XML 1.0 parser written in C
libexpat_project:libexpat from the portpkg audit reports nothing for this version.CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411, CVE-2026-56412
no CVE referenced
no CVE referenced
textproc/expat2: Update to 2.9.0 Changelog: https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes PR: 299158 Reviewed by: desktop (arrowd) Security: CVE-2026-102633 CVE-2026-77214 Exp-run by: antoine62a7a0bdb8
textproc/expat2: Update to 2.8.5 Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes PR: 298799 Reviewed by: desktop (arrowd) Security: CVE-2026-93990 Exp-run by: antoine (and for previous version, 2.8.4)96db14ee08
textproc/expat2: Update to 2.8.4 Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_4/expat/Changes PR: 298081 Reviewed by: desktop (arrowd) Security: CVE-2026-66046 CVE-2026-76641 CVE-2026-76957 CVE-2026-76956238e9ba61a
textproc/expat2: Update to 2.8.3 Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/Changes PR: 297428 Reviewed by: desktop (arrowd) Security: CVE-2026-72522 Exp-run by: antoine28a4219a72
textproc/expat2: Update to 2.8.2 Fixes multiple security issues and bugs Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes PR: 296191 Reviewed by: desktop (arrowd) Security: CVE-2026-50219 CVE-2026-56131 CVE-2026-56132 CVE-2026-56403 CVE-2026-56404 CVE-2026-56405 CVE-2026-56406 CVE-2026-56407 CVE-2026-56408 CVE-2026-56409 CVE-2026-56410 CVE-2026-56411 CVE-2026-564129e174b97b9
textproc/expat2: [security] upgrade to 2.8.1 See https://blog.hartwork.org/posts/expat-2-8-1-released/ Fixes: CVE-2026-45186 and CVSS unreliability Security: CVE-2026-45186 MFC after: 1 day PR: 295206 Approved by: vishwin709eee0a0c
textproc/expat2: Update to 2.8.0 Changelog: https://github.com/libexpat/libexpat/blob/R_2_8_0/expat/Changes PR: 294769 Reviewed by: desktop (arrowd)8d36ef1d28
textproc/expat2: Update to 2.7.5 Fixes CVE-2026-32776 , CVE-2026-32777 and CVE-2026-32778 Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes PR: 293886 Reviewed by: desktop (arrowd) Exp-run by: antoinea09d6c6e49
textproc/expat2: security update 2.7.3 -> 2.7.4 ChangeLog: https://github.com/libexpat/libexpat/compare/R_2_7_3...R_2_7_4 PR: 293033 Approved by: fluffy (on behalf of ports-secteam)94e627043b
textproc/expat2: Update to 2.7.3 Fix alignment of internal allocations for some non-amd64 - CVE-2025-59375 Fix regression from CVE-2024-8176 Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_3/expat/Changes PR: 289827 Reviewed by: desktop (arrowd) Exp-run by: antoinee2a4613d34
textproc/expat2: security update to 2.7.2 PR: 2896657b2254062b
textproc/expat2: Update to 2.7.1 Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_1/expat/Changes PR: 285730 Approved by: desktop (fluffy) Exp-run by: antoine18be59be30
textproc/expat2: Update to 2.7.0 Fixes CVE-2024-8176 Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_0/expat/Changes PR: 285424 Reviewed by: desktop (fluffy) Exp-run by: antoinea627ba49b6
textproc/expat2: Update to 2.6.4 Fixes CVE-2024-50602 Changelog: https://github.com/libexpat/libexpat/blob/R_2_6_4/expat/Changes PR: 282637 Approved by: portmgr (maintainer timeout, 2+ weeks) and discussed with fluffy on Matrix228c77f4f8
textproc/expat2: Update to 2.6.3 Fixes CVEs: CVE-2024-45490 CVE-2024-45491 CVE-2024-45492 * Remove GNU_CONFIGURE_MANPREFIX Changelog: https://github.com/libexpat/libexpat/blob/R_2_6_3/expat/Changes PR: 281273 Approved by: desktop (fluffy) Exp-run by: antoinef5cfb7ec00
textproc/expat2: Update to 2.6.2 Fixes CVE-2024-28757 Changelog https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes PR: 277772 Approved by: desktop (tcberner) Sponsored by: Blinkinblox Exp-run by: antoinebf99270dd4
textproc/expat2: Update to 2.6.1 Changelog: https://github.com/libexpat/libexpat/blob/R_2_6_1/expat/Changes PR: 277463 Approved by: desktop (tcberner) Sponsored by: Blinkinblox Exp-run by: antoine6e1ffc013a
textproc/expat2: Moved man to share/man Approved by: portmgr (blanket)649fcbe5fc
textproc/expat2: Update to 2.6.0 Fixes CVE-2023-52425 and CVE-2023-52426 Changelog: https://github.com/libexpat/libexpat/blob/R_2_6_0/expat/Changes References: https://www.cve.org/CVERecord?id=CVE-2023-52425 https://www.cve.org/CVERecord?id=CVE-2023-52426 PR: 276946 Approved by: desktop (tcberner) Exp-run by: antoinebc9951864f
MANPREFIX: eliminate usage of MANPREFIX While here move some manpages to share/man7074d7f6ae
textproc/expat2: Update to 2.5.0 PR: 267398 Approved by: tcberner, antoine59c13e4a5f
textproc/expat2: update to 2.4.9
Release 2.4.9 Tue September 20 2022
Security fixes:
#629 #640 CVE-2022-40674 -- Heap use-after-free vulnerability in
function doContent. Expected impact is denial of service
or potentially arbitrary code execution.
