* [PATCH] expat: Update to version 2.8.5
@ 2026-09-23 11:45 Adolf Belka
2026-09-23 11:45 ` [PATCH] rsync: Update to version 3.5.1 Adolf Belka
0 siblings, 1 reply; 2+ messages in thread
From: Adolf Belka @ 2026-09-23 11:45 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 2.8.4 to 2.8.5
- Update of rootfile
- 1 fix for a CVE
- Changelog
2.8.5
Security fixes:
(#1282) CVE-2026-93990 -- Reject high surrogates not followed by a
low surrogate during UTF-16 decoding; previously, malformed
UTF-16 could be smuggled into the application using Expat
and could cause arbitrary damage there, depending on how
malformed UTF-16 was handled inside the application;
validation was not their job but Expat's. This is similar
to past vulnerability CVE-2022-25235.
Upstream CVSS 3.1 vector:
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)
Bug fixes:
(#1346) lib: Fix OOM-related memory leak on a failed overflow check
(#1371) lib: Fix memory alignment for architectures with 128bit
pointers like CHERI-RISC-V
(#1367) xmlwf: Handle errors when closing output files
Other changes:
(#1354) lib: Reject an XML declaration version other than `1.[0-9]+`
(which is less strict than XML 1.0r4 (fourth edition)
and matches XML 1.0r5 (fifth edition))
(#1362) lib: Make Clang, GCC and MSVC warn about use of function
XML_SetHashSalt that is deprecated since Expat 2.8.0
(#1357) lib: Drop internal macros FASTCALL, PTRCALL, PTRFASTCALL
(#1367) xmlwf: Document that with `-k` the last error determines the
xmlwf exit code in `--help` output
(#1367) xmlwf: Make exit code 3 documentation match exit code 2 more
closely in `--help` output
(#1352 #1353) CMake|Windows: Refrain from adding `/source-charset:utf-8`
for MSVC
(#1366 #1374) Autotools: Be explicit about the minimum required version of
GNU Automake, currently version 1.13 of 2012-12-28
(#1351) Autotools|macOS: Sync CMake templates with CMake 4.4.3
(#1349) Replace some internal use of XML_Bool with standard bool
(#1364) tests: Propagate xmltest.sh failures via exit status
(#1360) tests|xmlwf: Add `#include "expat_config.h"` where missing
(#1355) tests: Start covering hash table operation
(#1350 #1369) tests: Drop __cplusplus leftovers
(#1378) tests: Fix tail pointer when unlinking the last tracked
allocation
(#1376) docs: Emphasize that XML_StopParser is not immediate
(#1381) docs: Sync XML_FeatureEnum value list in doc/reference.html
(#1356 #1361) Version info bumped from 13:4:12 (libexpat*.so.1.12.4)
to 13:5:12 (libexpat*.so.1.12.5); see https://verbump.de/
for what these numbers do
Infrastructure:
(#1347) Add missing .gitignore entries
(#1360) CI: Detect missing `#include "expat_config.h"`
(#1368) CI: Bump MinGW Clang from 23.0.1 to 23.1.1
(#1377) CI: Bump Fil-C from 0.684 to 0.685
(#1380) CI: Bump Cppcheck from 2.21.0 to 2.22.0
(#1372) CI: Extract helper script `apply-htmltidy.sh`
(#1366 #1374) Autotools: Start to also produce .tar.bz3 release tarballs
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
config/rootfiles/common/expat | 20 ++++++++++----------
lfs/expat | 4 ++--
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/config/rootfiles/common/expat b/config/rootfiles/common/expat
index 575cbe1cb..a32adc876 100644
--- a/config/rootfiles/common/expat
+++ b/config/rootfiles/common/expat
@@ -2,21 +2,21 @@
#usr/include/expat.h
#usr/include/expat_config.h
#usr/include/expat_external.h
-#usr/lib/cmake/expat-2.8.4
-#usr/lib/cmake/expat-2.8.4/expat-config-version.cmake
-#usr/lib/cmake/expat-2.8.4/expat-config.cmake
-#usr/lib/cmake/expat-2.8.4/expat-noconfig.cmake
-#usr/lib/cmake/expat-2.8.4/expat.cmake
+#usr/lib/cmake/expat-2.8.5
+#usr/lib/cmake/expat-2.8.5/expat-config-version.cmake
+#usr/lib/cmake/expat-2.8.5/expat-config.cmake
+#usr/lib/cmake/expat-2.8.5/expat-noconfig.cmake
+#usr/lib/cmake/expat-2.8.5/expat.cmake
#usr/lib/libexpat.la
#usr/lib/libexpat.so
usr/lib/libexpat.so.1
-usr/lib/libexpat.so.1.12.4
+usr/lib/libexpat.so.1.12.5
#usr/lib/pkgconfig/expat.pc
#usr/share/doc/expat
-#usr/share/doc/expat-2.8.4
-#usr/share/doc/expat-2.8.4/ok.min.css
-#usr/share/doc/expat-2.8.4/reference.html
-#usr/share/doc/expat-2.8.4/style.css
+#usr/share/doc/expat-2.8.5
+#usr/share/doc/expat-2.8.5/ok.min.css
