From d2b7e4be9455f116b71ec1954850b265ac72c63f Mon Sep 17 00:00:00 2001
From: Upgrade Helper <auh@yoctoproject.org>
Date: Tue, 11 Aug 2026 05:33:49 +0000
Subject: [PATCH] expat: upgrade 2.8.2 -> 2.8.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Source: Changes

!! <blink>Expat has UNFIXED SECURITY ISSUES!</blink>                         !!
!! Please see https://github.com/libexpat/libexpat/issues/1160 for details.  !!
!! Starting 2026-08-01, for up to six months my work maintaining libexpat    !!
!! will be funded by the City of Munich as part of their                     !!
!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html)   !!
!! — thank you!                                                              !!
!!                                   Sebastian Pipping -- Berlin, 2026-08-03 !!
Release 2.8.3 Mon August 10 2026
        Security fixes:
           #1296  CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
                    infinite loop caused by treating low surrogates (Unicode)
                    the same as high surrogates in functions *_toUtf16.
                    Needs Expat compiled with 16bit character support
                    (e.g. with Firefox and/or on Windows) to be affected.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote, the "AV:L" in NVD by
                    Mitre is mistaken.)
                    Original bug report from Mozilla at:
                    https://bugzilla.mozilla.org/show_bug.cgi?id=2053153

        Bug fixes:
     #1297 #1300  lib: Fix support for 2+ GiB documents (regression from 2.8.2)
           #1286  lib: Reject empty version in the XML declaration
     #1305 #1306  lib: Fix printf format for AIX

        Other changes:
           #1309  CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
           #1295  CMake|Windows: Add a 64bit MinGW toolchain file
     #1287 #1289  CMake|Windows: Start invoking MSVC with /source-charset:utf-8
           #1289  CMake|Windows: Start requiring MSVC 2015 Update 2 or later
           #1300  Document the current wrap-around issues with functions
                    - XML_GetCurrentByteIndex
                    - XML_GetCurrentColumnNumber
                    - XML_GetCurrentLineNumber
                    - XML_GetAttributeInfo
                    explicitly.
           #1303  Address Clang Static Analyzer 22 warning
                    `core.NullPointerArithm`
     #1313 #1314  Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
                    to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
           #1311  CI: Limit workflow runtime and package installation runtime
           #1310  CI: Pin Cppcheck version for a robust CI
           #1310  CI: Migrate Cppcheck CI from macOS to Linux
           #1312  CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
                    and WASI SDK
           #1304  CI: Activate AddressSanitizer for MSVC Windows CI
           #1308  CI: Introduce zizmor static analysis for GitHub Actions
           #1308  C

[Changelog truncated as it exceeds 3000 characters;
the full changelog can be found in an attachment to the AUH email]
---
 meta/recipes-core/expat/{expat_2.8.2.bb => expat_2.8.3.bb} | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 rename meta/recipes-core/expat/{expat_2.8.2.bb => expat_2.8.3.bb} (92%)

diff --git a/meta/recipes-core/expat/expat_2.8.2.bb b/meta/recipes-core/expat/expat_2.8.3.bb
similarity index 92%
rename from meta/recipes-core/expat/expat_2.8.2.bb
rename to meta/recipes-core/expat/expat_2.8.3.bb
index 0b9dbe161b..79e8c15227 100644
--- a/meta/recipes-core/expat/expat_2.8.2.bb
+++ b/meta/recipes-core/expat/expat_2.8.3.bb
@@ -15,7 +15,7 @@ SRC_URI = "${GITHUB_BASE_URI}/download/R_${VERSION_TAG}/expat-${PV}.tar.bz2  \
 GITHUB_BASE_URI = "https://github.com/libexpat/libexpat/releases/"
 UPSTREAM_CHECK_REGEX = "releases/tag/R_(?P<pver>.+)"
 
-SRC_URI[sha256sum] = "69e7f52417d85b1c2b7fe855e176eec55d0b2d7d92d691372d833a1c7df7923b"
+SRC_URI[sha256sum] = "b4cc2483927d5e90bf8c40b44a6b95b368b42a8a96e25883fce188b48a92b670"
 
 EXTRA_OECMAKE:class-native += "-DEXPAT_BUILD_DOCS=OFF"
 
-- 
2.47.1

