Changelog for expat: 2.8.2 -> 2.8.3
Source: Changes

!! <blink>Expat has UNFIXED SECURITY ISSUES!</blink>                         !!
!! Please see https://github.com/libexpat/libexpat/issues/1160 for details.  !!
!! Starting 2026-08-01, for up to six months my work maintaining libexpat    !!
!! will be funded by the City of Munich as part of their                     !!
!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html)   !!
!! — thank you!                                                              !!
!!                                   Sebastian Pipping -- Berlin, 2026-08-03 !!
Release 2.8.3 Mon August 10 2026
        Security fixes:
           #1296  CVE-2026-72522 -- Fix an out-of-bounds read and the resulting
                    infinite loop caused by treating low surrogates (Unicode)
                    the same as high surrogates in functions *_toUtf16.
                    Needs Expat compiled with 16bit character support
                    (e.g. with Firefox and/or on Windows) to be affected.
                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote, the "AV:L" in NVD by
                    Mitre is mistaken.)
                    Original bug report from Mozilla at:
                    https://bugzilla.mozilla.org/show_bug.cgi?id=2053153

        Bug fixes:
     #1297 #1300  lib: Fix support for 2+ GiB documents (regression from 2.8.2)
           #1286  lib: Reject empty version in the XML declaration
     #1305 #1306  lib: Fix printf format for AIX

        Other changes:
           #1309  CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX
           #1295  CMake|Windows: Add a 64bit MinGW toolchain file
     #1287 #1289  CMake|Windows: Start invoking MSVC with /source-charset:utf-8
           #1289  CMake|Windows: Start requiring MSVC 2015 Update 2 or later
           #1300  Document the current wrap-around issues with functions
                    - XML_GetCurrentByteIndex
                    - XML_GetCurrentColumnNumber
                    - XML_GetCurrentLineNumber
                    - XML_GetAttributeInfo
                    explicitly.
           #1303  Address Clang Static Analyzer 22 warning
                    `core.NullPointerArithm`
     #1313 #1314  Version info bumped from 13:2:12 (libexpat*.so.1.12.2)
                    to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/
                    for what these numbers do

        Infrastructure:
           #1311  CI: Limit workflow runtime and package installation runtime
           #1310  CI: Pin Cppcheck version for a robust CI
           #1310  CI: Migrate Cppcheck CI from macOS to Linux
           #1312  CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten
                    and WASI SDK
           #1304  CI: Activate AddressSanitizer for MSVC Windows CI
           #1308  CI: Introduce zizmor static analysis for GitHub Actions
           #1308  CI: Start using `persist-credentials: false` with Git checkout
           #1219  CI: Add a 7 day cooldown to Dependabot for GitHub Actions
     #1302 #1303  CI: Bump Clang from 21 to 22
     #1293 #1294  Update project status for 2026-08
     #1301 #1307  Add SPDX license identifiers to the source code

        Special thanks to:
            Evgeny Kotkov
            Henri Sivonen
            Kartik Kenchi
            Matthew Fernandez
            Matthew Wozniczka
            Stan Ulbrych
            Tuukka Pasanen
            William Woodruff
                 and
            Anthropic
            City of Munich Open Source Sabbatical
            Mozilla Security Team
            Subversion
            zizmor static analysis

                    Upstream CVSS 3.1 vector:
                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
                    (Note the "AV:N" for network/remote and the "AC:L"
                    for low complexity; the NVD entry from Mitre is mistaken.)