > > Plugs CVEs: > CVE-2026-102633: Integer overflow in function expat_realloc on 32bit platforms > CVE-2026-77214: Validate parameter `len` against available buffer capacity in > XML_ParseBuffer > > * Remove option, functionality is removed in codebase. > > Signed-off-by: Christian Melki <[email protected]> > Message-Id: <[email protected]> > Signed-off-by: Michael Olbrich <[email protected]> > > diff --git a/rules/expat.make b/rules/expat.make > index 6c9707da4232..9695fc8968f6 100644 > --- a/rules/expat.make > +++ b/rules/expat.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_EXPAT) += expat > # > # Paths and names > # > -EXPAT_VERSION := 2.8.5 > -EXPAT_SHA256 := > 952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454 > +EXPAT_VERSION := 2.9.0 > +EXPAT_SHA256 := > 775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984 > EXPAT := expat-$(EXPAT_VERSION) > EXPAT_SUFFIX := tar.bz2 > EXPAT_RELEASE := R_$(subst .,_,$(EXPAT_VERSION)) > @@ -41,7 +41,6 @@ EXPAT_CONF_OPT := \ > $(CROSS_AUTOCONF_USR) \ > --disable-static \ > --disable-symbol-versioning \ > - --disable-xml-attr-info \ > --enable-xml-context \ > --without-xmlwf \ > --without-examples \