+#usr/share/doc/expat-2.8.5/reference.html
+#usr/share/doc/expat-2.8.5/style.css
#usr/share/doc/expat/AUTHORS
#usr/share/doc/expat/changelog
#usr/share/man/man1/xmlwf.1
diff --git a/lfs/expat b/lfs/expat
index 512cb5a76..b5f9466e4 100644
--- a/lfs/expat
+++ b/lfs/expat
@@ -24,7 +24,7 @@
include Config
-VER = 2.8.4
+VER = 2.8.5
THISAPP = expat-$(VER)
DL_FILE = $(THISAPP).tar.xz
@@ -40,7 +40,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = bec06d3c3179115692edb5e9366412361abae5355b131a005ef91aaa041bf4ebf74a86cc2fac29c44730a07cba6fbda988a6bfdafafc9eeba25a00fb98e43d24
+$(DL_FILE)_BLAKE2 = 7d10459714722c6e4e858da92d3f7def6950240275ad5054b97f5d7612524f2813b8add75d6693698c8e7cdb4a64f73750346783e438ff6271dbc80643d51ee7
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread
* [PATCH] rsync: Update to version 3.5.1
2026-09-23 11:45 [PATCH] expat: Update to version 2.8.5 Adolf Belka
@ 2026-09-23 11:45 ` Adolf Belka
0 siblings, 0 replies; 2+ messages in thread
From: Adolf Belka @ 2026-09-23 11:45 UTC (permalink / raw)
To: development; +Cc: Adolf Belka
- Update from version 3.5.0 to 3.5.1
- No change in rootfile
- Changelog
3.5.1
PROTOCOL NUMBER:
- The protocol number was changed to 33.
BUG FIXES:
- Fixed several path-handling regressions from 3.5.0. Explicit sender paths
can again traverse symlinked ancestors without weakening confinement of
paths found during recursive scans. Local and remote-shell `--files-from`
paths are handled as operator-supplied paths rather than paths beneath the
transfer root.
- Fixed access to `/dev/stdin`, `/dev/stdout`, `/dev/stderr` and `/dev/fd/N`
when they refer to pipes or descriptors inside user namespaces. Reading
batch data from a FIFO or process substitution works again.
- Restored `--max-alloc=0` as a spelling for the parser's maximum allocation
limit rather than disabling that limit.
- Fixed restricted-root paths in `rrsync` and detection of an inetd connection
when a daemon is started with a local socket on standard input, as can
happen under ADB without a PTY.
- Allowed `--contimeout` for daemon connections made through `--rsh` without
applying it to ordinary remote-shell transfers.
- Tightened validation of partial-directory state and alternate-destination
paths on the receiver. An alternate-destination leaf symlink is no longer
followed as a basis file.
- Fixed undefined shifts in the bundled zlib code and a FreeBSD amd64 build
failure involving the assembly and SIMD objects.
ENHANCEMENTS:
- Added support for internationalised domain names when the required library
is available at build time.
- Added the number of 4 KiB logical blocks touched to `--stats`. This counts
distinct logical file regions written by the receiver, not physical disk
blocks or disk I/O. It is reported when both peers negotiate protocol 33.
BUILD AND TESTS:
- `install-strip` now honours `STRIP` including during cross-compilation.
- Updated platform tests and fleet-test coverage for the 3.5.0 fixes.
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
---
lfs/rsync | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/lfs/rsync b/lfs/rsync
index 69a2aa469..775eae04a 100644
--- a/lfs/rsync
+++ b/lfs/rsync
@@ -26,7 +26,7 @@ include Config
SUMMARY = Versatile tool for fast incremental file transfer
-VER = 3.5.0
+VER = 3.5.1
THISAPP = rsync-$(VER)
DL_FILE = $(THISAPP).tar.gz
@@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE)
DIR_APP = $(DIR_SRC)/$(THISAPP)
TARGET = $(DIR_INFO)/$(THISAPP)
PROG = rsync
-PAK_VER = 25
+PAK_VER = 26
DEPS = libxxhash
@@ -48,7 +48,7 @@ objects = $(DL_FILE)
$(DL_FILE) = $(DL_FROM)/$(DL_FILE)
-$(DL_FILE)_BLAKE2 = 1a0aaddd9555c14e2b026f4ac9aff0c0b7760a5809fc80c7872b382a0b9b4719dcc0d382c0e43439955efd855ffa2dff101c10a86529b88fd380205cc9506179
+$(DL_FILE)_BLAKE2 = 513d03ddadf484424c90755f8d3a947993fdbac3fd7e7b2cdc675e25096f376d7086318be904efd32071d4ba27a06bdaf2875a2086e94f7bd5a7cc9fbdf065ef
install : $(TARGET)
--
2.55.0
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-23 11:45 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-23 11:45 [PATCH] expat: Update to version 2.8.5 Adolf Belka
2026-09-23 11:45 ` [PATCH] rsync: Update to version 3.5.1 Adolf Belka
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox