Version in base suite: 2.7.1-2 Version in overlay suite: 2.8.2-1~deb13u1 Base version: expat_2.8.2-1~deb13u1 Target version: expat_2.8.3-1~deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/e/expat/expat_2.8.2-1~deb13u1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/e/expat/expat_2.8.3-1~deb13u1.dsc .ci.sh | 4 - .github/dependabot.yml | 6 + .github/workflows/autotools-cmake.yml | 9 +- .github/workflows/clang-format.yml | 15 ++-- .github/workflows/clang-static-analyzer.yml | 17 ++-- .github/workflows/clang-tidy.yml | 15 ++-- .github/workflows/cmake-required-version.yml | 7 + .github/workflows/codespell.yml | 8 +- .github/workflows/coverage.yml | 14 ++- .github/workflows/coverity-scan.yml | 22 +++--- .github/workflows/cppcheck.yml | 44 ++++++++++-- .github/workflows/emscripten.yml | 10 +- .github/workflows/expat_config_h.yml | 8 +- .github/workflows/freebsd.yml | 9 +- .github/workflows/fuzzing.yml | 21 +++-- .github/workflows/linux.yml | 25 ++++-- .github/workflows/macos.yml | 9 +- .github/workflows/musl.yml | 9 +- .github/workflows/perl-integration.yml | 7 + .github/workflows/solaris.yml | 9 +- .github/workflows/valid-xml.yml | 9 +- .github/workflows/wasi_sdk.yml | 10 +- .github/workflows/windows-binaries.yml | 5 + .github/workflows/windows-build.yml | 12 +++ .github/workflows/zizmor.yml | 53 ++++++++++++++ README.md | 14 ++- debian/changelog | 15 +++- expat/CMake.README | 12 +-- expat/CMakeLists.txt | 29 ++++++-- expat/Changes | 97 +++++++++++++++++++++------ expat/Makefile.am | 3 expat/README.md | 14 ++- expat/cmake/mingw-toolchain-win32.cmake | 37 ++++++++++ expat/cmake/mingw-toolchain-win64.cmake | 37 ++++++++++ expat/cmake/mingw-toolchain.cmake | 37 ---------- expat/configure.ac | 2 expat/coverage.sh | 4 - expat/doc/reference.html | 30 ++++++++ expat/doc/xmlwf.xml | 2 expat/examples/element_declarations.c | 2 expat/examples/elements.c | 2 expat/examples/outline.c | 2 expat/lib/ascii.h | 2 expat/lib/asciitab.h | 2 expat/lib/expat.h | 4 - expat/lib/expat_external.h | 2 expat/lib/fallthrough.h | 2 expat/lib/iasciitab.h | 2 expat/lib/internal.h | 17 +--- expat/lib/latin1tab.h | 2 expat/lib/memory_sanitizer.h | 2 expat/lib/nametab.h | 2 expat/lib/random_arc4random.c | 2 expat/lib/random_arc4random.h | 2 expat/lib/random_arc4random_buf.c | 2 expat/lib/random_arc4random_buf.h | 2 expat/lib/random_dev_urandom.c | 2 expat/lib/random_dev_urandom.h | 2 expat/lib/random_getentropy.c | 2 expat/lib/random_getentropy.h | 2 expat/lib/random_getrandom.c | 2 expat/lib/random_getrandom.h | 2 expat/lib/random_rand_s.c | 2 expat/lib/random_rand_s.h | 2 expat/lib/siphash.h | 2 expat/lib/utf8tab.h | 2 expat/lib/winconfig.h | 2 expat/lib/xcsinc.c | 8 +- expat/lib/xmlparse.c | 74 +++++++++++++------- expat/lib/xmlrole.c | 2 expat/lib/xmlrole.h | 2 expat/lib/xmltok.c | 17 +++- expat/lib/xmltok.h | 10 +- expat/lib/xmltok_impl.c | 2 expat/lib/xmltok_impl.h | 2 expat/lib/xmltok_ns.c | 2 expat/tests/acc_tests.c | 2 expat/tests/acc_tests.h | 2 expat/tests/alloc_tests.c | 2 expat/tests/alloc_tests.h | 2 expat/tests/basic_tests.c | 33 ++++++++- expat/tests/basic_tests.h | 2 expat/tests/chardata.c | 2 expat/tests/chardata.h | 2 expat/tests/common.c | 2 expat/tests/common.h | 2 expat/tests/dummy.c | 2 expat/tests/dummy.h | 2 expat/tests/handlers.c | 2 expat/tests/handlers.h | 2 expat/tests/memcheck.c | 2 expat/tests/memcheck.h | 2 expat/tests/minicheck.c | 2 expat/tests/minicheck.h | 2 expat/tests/misc_tests.c | 71 +++++++++++++++++++ expat/tests/misc_tests.h | 2 expat/tests/ns_tests.c | 2 expat/tests/ns_tests.h | 2 expat/tests/nsalloc_tests.c | 2 expat/tests/nsalloc_tests.h | 2 expat/tests/runtests.c | 2 expat/tests/structdata.c | 2 expat/tests/structdata.h | 2 expat/win32/expat.iss | 2 expat/xmlwf/codepage.c | 2 expat/xmlwf/codepage.h | 2 expat/xmlwf/ct.c | 2 expat/xmlwf/filemap.h | 2 expat/xmlwf/readfilemap.c | 2 expat/xmlwf/unixfilemap.c | 2 expat/xmlwf/win32filemap.c | 2 expat/xmlwf/xmlfile.c | 2 expat/xmlwf/xmlfile.h | 2 expat/xmlwf/xmlmime.c | 2 expat/xmlwf/xmlmime.h | 2 expat/xmlwf/xmltchar.h | 2 expat/xmlwf/xmlwf.c | 2 expat/xmlwf/xmlwf_helpgen.py | 2 expat/xmlwf/xmlwf_helpgen.sh | 2 119 files changed, 840 insertions(+), 228 deletions(-) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp51yo09_q/expat_2.8.2-1~deb13u1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp51yo09_q/expat_2.8.3-1~deb13u1.dsc: no acceptable signature found diff -Nru expat-2.8.2/.ci.sh expat-2.8.3/.ci.sh --- expat-2.8.2/.ci.sh 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.ci.sh 2026-08-10 21:49:33.000000000 +0000 @@ -6,7 +6,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2017-2025 Sebastian Pipping +# Copyright (c) 2017-2026 Sebastian Pipping # Copyright (c) 2017 Rolf Eike Beer # Copyright (c) 2019 Mohammed Khajapasha # Copyright (c) 2019 Manish, Kumar @@ -39,7 +39,7 @@ latest_brew_python3_bin="$(ls -1d /usr/local/Cellar/python/3.*/bin | sort -n | tail -n1)" export PATH="${latest_brew_python3_bin}${PATH:+:}${PATH}" elif [[ ${RUNNER_OS} = Linux ]]; then - export PATH="/usr/lib/llvm-21/bin:${PATH}" + export PATH="/usr/lib/llvm-22/bin:${PATH}" else echo "Unsupported RUNNER_OS \"${RUNNER_OS}\"." >&2 exit 1 diff -Nru expat-2.8.2/.github/dependabot.yml expat-2.8.3/.github/dependabot.yml --- expat-2.8.2/.github/dependabot.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/dependabot.yml 2026-08-10 21:49:33.000000000 +0000 @@ -6,6 +6,7 @@ # |_| XML parser # # Copyright (c) 2021 Sebastian Pipping +# Copyright (c) 2026 Stan Ulbrych # Licensed under the MIT license: # # Permission is hereby granted, free of charge, to any person obtaining @@ -39,3 +40,8 @@ - "enhancement" schedule: interval: "weekly" + cooldown: + # https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns + # Cooldowns protect against supply chain attacks by avoiding the + # highest-risk window immediately after new releases. + default-days: 7 diff -Nru expat-2.8.2/.github/workflows/autotools-cmake.yml expat-2.8.3/.github/workflows/autotools-cmake.yml --- expat-2.8.2/.github/workflows/autotools-cmake.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/autotools-cmake.yml 2026-08-10 21:49:33.000000000 +0000 @@ -44,6 +44,7 @@ jobs: checks: name: Ensure that GNU Autotools and CMake build systems agree + timeout-minutes: 30 strategy: fail-fast: false matrix: @@ -56,7 +57,7 @@ cmake_args: - os: ubuntu-22.04 configure_args: --host=i686-w64-mingw32 - cmake_args: -DCMAKE_TOOLCHAIN_FILE=cmake/mingw-toolchain.cmake + cmake_args: -DCMAKE_TOOLCHAIN_FILE=cmake/mingw-toolchain-win32.cmake - os: ubuntu-24.04 configure_args: >- --enable-symbol-versioning @@ -82,14 +83,16 @@ shell: bash runs-on: "${{ matrix.os }}" steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: (Linux) Install build dependencies if: "${{ runner.os == 'Linux' }}" run: |- set -x sudo apt-get update - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ cmake \ docbook2x \ lzip \ diff -Nru expat-2.8.2/.github/workflows/clang-format.yml expat-2.8.3/.github/workflows/clang-format.yml --- expat-2.8.2/.github/workflows/clang-format.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/clang-format.yml 2026-08-10 21:49:33.000000000 +0000 @@ -43,21 +43,24 @@ jobs: clang_format: name: Enforce clang-format clean code + timeout-minutes: 30 runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - name: Install clang-format 21 + - name: Install clang-format 22 run: |- set -x source /etc/os-release wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main" + sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-22 main" sudo apt-get update # due to new repository - sudo apt-get install --yes --no-install-recommends -V \ - clang-format-21 \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ + clang-format-22 \ moreutils - echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}" + echo /usr/lib/llvm-22/bin >>"${GITHUB_PATH}" - name: Run clang-format run: | diff -Nru expat-2.8.2/.github/workflows/clang-static-analyzer.yml expat-2.8.3/.github/workflows/clang-static-analyzer.yml --- expat-2.8.2/.github/workflows/clang-static-analyzer.