From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Wed, 07 Oct 2026 20:37:52 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xEWWW-00B24n-2t for lore@lore.pengutronix.de; Wed, 07 Oct 2026 20:37:52 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xEWWW-0008O7-0Z; Wed, 07 Oct 2026 20:37:52 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xEWWO-0008Nz-Eg for ptxdist@pengutronix.de; Wed, 07 Oct 2026 20:37:44 +0200 Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazlp170110003.outbound.protection.outlook.com [IPv6:2a01:111:f403:c200::3]) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPS id E1AA6200582 for ; Wed, 07 Oct 2026 20:37:43 +0200 (CEST) ARC-Seal: i=2; s=20260414; d=pengutronix.de; t=1791398264; a=rsa-sha256; cv=pass; b=dU/krtpilumsIf7xFTD+b8rpcphsr5/9kCRWHvMsfdwRv9SqCBgg440nPC92bnaa/n/EO2 CYNjN/r1/z9Kb6kvTwFUqlS9JOmX+Wqt5ZO3Hxnbg2u5+ttijq6W/wCOadI4XkhZveriBG IjiYYch+eipxro8+vnXXDYnAxftlfKfzvIlPjXGPI+/WkqXS4bS3CYyre2pfNUDJS6+NnH IRYaIZcXkNPfa5mz6NdvBJ1UDtGzVa/9SR1T5ZNiDlSwR1u/lu2iQNO0zYF9DmdVOxG2Qs 8Nf6fUBLjSHQE5Dasxls71g61ibjEqhBx2FpB7nIObDECLFy9HaEIPXBr48OBg== ARC-Authentication-Results: i=2; mx1.white.stw.pengutronix.de; dkim=pass header.d=t2datacom.onmicrosoft.com header.s=selector1-t2datacom-onmicrosoft-com header.b=WwbF8QUz; spf=pass (mx1.white.stw.pengutronix.de: domain of christian.melki@t2data.com designates 2a01:111:f403:c200::3 as permitted sender) smtp.mailfrom=christian.melki@t2data.com; arc=pass ("microsoft.com:s=arcselector10001:i=1"); dmarc=pass (policy=none) header.from=t2data.com ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1791398264; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=RKcjpAqiWBQUFLjpN0Dv5AQQ/cdITe65VBOjqpl5mq4=; b=B5jmqglg/XMmBHCACjseAhY9kHB/rCbXcsriI8ehXydGrr+EUnkbI81aXUjkpNo0cCKVXW 8e+4+GXEzIDc6EpfSSU1+dE11ybAYdL0zTqTx6qYAKAesW9+teS8AsWrHRQMy6PTt4EMoQ YpEj8vWxm1REM9HfKgwC0BYvsAww204pk0Rby/3h8w40ofFYqR87uSYd4gPi/ophgEcTL9 dpQXLYlxaC0Jd+asKBsthmKk8Qck/Ag813OJfqHQzJwS+bRWGLgqwOc/pvNC1ij5b6e7de 1cPjHKXsp/TeJIyOo3K09qahhRN5GE3DixmJlw7xBwCSsyrWI7m8wCp2GlEcUQ== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Jvu7AQCZ63NIn/Qr3NaGg0fJYSRf7cTvKvKQskq+uG493m+FLYb97KwDhbCFCFrL/CJDvtElfuAfaIWX5W0miiFu1XnBU9n78jjIh/9eIIfNAs0oTzC3Am8IHgB52z0cQKHR1MpzXNCE0a60tA4McMuP6zLAwkkMqdZlbijG78qY56HKYGTBWrJ45i7rxaZvu7/o5wXk9hEueRoZ9nN+AZfIOi+RiyXuJN3YD2X98NioBfDVyqbnAhm0FBKOBeZMPL6QVmjbW3oHc8IO1mCk2WCRwBQ70EbKgnbMCQJWy8euUk7H/vfpuW99wRhSp25/b31PClz0p/tXjGjHUoQblw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=RKcjpAqiWBQUFLjpN0Dv5AQQ/cdITe65VBOjqpl5mq4=; b=kSrW/DR8MKNM+qHRqDuos0MkYN8vgKI7n8jU4dkNC9RJToSh+y0FlhCYTxQmNOl5CjoWsiRkeERkI+t60KANQ1eHNcDslFa2rItiqrAg5DTv68D4vGFNyqW8dmgAroqF38Hftg+TnznGON/gHO+/olgc9mAT2EwJnaJr7FJsBeB6pv7MHInfVKBg6b4f02vxqM+V9T4jES1iYuso8gPw0JInL+XHsm6Ik/Z0eYoOaAbH058NUOFDiqAt5/Dl4y6qJDnuRGnrFVQRlX+Rej2teHbPJAjBzXAPZSCOaQXQ1TpM1laufM7Me7DL8oCdf4zQKnbIzAGHvaqsvAUrnWi45Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=t2data.com; dmarc=pass