From mboxrd@z Thu Jan 1 00:00:00 1970 Delivery-date: Thu, 15 Oct 2026 07:58:21 +0200 Received: from metis.whiteo.stw.pengutronix.de ([2a0a:edc0:2:b01:1d::104]) by lore.white.stw.pengutronix.de with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xHETt-00DnR3-2y for lore@lore.pengutronix.de; Thu, 15 Oct 2026 07:58:21 +0200 Received: from [127.0.0.1] (helo=metis.whiteo.stw.pengutronix.de) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xHETr-0006iK-LQ; Thu, 15 Oct 2026 07:58:19 +0200 Received: from mx1.white.stw.pengutronix.de ([185.203.200.13]) by metis.whiteo.stw.pengutronix.de with esmtp (Exim 4.92) (envelope-from ) id 1xHETY-0006I2-TE for ptxdist@pengutronix.de; Thu, 15 Oct 2026 07:58:01 +0200 Received: from dude05.red.stw.pengutronix.de (dude05.red.stw.4.pengutronix.de [10.17.1.19]) (Authenticated sender: relay-from-dude05.red.stw.pengutronix.de) by mx1.white.stw.pengutronix.de (Postfix) with ESMTPSA id D2333201BBB; Thu, 15 Oct 2026 07:58:00 +0200 (CEST) ARC-Seal: i=1; s=20260414; d=pengutronix.de; t=1792043880; a=rsa-sha256; cv=none; b=gNoWIZks1dWEPXUeLxAJMkKf4s9UmtiKZNRafQD51xYucqHOQfQ9i1WndI9WRPK691GU5s AITO0dWZzKYuN3cUNN0i7jCo6KnBvk9rSWE/IG5i8M2OFWzy2bA7+15fg36daj9F+OInRQ 2ByiwyEBXN9Vnr5xtnE/E1eFXEBK4ujyzkTM1aMkIueA+vtWnIwcqHXZ8EzNJ4q2hyS24w UxM5/U8nN3h1xf2cd0a0JXL7lWvvKsUpZJI34SPEi/xhbkKHOg8PcKwUiSnQxzwsTX+wBN 0HcQIi5LKTAyBeafoQOpjlsUtjJ6dv/nXJfooOIDU2jJDn4LgUkyZ6vhVNHROQ== ARC-Authentication-Results: i=1; ORIGINATING; auth=pass smtp.auth=relay-from-dude05.red.stw.pengutronix.de smtp.mailfrom=mol@pengutronix.de ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=pengutronix.de; s=20260414; t=1792043880; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=A8ijlHHs7oddiFGz1Uf853SyE3PN07qzB6YG7vtPvdA=; b=bWWXTfI+v9wQXOZjEAqCOrB0ZPrw/V/dNMQsK05rUkNmyG8Oj0E5O4PVIurxCLZ5P8K8tX KCtjRDsGsr+hLc1hwjAYjyLajPLZtfkbP+4G7Xits5DA3BnJEyQWohHk+t8doRfJ2b9+Vk pUQKdp5TbJfqRgg7ijhWAFlsN6EnNLvL/vezmiH6E5Bnzn75tGdGX5eDj9mIBErKwRSJzs 5LkVETBN8z1GLuQfnZnU42M0law+wKDQSqxYjaeFG6++abyf5TmaxgrQeEMIBky2//ffIY g1qgq5sCaN6V75SAA0smICpFgoog98dHPiIpqJyoTuxQuRrm8pRlMxtROIOSEw== Received: by dude05.red.stw.pengutronix.de (Postfix, from userid 1014) id C37EF741297; Thu, 15 Oct 2026 07:58:00 +0200 (CEST) From: Michael Olbrich To: ptxdist@pengutronix.de Date: Thu, 15 Oct 2026 07:58:00 +0200 Message-ID: <20261015055800.1415604-1-m.olbrich@pengutronix.de> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261007183735.1679130-1-christian.melki@t2data.com> References: <20261007183735.1679130-1-christian.melki@t2data.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on metis.whiteo.stw.pengutronix.de X-Spam-Level: X-Spam-Status: No, score=-3.0 required=5.0 tests=ALL_TRUSTED,BAYES_00, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU autolearn=ham autolearn_force=no version=3.4.2 Subject: Re: [ptxdist] [APPLIED] expat: Version bump. 2.8.5 -> 2.9.0 X-BeenThere: ptxdist@pengutronix.de X-Mailman-Version: 2.1.29 Precedence: list List-Id: PTXdist Development Mailing List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: ptxdist@pengutronix.de Cc: Christian Melki Sender: "ptxdist" X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: ptxdist-bounces@pengutronix.de X-SA-Exim-Scanned: No (on metis.whiteo.stw.pengutronix.de); SAEximRunCond expanded to false Thanks, applied as 6ef2e7198ca4a891de66675bdaa0875382d82216. Michael [sent from post-receive hook] On Thu, 15 Oct 2026 07:58:00 +0200, Christian Melki wrote: > A few changes, nothing over the top. > https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes > > Plugs CVEs: > CVE-2026-102633: Integer overflow in function expat_realloc on 32bit platforms > CVE-2026-77214: Validate parameter `len` against available buffer capacity in XML_ParseBuffer > > * Remove option, functionality is removed in codebase. > > Signed-off-by: Christian Melki > Message-Id: <20261007183735.1679130-1-christian.melki@t2data.com> > Signed-off-by: Michael Olbrich > > diff --git a/rules/expat.make b/rules/expat.make > index 6c9707da4232..9695fc8968f6 100644 > --- a/rules/expat.make > +++ b/rules/expat.make > @@ -16,8 +16,8 @@ PACKAGES-$(PTXCONF_EXPAT) += expat > # > # Paths and names > # > -EXPAT_VERSION := 2.8.5 > -EXPAT_SHA256 := 952c03c33a6b337f12dae7a9b0f9dee86f867550d35c994d6bdaaddd37dc8454 > +EXPAT_VERSION := 2.9.0 > +EXPAT_SHA256 := 775e8a68f81a748a401dc3168318d4a39484eb4f954726f21517c8f42c0ba984 > EXPAT := expat-$(EXPAT_VERSION) > EXPAT_SUFFIX := tar.bz2 > EXPAT_RELEASE := R_$(subst .,_,$(EXPAT_VERSION)) > @@ -41,7 +41,6 @@ EXPAT_CONF_OPT := \ > $(CROSS_AUTOCONF_USR) \ > --disable-static \ > --disable-symbol-versioning \ > - --disable-xml-attr-info \ > --enable-xml-context \ > --without-xmlwf \ > --without-examples \