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/clang-static-analyzer.yml 2026-08-10 21:49:33.000000000 +0000 @@ -42,21 +42,24 @@ jobs: clang_static_analyzer: name: Enforce Clang Static Analyzer (scan-build) clean code + timeout-minutes: 30 runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - name: Install Clang 21 (including scan-build) + - name: Install Clang 22 (including scan-build) run: |- set -x source /etc/os-release wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main" + sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-22 main" sudo apt-get update # due to new repository - sudo apt-get install --yes --no-install-recommends -V \ - clang-21 \ - clang-tools-21 - echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}" + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ + clang-22 \ + clang-tools-22 + echo /usr/lib/llvm-22/bin >>"${GITHUB_PATH}" - name: Build using scan-build run: | diff -Nru expat-2.8.2/.github/workflows/clang-tidy.yml expat-2.8.3/.github/workflows/clang-tidy.yml --- expat-2.8.2/.github/workflows/clang-tidy.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/clang-tidy.yml 2026-08-10 21:49:33.000000000 +0000 @@ -43,20 +43,23 @@ jobs: clang_tidy: name: Enforce clang-tidy clean code + timeout-minutes: 15 runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - name: Install clang-tidy 21 + - name: Install clang-tidy 22 run: |- set -x source /etc/os-release wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main" + sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-22 main" sudo apt-get update # due to new repository - sudo apt-get install --yes --no-install-recommends -V \ - clang-tidy-21 - echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}" + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ + clang-tidy-22 + echo /usr/lib/llvm-22/bin >>"${GITHUB_PATH}" - name: Run clang-tidy run: | diff -Nru expat-2.8.2/.github/workflows/cmake-required-version.yml expat-2.8.3/.github/workflows/cmake-required-version.yml --- expat-2.8.2/.github/workflows/cmake-required-version.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/cmake-required-version.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2021-2025 Sebastian Pipping +# Copyright (c) 2021-2026 Sebastian Pipping # Copyright (c) 2023 Joyce Brum # Copyright (c) 2024 Dag-Erling Smørgrav # Licensed under the MIT license: @@ -44,9 +44,12 @@ jobs: checks: name: Ensure realistic minimum CMake version requirement + timeout-minutes: 15 runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install ancient CMake run: | diff -Nru expat-2.8.2/.github/workflows/codespell.yml expat-2.8.3/.github/workflows/codespell.yml --- expat-2.8.2/.github/workflows/codespell.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/codespell.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2021-2024 Sebastian Pipping +# Copyright (c) 2021-2026 Sebastian Pipping # Copyright (c) 2023 Joyce Brum # Licensed under the MIT license: # @@ -43,9 +43,13 @@ jobs: checks: name: Enforce codespell-clean spelling + timeout-minutes: 15 runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2 with: path: expat/ diff -Nru expat-2.8.2/.github/workflows/coverage.yml expat-2.8.3/.github/workflows/coverage.yml --- expat-2.8.2/.github/workflows/coverage.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/coverage.