action=none header.from=t2data.com; dkim=pass header.d=t2data.com; arc=none Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) by DB9P251MB1132.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:5e0::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.496.15; Wed, 7 Oct 2026 18:37:41 +0000 Received: from DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19]) by DB9P251MB0618.EURP251.PROD.OUTLOOK.COM ([fe80::a4b2:58d7:8549:4b19%3]) with mapi id 15.21.0496.010; Wed, 7 Oct 2026 18:37:41 +0000 From: Christian Melki To: ptxdist@pengutronix.de Date: Wed, 7 Oct 2026 20:37:35 +0200 Message-ID: <20261007183735.1679130-1-christian.melki@t2data.com> X-Mailer: git-send-email 2.43.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: GVZP280CA0058.SWEP280.PROD.OUTLOOK.COM (2603:10a6:150:271::10) To DB9P251MB0618.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:334::22) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DB9P251MB0618:EE_|DB9P251MB1132:EE_ X-MS-Office365-Filtering-Correlation-Id: 486ff0f6-d822-41a2-1d20-08df24a21203 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; ARA:13230040|52116014|23010399003|376014|366016|1800799024|38350700014|5023799004|56012099006|10067099003|18002099003; X-Microsoft-Antispam-Message-Info: wVsdK0iGOZE+NcV5gX5J9fGWwMVWg0cxSNthR9gS0Fzee33a5A/e0gXsxqxN14bGgLiTM6/5Kl8CUfcs0X/kn6vb5/clldHs/5zEnPiiv0xLB5Q55DTUeI9XgMd9zHMK60ZRlQjeCMWFY6/EeTY2G+cu7xENjVjbDdTqIep+p9nuhI8p8dcE3E+it+b/1ca9rad0kYg6/1dO0nDvsNpOjd9pyGLN2zMYZTOEehoiQ9bq1NaBaXGF+26AM735JpbrjMxSol8Tpj/Az8nQSKZdyOJk8JRbFeHMCjfTL5+PozzD9u6TChKvGUqj0jTGro2u1FMNyP0s53WR9kxjHbV4JTPw0I+urGRlthjBST7a0sdrtImYk/uJChQPvAVDnSjSUX5nyS6Bh3+971hVvshTtBPgLaUjKfM0klfOP/UnvjrS2G+oIDI5zFkG1X5nIws7Yt5M5xTQ0Us7SkHmc6vZQHbNTqjNgOe8h4hSeyq2o/vh9RGKE6L+M085WyHKTah5RCP55fk5o+7dNJqE6a3aQqC3RSoPSvRPrep7H8Qu5+ktpjOltPuEufgZRtsCbuKELnx41Nqq2Bcvsbn2EjVjY7Zoiqa+Hj9jLybo3eV47S6eziGO7OgoLFbieRo7vGRdRUVjn5gd79PQJSvLpoxScIjyieRM9VpjFCxnkoYn9r0= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DB9P251MB0618.EURP251.PROD.OUTLOOK.COM; PTR:; CAT:NONE; SFS:(13230040)(52116014)(23010399003)(376014)(366016)(1800799024)(38350700014)(5023799004)(56012099006)(10067099003)(18002099003); DIR:OUT; SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?CijH3bpQ9wqqj8UMX+xyYedoRUL88ZNmXiTlZsOMGJfAU0eVXTGD3syrih4f?