Bug fixes:
#634 MinGW: Fix mis-compilation for -D__USE_MINGW_ANSI_STDIO=0
#614 docs: Fix documentation on effect of switch XML_DTD on
symbol visibility in doc/reference.html
Other changes:
#638 MinGW: Make fix-xmltest-log.sh drop more Wine bug output
#596 #625 Autotools: Sync CMake templates with CMake 3.22
#608 CMake: Migrate from use of CMAKE_*_POSTFIX to
dedicated variables EXPAT_*_POSTFIX to stop affecting
other projects
#597 #599 Windows|CMake: Add missing -DXML_STATIC to test runners
and fuzzers
#512 #621 Windows|CMake: Render .def file from a template to fix
linking with -DEXPAT_DTD=OFF and/or -DEXPAT_ATTR_INFO=ON
#611 #621 MinGW|CMake: Apply MSVC .def file when linking
#622 #624 MinGW|CMake: Sync library name with GNU Autotools,
i.e. produce libexpat-1.dll rather than libexpat.dll
by default. Filename libexpat.dll.a is unaffected.
#632 MinGW|CMake: Set missing variable CMAKE_RC_COMPILER in
toolchain file "cmake/mingw-toolchain.cmake" to avoid
error "windres: Command not found" on e.g. Ubuntu 20.04
#597 #627 CMake: Unify inconsistent use of set() and option() in
context of public build time options to take need for
set(.. FORCE) in projects using Expat by means of
add_subdirectory(..) off Expat's users' shoulders
#626 #641 Stop exporting API symbols when building a static library
#644 Resolve use of deprecated "fgrep" by "grep -F"
#620 CMake: Make documentation on variables a bit more consistent
#636 CMake: Drop leading whitespace from a #cmakedefine line in
file expat_config.h.cmake
#594 xmlwf: Fix harmless variable mix-up in function nsattcmp
#592 #593 #610 Address Cppcheck warnings
#643 Address Clang 15 compiler warnings
#642 #644 Version info bumped from 9:8:8 to 9:9:8;
see https://verbump.de/ for what these numbers do
Infrastructure:
#597 #598 CI: Windows: Start covering MSVC 2022
#619 CI: macOS: Migrate off deprecated macOS 10.15
#632 CI: Linux: Make migration off deprecated Ubuntu 18.04 work
#643 CI: Upgrade Clang from 14 to 15
#637 apply-clang-format.sh: Add support for BSD find
#633 coverage.sh: Exclude MinGW headers
#635 coverage.sh: Fix name collision for -funsigned-char
Special thanks to:
David Faure
Felix Wilhelm
Frank Bergmann
Rhodri James
Rosen Penev
Thijs Schreijer
Vincent Torri
and
Google Project Zero
Exp-run by: antoine
PR: 2665249901fd092aRemove WWW entries moved into port Makefiles Commit b7f05445c00f has added WWW entries to port Makefiles based on WWW: lines in pkg-descr files. This commit removes the WWW: lines of moved-over URLs from these pkg-descr files. Approved by: portmgr (tcberner)fb16dfecae
Add WWW entries to port Makefiles It has been common practice to have one or more URLs at the end of the ports' pkg-descr files, one per line and prefixed with "WWW:". These URLs should point at a project website or other relevant resources. Access to these URLs required processing of the pkg-descr files, and they have often become stale over time. If more than one such URL was present in a pkg-descr file, only the first one was tarnsfered into the port INDEX, but for many ports only the last line did contain the port specific URL to further information. There have been several proposals to make a project URL available as a macro in the ports' Makefiles, over time. This commit implements such a proposal and moves one of the WWW: entries of each pkg-descr file into the respective port's Makefile. A heuristic attempts to identify the most relevant URL in case there is more than one WWW: entry in some pkg-descr file. URLs that are not moved into the Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr files in order to preserve them. There are 1256 ports that had no WWW: entries in pkg-descr files. These ports will not be touched in this commit. The portlint port has been adjusted to expect a WWW entry in each port Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as deprecated. Approved by: portmgr (tcberner)b7f05445c0
textproc: remove 'Created by' lines A big Thank You to the original contributors of these ports: * "Choe, Cheng-Dae" whitekid * - * <glewis@FreeBSD.org> * <koshy@india.hp.com> * Aaron Dalton <aaron@FreeBSD.org> * Aaron Dalton <aaron@daltons.ca> * Aaron Straup Cope * Aaron Straup Cope <ascope@cpan.org> * Ache * Adam Herzog <adam@herzogdesigns.com> * Adam Weinberger <adamw@FreeBSD.org> * Ade Lovett <ade@FreeBSD.org> * Akinori MUSHA aka knu <knu@FreeBSD.org> * Akinori MUSHA aka knu <knu@idaemons.org> * Alan Eldridge <alane@FreeBSD.org> * Alex Dupre <ale@FreeBSD.org> * Alex Kapranoff <kappa@FreeBSD.org.ua> * Alexander Logvinov <ports@logvinov.com> * Alexander Nedotsukov <bland@FreeBSD.org> * Alexander Zhuravlev <zaa@zaa.pp.ru> * Alexander@Leidinger.net * Alexandre Biancalana <ale@biancalanas.net> * Alexey Dokuchaev <danfe@FreeBSD.org> * Alexis Praga <alexis.praga@free.fr> * Andreas Heil <ah@linux-hq.de> * Andrei V. Shetuhin <reki@reki.ru> * Andrej Zverev <andrey.zverev@electro-com.ru> * Andrew <andrew@ugh.net.au> * Andrew Humphrey <ahumphrey@realestate.com.au> * Andrew Lewis <freeghb@gmail.com> * Andrew Pantyukhin <infofarmer@FreeBSD.org> * Andrew Romero <melanhit@gmail.com> * Andrey Kostenko <andrey@kostenko.name> * Andrey Zakhvatov * Andrey Zakhvatov <andy@FreeBSD.org> * Anes Mukhametov <anes@anes.su> * Antoine Brodin <antoine@FreeBSD.org> * Anton Berezin <tobez@FreeBSD.org> * Anton Berezin <tobez@tobez.org> * Anton Yudin <toha@toha.org.ua> * Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>) * Ashish SHUKLA <wahjava@gmail.com> * Autrijus Tang <autrijus@autrijus.org> * Babak Farrokhi <farrokhi@FreeBSD.org> * Ben Haga <tuxsuximus@hotmail.com> * Ben Woods <woodsb02@FreeBSD.org> * Benno Rice <benno@jeamland.net> * Bill "I hate Perl" Fumerola * Bill Brinzer <bill.brinzer@gmail.com> * Bill Fumerola <billf@chc-chimes.com> * Bill Swingle <unfurl@FreeBSD.org> * Bob Eager <rde@ml1.org.uk> * Boris Samorodov <bsam@FreeBSD.org> * Brian Candler <B.Candler@pobox.com> * Brion Moss <brion@queeg.com> * Carlos J Puga Medina <cpm@fbsd.es> * Carlos J. Puga Medina <cpm@FreeBSD.org> * Cezary Morga <cm@therek.net> * Cheng-Lung Sung <clsung@FreeBSD.org> * Cheng-Lung Sung <clsung@dragon2.net> * Chris D. Faulhaber <jedgar@fxp.org> * Chris Hutchinson <portmaster@bsdforge.com> * Christoper Key <cjk32@cam.ac.uk> * Clemens Zauner <czauner+ports@onlineloop.com> * Cyrille Lefevre <clefevre@citeweb.net> * Dan Langille <dvl@FreeBSD.org> * Daniel Roethlisberger <daniel@roe.ch> * Danilo G. Baio <dbaio@FreeBSD.org> * David Bremner <bremner@unb.ca> * David O'Brien (obrien@FreeBSD.org) * David Sze <dsze@alumni.uwaterloo.ca> * Denis Pokataev <catone@cpan.org> * Dennis Herrmann <dhn@FreeBSD.org> * Dereckson <dereckson@gmail.com> * Dikshie * Dikshie <dikshie@sfc.wide.ad.jp> * Dima Sivachenko <demon@gpad.ac.ru> * Dirk Froemberg <dirk@FreeBSD.org> * Ditesh Shashikant Gathani <ditesh@gathani.org> * Dmitry Morozovsky <marck@FreeBSD.org> * Dmitry Sivachenko <demon@FreeBSD.org> * Dom Mitchell <dom@happygiraffe.net> * Don Croyle <croyle@gelemna.org> * Donald Burr <dburr@FreeBSD.org> * Douglas Thrift <douglas@douglasthrift.net> * Dru Lavigne <dru@FreeBSD.org> * Dryice Liu <dryice@dryice.name> * Ed Schouten <ed@FreeBSD.org> * Edward Tomasz Napierala <trasz@FreeBSD.org> * Elvis Chiang <elvis@sslab.cs.ccu.edu.tw> * Emanuel Haupt <ehaupt@FreeBSD.org> * Emanuel Haupt <ehaupt@critical.ch> * Eric A. Griff <eric@talesfromthereal.com> * Eric Freeman <freebsdports@chillibear.com> * Erik Greenwald <erik@smluc.org> * Ernst de Haan <znerd@FreeBSD.org> * Erwin Lansing <erwin@FreeBSD.org> * Espen Tagestad <espen@tagestad.no> * Eugene Furs <justas@mbank.lv> * Felippe de Meirelles Motta <lippemail@gmail.com> * Felix Palmen <felix@palmen-it.de> * Fernan Aguero <fernan@iib.unsam.edu.ar> * Filip Parag <filip@parag.rs> * Foxfair Hu <foxfair@FreeBSD.org> * Freddie Cash <fcash@sd73.bc.ca> * Frederic Culot <culot@FreeBSD.org> * Frederic Dubuy <fdubuy@free.fr> * Gabor Kovesdan <gabor@FreeBSD.org> * Garrett Rooney <rooneg@electricjellyfish.net> * Gasol Wu <gasol.wu@gmail.com> * Gea-Suan Lin <gslin@gslin.org> * Geoffroy Desvernay <dgeo@centrale-marseille.fr> * George Hartzell <hartzell@fruitfly.org> * Gerald Pfeifer <gerald@pfeifer.com> * Gerrit Beine <gerrit.beine@gmx.de> * Glenn Trewitt <glenn@trewitt.org> * Goran Tal <goran.tal@gmail.com> * Graham Todd <gtodd@bellanet.org> * Greg Larkin <glarkin@FreeBSD.org> * Greg Lewis <glewis@FreeBSD.org> * Grzegorz Blach <gblach@FreeBSD.org> * Guangyuan Yang <ygy@FreeBSD.org> * Hansjoerg Pehofer <hansjoerg.pehofer@uibk.ac.at> * Henrik Motakef <henrik.motakef@web.de> * Henry Hu <henry.hu.sh@gmail.com> * Herve Quiroz <herve.quiroz@esil.univ-mrs.fr> * Herve Quiroz <hq@FreeBSD.org> * Hiroki Sato <hrs@FreeBSD.org> * Horia Racoviceanu <horia@racoviceanu.com> * Hye-Shik Chang <perky@fallin.lv> * Ian Vaudrey <i.vaudrey@bigfoot.com> * Ilya A. Arkhipov <rum1cro@yandex.ru> * Jaap Boender <jaapb@kerguelen.org> * James Earl * James Flemer <jflemer@alum.rpi.edu> * James Raftery <james@now.ie> * Jason Burgess <dev@fenux.net> * Jason Helfman <jgh@FreeBSD.org> * Jean-Baptiste Quenot <jb.quenot@caraldi.com> * Jean-Yves Lefort <jylefort@brutele.be> * Jeff Putsch <jdputsch@comcast.net> * Jeremy Shaffner <jeremy@external.org> * Jie Gao <gaoj@cpsc.ucalgary.ca> * Jim Mock <jim@FreeBSD.org> * Jin-Shan Tseng <tjs@cdpa.nsysu.edu.tw> * Joe Marcus Clarke <marcus@FreeBSD.org> * Johann Visagie <johann@egenetics.com> * Johann Visagie <wjv@FreeBSD.org> * Johannes Jost Meixner <xmj@FreeBSD.org> * Johannes Meixner <johannes@perceivon.net> * John MacFarlane <jgm@berkeley.edu> * John Marino <marino@FreeBSD.org> * Jonathan Chen <jonc@chen.org.nz> * Jos Backus <josb@cncdsl.com> * Joseph Koshy <jkoshy@FreeBSD.org> * Josh Gilliam <josh@quick.net> * Jov <amutu@amutu.com> * Jui-Nan Lin <jnlin@csie.nctu.edu.tw> * Julien Laffaye <kimelto@gmail.com> * Jun Kuriyama <kuriyama@opt.phys.waseda.ac.jp> * Jyun-Yan You <jyyou@cs.nctu.edu.tw> * KANOU Hiroki <kanou@khdd.net> * KIMURA Yasuhiro <yasu@utahime.org> * KIRIYAMA Kazuhiko <kiri@FreeBSD.org> * Ka Ho Ng <khng300@gmail.com> * Kay Lehmann <kay_lehmann@web.de> * Kevin Lo <kevlo@FreeBSD.org> * Kimura Fuyuki <fuyuki@hadaly.org> * Kimura Fuyuki <fuyuki@mj.0038.net> * Kimura Fuyuki <fuyuki@nigredo.org> * Konstantin Menshikov <kostjnspb@yandex.ru> * Koop Mast <kwm@FreeBSD.org> * Kouichi ABE (WALL) <kouichi@mysticwall.com> * Kris Kennaway <kris@FreeBSD.org> * Kris Moore <kmoore@FreeBSD.org> * Kuan-Chung Chiu <buganini@gmail.com> * Kubilay Kocak <koobs@FreeBSD.org> * Kurt Lidl <kurt.lidl@cello.com> * Lars Balker Rasmussen <lbr@FreeBSD.org> * Lars Engels <lme@FreeBSD.org> * Lars Thegler <lars@thegler.dk> * Lars Thegler <lth@FreeBSD.org> * Leland Wang <llwang@infor.org> * Leo Kim <leo@florida.sarang.net> * Lev Serebryakov <lev@serebryakov.spb.ru> * Li-Wen Hsu <lwhsu@FreeBSD.org> * Loic Pefferkorn <loic-freebsd@loicp.eu> * MANTANI Nobutaka <nobutaka@FreeBSD.org> * MIHIRA Yoshiro <sanpei@FreeBSD.org> * Marcin Cieslak * Marcin Jessa <yazzy@yazzy.org> * Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org> * Mark Pulford <mark@kyne.com.au> * Mark R V Murray <mark@grondar.za> * Martin Kammerhofer * Martin Matuska <mm@FreeBSD.org> * Martin Wilke <miwi@FreeBSD.org> * Marwan Burelle <marwan.burelle@lri.fr * Masahiro Teramoto <markun@onohara.to> * Mathieu Arnold <m@absolight.net> * Matt Mills <matt_mills@btopenworld.com> * Matthew Fuller <fullermd@over-yonder.net> * Matthew Seaman * Matthias Fechner <mfechner@FreeBSD.org> * Mauricio Herrera Cuadra <mauricio@arareko.net> * Max Baryshnikov <mephius@gmail.com> * Max N. Boyarov <m.boyarov@gmail.com> * Maxim Sobolev <sobomax@FreeBSD.org> * Meno Abels <meno.abels@adviser.com> * Michael Johnson <ahze@FreeBSD.org> * Michael Johnson <ahze@ahze.net> * Michael Moll <kvedulv@kvedulv.de> * Michael Ranner <michael@ranner.eu> * Michael Schout <mschout@gkg.net> * Mike Bristow <mike@urgle.com> * Mikhail Teterin <mi@aldan.algebra.com> * Moggie <moggie@elasticmind.net> * Mykola