textproc/libxml2: really update to 2.15.1 Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/blob/2.15/NEWS Notably, all documentation generation requires a circular dependency on textproc/libxslt. While the API documentation, in HTML, lives on the upstream site [0], the man pages are now pre-rendered manually. Also includes an upstream commit addressing unsafe pointer usage in XPath, leading to security bugs in consumers like libxslt (CVE-2025-10911). [1] Mark the -python child port DEPRECATED without expiration date since upstream has not provided a firm one yet, particularly the release schedule for the next major version 2.16. [0] https://gnome.pages.gitlab.gnome.org/libxml2/html/index.html [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/0e50b31902cdb1eb242eb361c123e9e033b2af87 Event: Snowstorm Special January 2026 With hat: desktop PR: 291316fc6c145ef0
Port details
textproc/libxml2-python2.15.4
Python interface for XML parser library for GNOME
- Maintainer
- desktop@FreeBSD.org
- Packages
- py312-libxml2-python 2.15.4
- Upstream
- up to date
- CPE
xmlsoft:libxml2-pythonfrom the port- WWW
- http://xmlsoft.org/
- Links
- cgit · VuXML
Unaddressed (0) · The CVE record lists this version as affected, no VuXML entry names the CVE
None. There is no CVE without a VuXML entry for this version.
VuXML only (0) · listed, port not fixed yet
None.
pkg audit reports nothing for this version.Fixed (0)
No VuXML entries for this package.
Commits (4)
Revert "textproc/libxml2*: update to 2.15.1, split -core" The design of this update was repeatedly rejected in the linked PR with a prescribed different design. This commit is therefore unauthorised. This reverts commit 099bd713e09ebdd02d73fde770c50706f980404f. With hat: desktop (textproc/libxml2), gnome (USES=gnome) PR: 2913165137742117
textproc/libxml2*: update to 2.15.1, split -core libxml2 now requires xsltproc from libxslt to build, yet libxslt depends on libxml2, so we need to break a dependency cycle. documentation needed to be split out to a separate port. libxml2 has therefore been split into two ports, * libxml2 builds the documentation (unless disabled), * library and executables in libxml2-core. Pull in one contributor patch suggested by the former libxml2 maintainer to address one downstream security issue in recent libxslt versions. This should address arrowd@'s hint that installing libxml2 should provide a full-featured package. While here, deprecate libxml2-python according to upstream plans, we have very few users in the ports tree, and expire end of 2026Q1. PR: 291316099bd713e0
textproc/libxml2: update to 2.14.4 Changelog: https://gitlab.gnome.org/GNOME/libxml2/-/blob/v2.14.4/NEWS textproc/py-libxml2 child port is moved to textproc/libxml2-python to match the Python package name upstream specified; it now USES=python to build after do-configure. Consumers adjusted to match. Includes two bug-fix commits. PR: 279705571565734d