= =?us-ascii?Q?k09giwlHukjfDMHk+tkD2FT0fXwOQPIh0RKmCpULWbj3o+P8O70MdTbfChHJ?= =?us-ascii?Q?6CU+U4YCqZ6DbOvNpHzXTN4d6unZpLygwalLu0WEvdw4kf7j8dmefiYSq8c0?= =?us-ascii?Q?WJGqDbZ20TPvl0XOB7gclbVmPc12M8uou1uxZ/JEgbGD2OD2Mzml+0Uko/cH?= =?us-ascii?Q?GRcXgG3hKxpWDNzedP85knLvbHDF6h4H6z1e5QfXDUqsQ/mhUAg6xG4g2Gxj?= =?us-ascii?Q?GzeffNL2HfrA3Cxlzzs/DhvfcaHc7l5bM1PnKmRp2DB8YrL1Oa3jOW344vjb?= =?us-ascii?Q?YvFS3y4pXmekQHZNQW32ZWGZklK+tvhGtB/wSldQcuFwuI7OwLXoQxNSHqH/?= =?us-ascii?Q?YNVFDMJpZN77OrSGXsBmApE44jDzO2h/QO7/I3uQF9agGt/WIl8C6TYN+am2?= =?us-ascii?Q?+rQsqFEGt4hePUh9BxKyFJTMxdnj5NaCX/tGdw5v1SVpsyHjaGUOGWSiejvJ?= =?us-ascii?Q?vF8lE7CZkpJ73Ynam3zU4J4GfVuKgcrq1NX+Dn+qbqRanVfoZdtjHD5AuBJ9?= =?us-ascii?Q?UlyCjfmKDR0nRivn9EP6avPkbv39355qpV0FxDKkQwxL0Vslq9J1A8NUr2yN?= =?us-ascii?Q?khs08uC46vzH4n2S9gmjSIJhKsRUFgl7x1NNKvm/BSp3GPqyrUixOz4xovJ4?= =?us-ascii?Q?GiorGc+gwVY5/sgn2/ZItJl5JRqVGgJcjmC/7fJbqLhNNPw0yDqCDpCN8caa?= =?us-ascii?Q?XMLtgcs3MZV15sSLP2mFm1UQWCqztxXaMu4RL9mLVXAtI9dJLbvx+h34k77r?= =?us-ascii?Q?Ul7yrRgHnifB0FYxowroYhKnl/MhvXgo1vT1l/2kLlcNt5B6KlJtuN9Q1mfk?= =?us-ascii?Q?6Leg/wwQXDlCs1seVWQbDGqfOLNacBxTIghvba+ukjNl3KSvXMt1pgrB5ay1?= =?us-ascii?Q?QEitCMs0dCcNE8CgXpWOJTqN2EQCUI1tCcUqUHLWu3haW2IbPSIAHuCzCnQ4?= =?us-ascii?Q?2e914aH6k0XH3OilCIrYrCiwefS7xJ+bFBdMa/dBEpj/eUxT/5b8C5EBOUEA?= =?us-ascii?Q?8AZGhZ+drw9cJmjEzRD5Ki2BeZLSYQnX5MC7QUoyXZR/PJFwFCSpb1H0FlgO?= =?us-ascii?Q?h3HTQ504EKqex93HG6xPe+VCB3gszht2pd0cAOISHE7Kv30BC9oN/adeO7zR?= =?us-ascii?Q?egZQ+0qtgjA0GIiiqjJXSwZLjj+spYgHbJxs1BBI23IH/MSJCJw/I8xHinE0?= =?us-ascii?Q?Vc1TXMVvdLmZaAJPnfmemOvLnNrd03phSfpC1B6i8Tl7ORzMoS9XkD1z+AIq?= =?us-ascii?Q?IPqZ4XFd8NtpT7evUCxQQ4LTEM/a2z0zeNlEn7/AvxRr1qDuUafmH92tEkJx?= =?us-ascii?Q?70S8hXrbB4kK31bk2zj6rFvIOfrgkEPGzKaQsXICHsfiLtx9fcWzt+sdC35Z?= =?us-ascii?Q?bQshabYQH9VDNtD0WT3q/DngtIIvDtMmfDNcqO+NLJDPK46qyC9Mnwjb+ta+?= =?us-ascii?Q?PvV/Q5E6qPoNkN19PD3nOvSC2NQt+MvkA/pQCVcBPI2k8nn8cscwBZ9Gb1aB?= =?us-ascii?Q?MAv8h0JIdNNuG9u6/DMlrJkovHsDQFtHZd6btCa2QtdlbeYR1igrI0VGUlFv?= =?us-ascii?Q?WD1P4P99aVfZrpJHBZC5oWE9Zfo6FZJSh4V8t1fyBJWgeGQZj/AFryXkoZBe?= =?us-ascii?Q?0oLam8+4pVrBNn+0y9sqac5UoY/A7Z6rSBwi7wV6yENsOJtHI4jB/0yfM5BU?= =?us-ascii?Q?gioBaxBknhKtJ03f2apixCST6AUobSU=3D?= X-OriginatorOrg: t2data.com X-MS-Exchange-CrossTenant-Network-Message-Id: 486ff0f6-d822-41a2-1d20-08df24a21203 X-MS-Exchange-CrossTenant-AuthSource: DB9P251MB0618.EURP251.