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2021-2025 Sebastian Pipping +# Copyright (c) 2021-2026 Sebastian Pipping # Copyright (c) 2023 Joyce Brum # Copyright (c) 2024 Dag-Erling Smørgrav # Copyright (c) 2026 Rosen Penev @@ -45,11 +45,15 @@ jobs: checks: name: Collect test coverage + timeout-minutes: 60 runs-on: ubuntu-22.04 env: CFLAGS: -g3 -pipe steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install build dependencies run: |- set -x -u @@ -59,7 +63,7 @@ sudo dpkg --add-architecture i386 # for wine32 sudo apt-get update # due to new architecture - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ cmake \ docbook-xml \ docbook2x \ @@ -71,13 +75,15 @@ retry # Install 32bit Wine - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ mingw-w64 \ wine-stable \ wine32:i386 + - name: Unshallow Git clone run: | git fetch --force --tags --unshallow origin # for "git describe" in coverage.sh + - name: Collect test coverage env: MODE: coverage-sh diff -Nru expat-2.8.2/.github/workflows/coverity-scan.yml expat-2.8.3/.github/workflows/coverity-scan.yml --- expat-2.8.2/.github/workflows/coverity-scan.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/coverity-scan.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2024-2025 Sebastian Pipping +# Copyright (c) 2024-2026 Sebastian Pipping # Licensed under the MIT license: # # Permission is hereby granted, free of charge, to any person obtaining @@ -43,13 +43,15 @@ jobs: coverity_scan_upload: name: Upload build to Coverity Scan + timeout-minutes: 15 # NOTE: The idea is not to bother fork repositories with a job # that is doomed to fail if: ${{ github.repository == 'libexpat/libexpat' }} runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: + persist-credentials: false # The next two lines ensure clean and public-only submissions repository: libexpat/libexpat ref: master @@ -63,23 +65,23 @@ tee "${GITHUB_OUTPUT}" <<< "version=$(git describe --tags | sed -e 's,^R_,,' -e 's,_,.,g')" tee -a "${GITHUB_OUTPUT}" <<< "git_commit=$(git rev-parse HEAD)" - - name: Install Clang 21 + - name: Install Clang 22 run: |- set -x source /etc/os-release wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main" + sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-22 main" sudo apt-get update # due to new repository - sudo apt-get install --yes --no-install-recommends -V \ - clang-21 \ - libclang-rt-21-dev \ - llvm-21 - echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}" + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ + clang-22 \ + libclang-rt-22-dev \ + llvm-22 + echo /usr/lib/llvm-22/bin >>"${GITHUB_PATH}" - name: Install build dependencies run: |- set -x - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ libprotobuf-dev \ protobuf-compiler diff -Nru expat-2.8.2/.github/workflows/cppcheck.yml expat-2.8.3/.github/workflows/cppcheck.yml --- expat-2.8.2/.github/workflows/cppcheck.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/cppcheck.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2021-2025 Sebastian Pipping +# Copyright (c) 2021-2026 Sebastian Pipping # Copyright (c) 2023 Joyce Brum # Copyright (c) 2024 Dag-Erling Smørgrav # Licensed under the MIT license: @@ -29,7 +29,7 @@ # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE # USE OR OTHER DEALINGS IN THE SOFTWARE. -name: Run Cppcheck (from macOS Homebrew) +name: Run Cppcheck on: pull_request: @@ -44,14 +44,42 @@ jobs: checks: name: Run Cppcheck - runs-on: macos-14 + timeout-minutes: 30 + runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 - - name: Install runtime dependencies + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Build and install Cppcheck (less than 2 minutes) run: | + commit=e73bf44c3e49686b7495fab352d03a6c6075516b # 2.21.0 + + cmake_args=( + -G Ninja # for faster