Dzham <freebsd@levsha.org.ua> * Naram Qashat <cyberbotx@cyberbotx.com> * Neil Booth * Nicola Stanislao Vitale <nivit@FreeBSD.org * Nicola Stanislao Vitale <nivit@FreeBSD.org> * Nicola Vitale <nivit@FreeBSD.org> * Nicola Vitale <nivit@email.it> * Nik Clayton <nik@FreeBSD.org> * Nikola Lecic <nikola.lecic@anthesphoria.net> * Nosov Artem <chip-set@mail.ru> * Oleg Mamontov <oleg@mamontov.net> * Oliver Braun <obraun@informatik.unibw-muenchen.de> * Oliver Eikemeier <eikemeier@fillmore-labs.com> * Oliver Lehmann (oliver@FreeBSD.org) * Olivier Duchateau * Olivier Duchateau <olivierd@FreeBSD.org> * Olivier Girard <Olivier.Girard@univ-angers.fr> * Patrick Li <pat@databits.net> * Patrick Powell <papowell@astart.com> * Pav Lucistnik <pav@FreeBSD.org> * Pav Lucistnik <pav@oook.cz> * Pavel Timofeev <timp87@gmail.com> * Pawel Pekala <pawel@FreeBSD.org> * Pedro Giffuni * Pedro Giffuni <pfg@FreeBSD.org> * Pete Fritchman <petef@databits.net> * Peter Johnson <johnson.peter@gmail.com> * Peter Pentchev <roam@FreeBSD.org> * Peter Schuller <peter.schuller@infidyne.com> * Petteri Valkonen <petteri.valkonen@iki.fi> * Pietro Cerutti <gahr@gahr.ch> * Piotr Kubaj <pkubaj@anongoth.pl> * Piotr Rybicki <meritus@innervision.pl> * Po-Chuan Hsieh <sunpoet@FreeBSD.org> * Radim Kolar <hsn@sanatana.dharma> * Rainer Hurling <rhurlin@gwdg.de> * Rene Ladan <rene@FreeBSD.org> * René Ladan <rene@freebsd.org> * Richard Gallamore <ultima@FreeBSD.org> * Rick van der Zwet <info@rickvanderzwet.nl> * Robert Gogolok <gogo@cs.uni-sb.de> * Rod Taylor <ports@rbt.ca> * Rodrigo OSORIO <rodrigo@FreeBSD.org> * Roger Leigh <rleigh@codelibre.net> * Rong-En Fan <rafan@infor.org> * Rusmir Dusko <nemysis@FreeBSD.org> * Russell Cloran <russell@rucus.ru.ac.za> * Russell Jackson <raj@csub.edu> * Ryan Steinmetz <zi@FreeBSD.org> * Samuel Tardieu <sam@inf.enst.fr> * Sascha Holzleiter <sascha@root-login.org> * Scott Sanders <scott@jssjr.com> * Seamus Venasse <svenasse@polaris.ca> * Serge Gagnon <ser_gagnon@sympatico.ca> * Sergei Kolobov <sergei@kolobov.com> * Sergei Vyshenski <svysh.fbsd@gmail.com> * Sergey A. Osokin <osa@FreeBSD.org> * Sergey Skvortsov <skv@FreeBSD.org> * Sergey Skvortsov <skv@protey.ru> * Shen Chun-Hsing <statue@freebsd.netlab.cse.yzu.edu.tw> * Shinsuke Matsui <smatsui@karashi.org> * Silvio Ap Silva aka kanazuchi <alvolivre@live.com> * Simon 'corecode' Schubert <corecode@corecode.ath.cx> * Simon Olofsson <simon@olofsson.de> * Soeren Boll Overgaard <boll@tolkien.dk> * Sofian Brabez <sbz@FreeBSD.org> * Stanislav Svirid <count@211.ru> * Stefan Esser <se@FreeBSD.org> * Stefan Pauly <stefan@fh-mainz.de> * Stefan Walter <sw@gegenunendlich.de> * Stephen Montgomery-Smith <stephen@math.missouri.edu> * Stephen Roznowski (sjr@home.com) * Stephon Chen <stephon@gmail.com> * Steve Wills <swills@FreeBSD.org> * Steve Wills <swills@rubick> * Steven Kreuzer <skreuzer@FreeBSD.org> * Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org> * Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net> * Sven R <freebsd@hackacad.net> * Sébastien Santoro <dereckson@gmail.com> * TAKAHASHI Kaoru <kaoru@kaisei.org> * TAKATSU Tomonari <tota@FreeBSD.org> * TAKATSU Tomonari <tota@rtfm.jp> * TERAMOTO Masahiro <markun@onohara.to> * Thierry Thomas <thierry@FreeBSD.org> * Thierry Thomas <thierry@pompo.net> * Thomas Gellekum <tg@FreeBSD.org> * Thorsten Greiner <thorsten.greiner@web.de> * Tilman Linneweh <arved@FreeBSD.org> * Timothy Beyer <beyert@cs.ucr.edu> * Timur Bakeyev <bat@cpan.org> * Timur I. Bakeyev <timur@gnome.org> * Toby Allsopp <toby@mi6.gen.nz> * Tom Judge <tj@FreeBSD.org> * Tom Judge <tom@tomjudge.com> * Tom Sparks <tsparks@appliedops.net> * Tomoyuki Sakurai <cherry@trombik.org> * Torsten Zuehlsdorff <ports@toco-domains.de> * Torsten Zuehlsdorff <tz@FreeBSD.org> * Travis Campbell <hcoyote@ghostar.org> * Tsung-Han Yeh <snowfly@yuntech.edu.tw> * Ulrich Spoerlein <uqs@FreeBSD.org> * Ulrich Spoerlein <uspoerlein@gmail.com> * Uwe Pierau <uwe.pierau@tu-clausthal.de> * Vadim