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2026 18:37:41.6910 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 27928da5-aacd-4ba1-9566-c748a6863e6c X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: K5vljapKJmuGmxoStdhFdLVr5q1NZenGkU/vZ6JArE13qJREIdY349SHKt22P4WHj1Ss9fQ1ohNG+7GOfhyheBBS7rJwISESny7BMlA1neY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB9P251MB1132 X-Spamd-Result: default: False [-3.50 / 15.00]; BAYES_HAM(-3.00)[99.99%]; MID_CONTAINS_FROM(1.00)[]; ARC_ALLOW(-1.00)[microsoft.com:s=arcselector10001:i=1]; R_MISSING_CHARSET(0.50)[]; DMARC_POLICY_ALLOW(-0.50)[t2data.com,none]; R_DKIM_ALLOW(-0.20)[t2datacom.onmicrosoft.com:s=selector1-t2datacom-onmicrosoft-com]; R_SPF_ALLOW(-0.20)[+ip6:2a01:111:f403:c000::/51:c]; MIME_GOOD(-0.10)[text/plain]; RCVD_TLS_LAST(0.00)[]; NEURAL_HAM(-0.00)[-1.000]; RCPT_COUNT_ONE(0.00)[1]; ARC_SIGNED(0.00)[pengutronix.de:s=20260414:i=2]; MIME_TRACE(0.00)[0:+]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2a01:111:f403:c200::3:from]; TO_DN_NONE(0.00)[]; RCVD_COUNT_TWO(0.00)[2]; ASN(0.00)[asn:8075, ipnet:2a01:111:f000::/36, country:US]; DKIM_TRACE(0.00)[t2datacom.onmicrosoft.com:+]; FROM_HAS_DN(0.00)[] X-Rspamd-Action: no action X-Rspamd-Server: mx1 X-Rspamd-Queue-Id: E1AA6200582 X-Stat-Signature: rdhzxo6m533qesnbueboyhs8djekemj9 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-1.5 required=5.0 tests=AWL,BAYES_00,DKIM_SIGNED, DKIM_VALID,FORGED_SPF_HELO,RCVD_IN_DNSWL_NONE,SPF_HELO_PASS autolearn=no autolearn_force=no version=3.4.2 Subject: [ptxdist] [PATCH] expat: Version bump. 2.8.5 -> 2.9.0 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false A few changes, nothing over the top. https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes Plugs CVEs: CVE-2026-102633: Integer overflow in function expat_realloc on 32bit platforms CVE-2026-77214: Validate parameter `len` against available buffer capacity in XML_ParseBuffer * Remove option, functionality is removed in codebase. Signed-off-by: Christian Melki --- rules/expat.make | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/rules/expat.make b/rules/expat.make index 6c9707da4..9695fc896 100644 --- a/rules/expat.make +++ b/rules/expat.make @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_EXPAT) += expat # # Paths and names # -EXPAT_VERSION := 2.8.5 -EXPAT_SHA256 := 952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454 +EXPAT_VERSION := 2.9.0 +EXPAT_SHA256 := 775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984 EXPAT := expat-$(EXPAT_VERSION) EXPAT_SUFFIX := tar.bz2 EXPAT_RELEASE := R_$(subst .,_,$(EXPAT_VERSION)) @@ -41,7 +41,6 @@ EXPAT_CONF_OPT := \ $(CROSS_AUTOCONF_USR) \ --disable-static \ --disable-symbol-versioning \ - --disable-xml-attr-info \ --enable-xml-context \ --without-xmlwf \ --without-examples \ -- 2.43.0