builds + -DCMAKE_BUILD_TYPE=Release # for runtime performance + ) set -x - brew update - exec brew install cppcheck - - name: Run Cppcheck + + git init -b main cppcheck/ + + pushd cppcheck/ + git fetch --depth 1 https://github.com/cppcheck-opensource/cppcheck "${commit}" + git -c advice.detachedHead=false checkout FETCH_HEAD + popd + + cmake "${cmake_args[@]}" -S cppcheck/ -B build/ + + cmake --build build/ --parallel "$(nproc)" + + sudo cmake --install build/ + + rm -Rf cppcheck/ build/ + + # Smoke-test installed version + [[ $(type -P cppcheck) == /usr/local/bin/cppcheck ]] + cppcheck --version + + - name: Run Cppcheck (less than 6 minutes) run: | exec .github/workflows/scripts/mass-cppcheck.sh diff -Nru expat-2.8.2/.github/workflows/emscripten.yml expat-2.8.3/.github/workflows/emscripten.yml --- expat-2.8.2/.github/workflows/emscripten.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/emscripten.yml 2026-08-10 21:49:33.000000000 +0000 @@ -42,15 +42,18 @@ jobs: emscripten: name: Build with Emscripten + timeout-minutes: 15 runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install build dependencies run: |- set -x sudo apt-get update - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ cmake \ emscripten \ make @@ -58,8 +61,7 @@ - name: Build using Emscripten run: | cmake_args=( - -DCMAKE_C_FLAGS='-O1 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings' - -DCMAKE_CXX_FLAGS='-O2 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings' + -DCMAKE_{C,CXX}_FLAGS='-O2 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings' -DEXPAT_BUILD_DOCS=OFF -DEXPAT_SHARED_LIBS=OFF # to silence warning; not supported by Emscripten -DEXPAT_WARNINGS_AS_ERRORS=ON diff -Nru expat-2.8.2/.github/workflows/expat_config_h.yml expat-2.8.3/.github/workflows/expat_config_h.yml --- expat-2.8.2/.github/workflows/expat_config_h.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/expat_config_h.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2020-2025 Sebastian Pipping +# Copyright (c) 2020-2026 Sebastian Pipping # Copyright (c) 2023 Joyce Brum # Licensed under the MIT license: # @@ -43,9 +43,13 @@ jobs: checks: name: Check expat_config.h.{in,cmake} for regressions + timeout-minutes: 15 runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Check expat_config.h.{in,cmake} for regressions run: | set -v diff -Nru expat-2.8.2/.github/workflows/freebsd.yml expat-2.8.3/.github/workflows/freebsd.yml --- expat-2.8.2/.github/workflows/freebsd.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/freebsd.yml 2026-08-10 21:49:33.000000000 +0000 @@ -43,18 +43,21 @@ jobs: freebsd: name: Build in a FreeBSD VM + timeout-minutes: 30 runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: vmactions/freebsd-vm@b84ab5559b5a1bb4b8ee2737d2506a16e1737636 # v1.4.8 + - uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d # v1.5.2 with: release: "15.0" usesh: true prepare: | set -e -u -x - pkg install -y \ + timeout 10m pkg install -y \ autoconf \ automake \ bash \ diff -Nru expat-2.8.2/.github/workflows/fuzzing.yml expat-2.8.3/.github/workflows/fuzzing.yml --- expat-2.8.2/.github/workflows/fuzzing.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/fuzzing.yml 2026-08-10 21:49:33.000000000 +0000 @@ -42,6 +42,7 @@ jobs: run_fuzzers: name: Run fuzzing regression tests + timeout-minutes: 30 strategy: fail-fast: false matrix: @@ -53,25 +54,27 @@ env: fuzzer: ${{ matrix.fuzzer }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - name: Install Clang 21 + - name: Install Clang 22 run: |- set -x source /etc/os-release wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main" + sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-22 main" sudo apt-get update # due to new repository - sudo apt-get install --yes --no-install-recommends -V \ - clang-21 \ - libclang-rt-21-dev \ - llvm-21 - echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}" + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ + clang-22 \ + libclang-rt-22-dev \ + llvm-22 + echo /usr/lib/llvm-22/bin >>"${GITHUB_PATH}" - name: Install build dependencies run: |- set -x - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ autoconf \ automake \ docbook2x \ diff -Nru expat-2.8.2/.github/workflows/linux.yml expat-2.8.3/.github/workflows/linux.yml --- expat-2.8.2/.github/workflows/linux.