Vatlin * Vany <ivan@serezhkin.com> * Vasek Balcar <vasek@ti.cz> * Veniamin Gvozdikov <vg@FreeBSD.org> * Vidar Karlsen <vidar@karlsen.tech> * Vivek Khera <vivek@khera.org> * Volker Stolz <vs@FreeBSD.org> * Vsevolod Stakhov <vsevolod@highsecure.ru> * Waitman Gobble <waitman@waitman.net> * Wen Heping <wen@FreeBSD.org> * Wen Heping <wenheping@gmail.com> * Wen Heping<wen@FreeBSD.org> * Will Andrews <will@FreeBSD.org> * William Grzybowski <wg@FreeBSD.org> * Xavier Humbert <xavier@amdh.fr> * Xin LI <delphij@FreeBSD.org> * Yarema <yds@CoolRat.org> * Yarema <yds@Necessitu.de> * Yen-Ming Lee <leeym@FreeBSD.org> * Yen-Ming Lee <leeym@cae.ce.ntu.edu.tw> * Yi-Jheng Lin <yzlin@cs.nctu.edu.tw> * Ying-Chieh Liao <ijliao@FreeBSD.org> * Ying-Chieh Liao <ijliao@csie.nctu.edu.tw> * Yinghong Liu <relaxbsd@gmail.com> * Yinghong.Liu <relaxbsd@gmail.com> * Yoshiro MIHIRA <sanpei@sanpei.org> * Yoshiro MIHIRA <sanpei@yy.cs.keio.ac.jp> * Yuan-Chung Hsiao <ychsiao@ychsiao.org> * Yukihiro Nakai <Nakai@technologist.com> * Yuri Pankov <yuri.pankov@gmail.com> * Yuri Victorovich <yuri@rawbw.com> * Zane C. Bowers-Hadley <vvelox@vvelox.net> * Zeus Panchenko <zeus@gnu.org.ua> * Zhen REN <bg1tpt@gmail.com> * Zhihao Yuan <lichray@gmail.com> * ache * andreas@marvin.robin.de * andrey@kostenko.name * anholt@FreeBSD.org * antoine@FreeBSD.org * arved * b.f. <bf@FreeBSD.org> * bf@FreeBSD.org * brett@peloton.physics.montana.edu * buganini@gmail.com * chinsan * chinsan <chinsan.tw@gmail.com> * chinsan <chinsan@mail2000.com.tw> * clsung * clsung@dragon2.net * dannyman <dannyman@tellme.com> * dd * domi@saargate.de * eivind * eric * faber@lunabase.org * fenner * fenner@FreeBSD.org * gahr * gugabsd <gugabsd@mundounix.com.br> * gurkan@phys.ethz.ch * ijliao * jabley@automagic.org * janos.mohacsi@bsd.hu * jfieber * jkoshy * john@zoner.org * jupengfei <jupengfei@gmail.com> * kai * kevit * king@v2project.com * kuriyama * lars.eggert@gmx.net * lbartoletti <lbartoletti@FreeBSD.org> * lofi@FreeBSD.org * lth@FreeBSD.org * mainland@apeiron.net * mandree@FreeBSD.org * markm@FreeBSD.org * meyser@xenet.de * mike * milki <milki@rescomp.berkeley.edu> * nectar * nik * nivit@users.sourceforge.net * nork@FreeBSD.org * paulh@logicsquad.net * petef@databits.net * peter.schuller@infidyne.com * philip@p6m7g8.com * ports@c0decafe.net * reed@pugetsoundtechnology.com * rfarmer@predatorlabs.net * risner@stdio.com * scheidell@secnap.net * shige * skreuzer * snowchyld * steve * sumikawa@FreeBSD.org * sumikawa@kame.net * thierry@pompo.net * tj@FreeBSD.org * trasz * trevor * vanilla * wen@FreeBSD.org * wosch * znerd@FreeBSD.org With hat: portmgr5cf7e35e86
textproc/expat2: update to 2.4.8
Release 2.4.8 Mon March 28 2022
Other changes:
#587 pkg-config: Move "-lm" to section "Libs.private"
#587 CMake|MSVC: Fix pkg-config section "Libs"
#55 #582 CMake|macOS: Start using linker arguments
"-compatibility_version <version>" and
"-current_version <version>" in a way compatible with
GNU Libtool
#590 #591 Version info bumped from 9:7:8 to 9:8:8;
see https://verbump.de/ for what these numbers do
Infrastructure:
#589 CI: Upgrade Clang from 13 to 14
Special thanks to:
evpobr
Kai Pastor
Sam James
Exp-run by: antoine
PR: 262944709f05aef0textproc/expat2: update to 2.4.7
From [1]:
Release 2.4.7 Fri March 4 2022
Bug fixes:
#572 #577 Relax fix to CVE-2022-25236 (introduced with release 2.4.5)
with regard to all valid URI characters (RFC 3986),
i.e. the following set (excluding whitespace):
ABCDEFGHIJKLMNOPQRSTUVWXYZ abcdefghijklmnopqrstuvwxyz
0123456789 % -._~ :/?#[]@ !$&'()*+,;=
Other changes:
#555 #570 #581 CMake|Windows: Store Expat version in the DLL
#577 Document consequences of namespace separator choices not just
in doc/reference.html but also in header <expat.h>
#577 Document Expat's lack of validation of namespace URIs against
RFC 3986, and that the XML 1.0r4 specification doesn't
require Expat to validate namespace URIs, and that Expat
may do more in that regard in future releases.