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/linux.yml 2026-08-10 21:49:33.000000000 +0000 @@ -47,6 +47,7 @@ jobs: checks: name: Perform checks + timeout-minutes: 60 strategy: fail-fast: false matrix: @@ -89,7 +90,10 @@ env: CFLAGS: -g3 -pipe steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install build dependencies (MinGW) if: "${{ contains(matrix.FLAT_ENV, 'mingw') }}" run: |- @@ -98,27 +102,29 @@ # Install 32bit Wine sudo dpkg --add-architecture i386 # for wine32 sudo apt-get update # due to new architecture - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ mingw-w64 \ retry \ wine-stable \ wine32:i386 + - name: Install build dependencies (Non-MinGW) if: "${{ ! contains(matrix.FLAT_ENV, 'mingw') }}" run: |- set -x source /etc/os-release wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add - - sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main" + sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-22 main" sudo apt-get update # due to new repository - # NOTE: Please note the version-specific ${PATH} extension for Clang adding /usr/lib/llvm-21/bin in .ci.sh - sudo apt-get install --yes --no-install-recommends -V \ - clang-21 \ - libclang-rt-21-dev \ - llvm-21 + # NOTE: Please note the version-specific ${PATH} extension for Clang adding /usr/lib/llvm-22/bin in .ci.sh + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ + clang-22 \ + libclang-rt-22-dev \ + llvm-22 + - name: Install build dependencies (common) run: |- - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ cmake \ docbook2x \ gcc-multilib \ @@ -126,6 +132,7 @@ lcov \ lzip \ moreutils + - name: Perform check "${{ matrix.MODE }}" env: MODE: ${{ matrix.MODE }} diff -Nru expat-2.8.2/.github/workflows/macos.yml expat-2.8.3/.github/workflows/macos.yml --- expat-2.8.2/.github/workflows/macos.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/macos.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2020-2025 Sebastian Pipping +# Copyright (c) 2020-2026 Sebastian Pipping # Copyright (c) 2023 Joyce Brum # Copyright (c) 2024 Dag-Erling Smørgrav # Licensed under the MIT license: @@ -44,6 +44,7 @@ jobs: checks: name: Perform checks + timeout-minutes: 15 strategy: matrix: os: [macos-14, macos-15] @@ -54,11 +55,15 @@ FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address runs-on: ${{ matrix.os }} steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Install build dependencies run: | sudo rm /usr/local/bin/2to3 # so that "brew link" will work brew bundle # acts upon file Brewfile + - name: Perform check "${{ matrix.MODE }}" env: MODE: ${{ matrix.MODE }} diff -Nru expat-2.8.2/.github/workflows/musl.yml expat-2.8.3/.github/workflows/musl.yml --- expat-2.8.2/.github/workflows/musl.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/musl.yml 2026-08-10 21:49:33.000000000 +0000 @@ -5,7 +5,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2025 Sebastian Pipping +# Copyright (c) 2025-2026 Sebastian Pipping # Licensed under the MIT license: # # Permission is hereby granted, free of charge, to any person obtaining @@ -42,15 +42,18 @@ jobs: musl: name: Build with musl + timeout-minutes: 15 runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install build dependencies run: |- set -x sudo apt-get update - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ cmake \ musl-tools diff -Nru expat-2.8.2/.github/workflows/perl-integration.yml expat-2.8.3/.github/workflows/perl-integration.yml --- expat-2.8.2/.github/workflows/perl-integration.