If you find need for strict RFC 3986 URI validation on
application level today, https://uriparser.github.io/ may
be of interest.
#579 Fix documentation of XML_EndDoctypeDeclHandler in <expat.h>
#575 Document that a call to XML_FreeContentModel can be done at
a later time from outside the element declaration handler
#574 Make hardcoded namespace URIs easier to find in code
#573 Update documentation on use of XML_POOR_ENTOPY on Solaris
#569 #571 tests: Resolve use of macros NAN and INFINITY for GNU G++
4.8.2 on Solaris.
#578 #580 Version info bumped from 9:6:8 to 9:7:8;
see https://verbump.de/ for what these numbers do
Special thanks to:
Jeffrey Walton
Johnny Jazeix
Thijs Schreijer
Release 2.4.6 Sun February 20 2022
Bug fixes:
#566 Fix a regression introduced by the fix for CVE-2022-25313
in release 2.4.5 that affects applications that (1)
call function XML_SetElementDeclHandler and (2) are
parsing XML that contains nested element declarations
(e.g. "<!ELEMENT junk ((bar|foo|xyz+), zebra*)>").
Other changes:
#567 #568 Version info bumped from 9:5:8 to 9:6:8;
see https://verbump.de/ for what these numbers do
Special thanks to:
Matt Sergeant
Samanta Navarro
Sergei Trofimovich
and
NixOS
Perl XML::Parser
Release 2.4.5 Fri February 18 2022
Security fixes:
#562 CVE-2022-25235 -- Passing malformed 2- and 3-byte UTF-8
sequences (e.g. from start tag names) to the XML
processing application on top of Expat can cause
arbitrary damage (e.g. code execution) depending
on how invalid UTF-8 is handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
#561 CVE-2022-25236 -- Passing (one or more) namespace separator
characters in "xmlns[:prefix]" attribute values
made Expat send malformed tag names to the XML
processor on top of Expat which can cause
arbitrary damage (e.g. code execution) depending
on such unexpectable cases are handled inside the XML
processor; validation was not their job but Expat's.
Exploits with code execution are known to exist.
#558 CVE-2022-25313 -- Fix stack exhaustion in doctype parsing
that could be triggered by e.g. a 2 megabytes
file with a large number of opening braces.
Expected impact is denial of service or potentially
arbitrary code execution.
#560 CVE-2022-25314 -- Fix integer overflow in function copyString;
only affects the encoding name parameter at parser creation
time which is often hardcoded (rather than user input),
takes a value in the gigabytes to trigger, and a 64-bit
machine. Expected impact is denial of service.
#559 CVE-2022-25315 -- Fix integer overflow in function storeRawNames;
needs input in the gigabytes and a 64-bit machine.
Expected impact is denial of service or potentially
arbitrary code execution.
Other changes:
#557 #564 Version info bumped from 9:4:8 to 9:5:8;
see https://verbump.de/ for what these numbers do
Special thanks to:
Ivan Fratric
Samanta Navarro
and
Google Project Zero
JetBrains
[1] Changelog:
https://github.com/libexpat/libexpat/blob/R_2_4_7/expat/Changes
Exp-run by: antoine
PR: 262381
Security: CVE-2022-25235
Security: CVE-2022-25236
Security: CVE-2022-25313
Security: CVE-2022-25314
Security: CVE-2022-253155a4db4dfb5textproc/expat2: update to 2.4.4
Release 2.4.4 Sun January 30 2022
Security fixes:
#550 CVE-2022-23852 -- Fix signed integer overflow
(undefined behavior) in function XML_GetBuffer
(that is also called by function XML_Parse internally)
for when XML_CONTEXT_BYTES is defined to >0 (which is both
common and default).
Impact is denial of service or more.
#551 CVE-2022-23990 -- Fix unsigned integer overflow in function
doProlog triggered by large content in element type
declarations when there is an element declaration handler
present (from a prior call to XML_SetElementDeclHandler).
Impact is denial of service or more.