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/perl-integration.yml 2026-08-10 21:49:33.000000000 +0000 @@ -42,6 +42,7 @@ jobs: perl_integration: name: Run Perl XML::Parser integration tests + timeout-minutes: 15 strategy: fail-fast: false matrix: @@ -50,14 +51,16 @@ - "16fff0b90acbfb788f4c16ddc7c594ece91b5089" # ==2.59 with AI runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install system dependencies if: "${{ matrix.xml_parser_commit != '7096c4e45a62a23837382cf822d8c2dab780a3a1' }}" run: | set -x sudo apt-get update - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ libfile-sharedir-install-perl \ libfile-sharedir-perl diff -Nru expat-2.8.2/.github/workflows/solaris.yml expat-2.8.3/.github/workflows/solaris.yml --- expat-2.8.2/.github/workflows/solaris.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/solaris.yml 2026-08-10 21:49:33.000000000 +0000 @@ -42,11 +42,14 @@ jobs: solaris: name: Build in a Solaris VM + timeout-minutes: 30 runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - - uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1.3.7 + - uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312 # v1.3.8 with: release: "11.4-gcc" # with GCC 14 as of 2026-01-11 usesh: true @@ -58,7 +61,7 @@ # Exit code 3 means "all now installed and some not before". # Exit code 4 means "all now installed and all already before". # Command "pkg list -a" can show a list of packages available. - pkg install \ + timeout 10m pkg install \ autoconf \ automake \ bash \ diff -Nru expat-2.8.2/.github/workflows/valid-xml.yml expat-2.8.3/.github/workflows/valid-xml.yml --- expat-2.8.2/.github/workflows/valid-xml.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/valid-xml.yml 2026-08-10 21:49:33.000000000 +0000 @@ -43,9 +43,12 @@ jobs: checks: name: Ensure well-formed and valid XML + timeout-minutes: 15 runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install build dependencies env: @@ -53,7 +56,7 @@ run: |- set -x sudo apt-get update - sudo apt-get install --yes --no-install-recommends -V \ + sudo timeout 10m apt-get install --yes --no-install-recommends -V \ docbook \ libxml2-utils \ moreutils \ @@ -61,7 +64,7 @@ # NOTE: Ubuntu 24.04 has tidy 5.6.0 while we need more recent tidy 5.8.0 wget --progress=dot:giga "https://github.com/htacg/tidy-html5/releases/download/${tidy_version}/tidy-${tidy_version}-Linux-64bit.deb" - sudo apt-get install --yes "./tidy-${tidy_version}-Linux-64bit.deb" + sudo timeout 10m apt-get install --yes "./tidy-${tidy_version}-Linux-64bit.deb" - name: Enforce clean XML run: | diff -Nru expat-2.8.2/.github/workflows/wasi_sdk.yml expat-2.8.3/.github/workflows/wasi_sdk.yml --- expat-2.8.2/.github/workflows/wasi_sdk.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/wasi_sdk.yml 2026-08-10 21:49:33.000000000 +0000 @@ -43,9 +43,12 @@ jobs: wasi_sdk: name: Build with WASI SDK + timeout-minutes: 15 runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - name: Install build dependencies env: @@ -54,14 +57,13 @@ run: |- set -x -u wget "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${wasi_sdk_major}/wasi-sdk-${wasi_sdk_major}.${wasi_sdk_minor}-x86_64-linux.deb" - sudo apt-get install --yes "./wasi-sdk-${wasi_sdk_major}.${wasi_sdk_minor}-x86_64-linux.deb" + sudo timeout 10m apt-get install --yes "./wasi-sdk-${wasi_sdk_major}.