Bug fixes:
#544 #545 xmlwf: Fix a memory leak on output file opening error
Other changes:
#546 Autotools: Fix broken CMake support under Cygwin
#554 Windows: Add missing files to the installer to fix
compilation with CMake from installed sources
#552 #554 Version info bumped from 9:3:8 to 9:4:8;
see https://verbump.de/ for what these numbers do
Special thanks to:
Carlo Bramini
hwt0415
Roland Illig
Samanta Navarro
and
Clang LeakSan and the Clang team
PR: 261597
Exp-run by: antoine4c6bb049abtextproc/expat2: update to 2.4.3 From [1]: libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, precisely C99. It is cross-platform and licensed under the MIT license. Expat 2.4.3 has been released earlier today. Besides two minor fixes to the build system, this release is about security fixes. There is a total of 8 CVEs fixed, all related to fixed-size integer math (integer overflow and invalid shifts) near memory allocation. Impact is denial of service, or more. * CVE-2021-45960 * CVE-2021-46143 * CVE-2022-22822 * CVE-2022-22823 * CVE-2022-22824 * CVE-2022-22825 * CVE-2022-22826 * CVE-2022-22827 For more details, please check out the change log [2]. [1] https://blog.hartwork.org/posts/expat-2-4-3-released/ [2] https://github.com/libexpat/libexpat/blob/R_2_4_3/expat/Changes Exp-run by: antoine PR: 26128597d40c6bda
textproc/expat2: Update to 2.4.2 Changelog: https://github.com/libexpat/libexpat/blob/R_2_4_2/expat/Changes PR: 260580 Approved by: tcberner (mentor), desktop (tcberner) Exp-run by: antoine18a7d3dfe3
textproc/expat2: Fix CPE information because current one is deprecated Approved by: portmgr (blanket)3ee2d51df2
textproc/expat2: Add CPE information Approved by: portmgr (blanket)20617299ae
textprox/expat2: update to 2.4.1 -- fixes CVE-2013-0340/CWE-776 See [1] for details: Expat 2.4.0 and follow-up release 2.4.1 have both been released earlier today (21-05-23). Release 2.4.0 fixes long known security issue CVE-2013-0340 by adding protection against so-called Billion Laughs Attacks, a form of denial of service against applications accepting XML input, in all known variations, including recent flavor Parameter Laughs. [1] https://blog.hartwork.org/posts/cve-2013-0340-billion-laughs-fixed-in-expat-2-4-0 PR: 256121 Exp-run by: antoine1454ab4020
textproc/expat: update to 2.3.0 - Move static libraries behind an option STATIC. This will likely be dropped completely in the next update. PR: 254543 Exp-run by: antoined06d7188f3
Remove # $FreeBSD$ from Makefiles.305f148f48
textproc/expat2: Update to 2.2.10 - give maintainership to desktop@ - add test target Changelog: https://github.com/libexpat/libexpat/blob/R_2_2_10/expat/Changes PR: 243228 Submitted by: daniel.engberg.lists@pyret.net Exp-run by: antoine Approved by: Sergei Vyshenski <svysh.fbsd@gmail.com> (previous maintainer)019a03ba98
Manual pages are not subject to DOCS option and typically installed unconditionally, especially when they come pre-built.8027deddcf
textproc/expat2: upgrade 2.2.7 -> 2.2.8 PR: 240613 Submitted by: Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer) Exp-Run by: antoine Relnotes: https://github.com/libexpat/libexpat/blob/R_2_2_8/expat/Changes Security: CVE-2019-159030d6f2996b5
textproc/expat2: upgrade 2.2.6 -> 2.2.7 - exp-run by antoine PR: 238864 Submitted by: Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer) Reviewed by: koobs Relnotes: https://github.com/libexpat/libexpat/blob/R_2_2_7/expat/Changes Security: https://github.com/libexpat/libexpat/issues/186 https://github.com/libexpat/libexpat/pull/2628419628342
Add DOCS options to ports that should have one. Also various fixes related to said option. PR: 230864 Submitted by: mat exp-runs by: antoinee1bfdfbe56
textproc/expat2: configure fails when texproc/docbook-utils has been installed - Build --without-docbook to skip XML to man page compilation - Bump PORTREVISION PR: 230957 Submitted by: cpm Approved by: Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer)d39f2e711b
textproc/expat2: update to 2.2.6 PR: 230653 Submitted by: Sergei Vyshenski <svysh.fbsd@gmail.com> (maintainer) Exp-run by: antoinefc59989bed
Update to 2.2.5. Submitter becomes maintainer after consecutive and lengthy timeouts. PR: 221634 Submitted by: svysh.fbsd@gmail.com Approved by: maintainer timeout (4 months) Exp-run by: antoine5ae8ad1e65
Update to 2.2.1. Security: CVE-2017-9233259449df56
Update WWW: SF redirects to https://sourceforge.net/projects/<PROJECT_NAME>/0e04efec5a
Remove libexpat.so.6 compatibility link that was added in r374303 to prevent massive PORTREVISION bumps. Bump dependent ports that have not been bumped since.eb96de0656
Do not use post-stage. Use post-install instead. The only reason to use post-stage is because the port needs to do "things" at a later time, like some plist manipulation. While there, fold post-install in do-install targets when they are defined. PR: 214780 Submitted by: mat Exp-run by: antoine Sponsored by: Absolight8b4093cba5
- Add LICENSE Approved by: portmgr (blanket)6966ce9047
Update to 2.2.0. PR: 210531 Approved by: maintainer timeout (2 weeks)8d1a1842e2
textproc/expat2: Patch vulnerability This patch resolves a vulnerability that may still exist due to compiler optimizations. The previous patches for CVE-2015-1283 and CVE-2015-2716 may not work as intended in some situations. MFH: 2016Q2 Security: CVE-2016-447266ce3cb3fa