${wasi_sdk_minor}-x86_64-linux.deb" - name: Build using WASI SDK run: | cmake_args=( -DCMAKE_TOOLCHAIN_FILE=/opt/wasi-sdk/share/cmake/wasi-sdk-p1.cmake - -DCMAKE_C_FLAGS='-O1 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings' - -DCMAKE_CXX_FLAGS='-O2 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings' + -DCMAKE_{C,CXX}_FLAGS='-O2 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings' -DEXPAT_BUILD_DOCS=OFF -DEXPAT_BUILD_TESTS=OFF -DEXPAT_SHARED_LIBS=OFF diff -Nru expat-2.8.2/.github/workflows/windows-binaries.yml expat-2.8.3/.github/workflows/windows-binaries.yml --- expat-2.8.2/.github/workflows/windows-binaries.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/windows-binaries.yml 2026-08-10 21:49:33.000000000 +0000 @@ -42,6 +42,7 @@ jobs: windows_binaries: name: Build ${{ matrix.expat_platform }} binaries + timeout-minutes: 15 strategy: fail-fast: false matrix: @@ -65,7 +66,9 @@ shell: bash runs-on: "${{ matrix.runs-on }}" steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0 diff -Nru expat-2.8.2/.github/workflows/windows-build.yml expat-2.8.3/.github/workflows/windows-build.yml --- expat-2.8.2/.github/workflows/windows-build.yml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/windows-build.yml 2026-08-10 21:49:33.000000000 +0000 @@ -43,6 +43,7 @@ jobs: windows_build: name: Build on Windows (${{ matrix.runs-on }}, ${{ matrix.cmake_platform }}, ${{ matrix.expat_char_type }}) + timeout-minutes: 15 strategy: fail-fast: false matrix: @@ -87,7 +88,9 @@ shell: bash runs-on: "${{ matrix.runs-on }}" steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false - uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0 @@ -104,6 +107,7 @@ -DCMAKE_BUILD_TYPE="${cmake_build_type}" -DEXPAT_CHAR_TYPE="${expat_char_type}" -DEXPAT_WARNINGS_AS_ERRORS=ON + -D_EXPAT_MSVC_ASAN=ON -Wdev -Wdeprecated ) @@ -137,6 +141,12 @@ ) set -x cd expat/build + # Copy ASan DLL in place + find \ + '/c/Program Files\Microsoft Visual Studio' \ + -type f \ + -name clang_rt.asan_dynamic-\*.dll \ + -exec cp -v {} "tests/${cmake_build_type}/" \; cp -v "${cmake_build_type}/${expat_dll}" "tests/${cmake_build_type}/" ctest "${ctest_args[@]}" diff -Nru expat-2.8.2/.github/workflows/zizmor.yml expat-2.8.3/.github/workflows/zizmor.yml --- expat-2.8.2/.github/workflows/zizmor.yml 1970-01-01 00:00:00.000000000 +0000 +++ expat-2.8.3/.github/workflows/zizmor.yml 2026-08-10 21:49:33.000000000 +0000 @@ -0,0 +1,53 @@ +# __ __ _ +# ___\ \/ /_ __ __ _| |_ +# / _ \\ /| '_ \ / _` | __| +# | __// \| |_) | (_| | |_ +# \___/_/\_\ .__/ \__,_|\__| +# |_| XML parser +# +# Copyright (c) 2026 Sebastian Pipping +# Licensed under the MIT license: +# +# Permission is hereby granted, free of charge, to any person obtaining +# a copy of this software and associated documentation files (the +# "Software"), to deal in the Software without restriction, including +# without limitation the rights to use, copy, modify, merge, publish, +# distribute, sublicense, and/or sell copies of the Software, and to permit +# persons to whom the Software is furnished to do so, subject to the +# following conditions: +# +# The above copyright notice and this permission notice shall be included +# in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN +# NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, +# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE +# USE OR OTHER DEALINGS IN THE SOFTWARE. + +name: Enforce GitHub Actions security via zizmor + +on: + push: + pull_request: + schedule: + - cron: '0 2 * * 5' # Every Friday at 2am + workflow_dispatch: + +permissions: + contents: read + +jobs: + zizmor: + name: Enforce GitHub Actions security via zizmor + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + advanced-security: false diff -Nru expat-2.8.2/README.md expat-2.8.3/README.md --- expat-2.8.2/README.md 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/README.md 2026-08-10 21:49:33.000000000 +0000 @@ -6,12 +6,18 @@ > [!CAUTION] > -> Expat is **understaffed** and without funding. -> There is a [call for help with details](https://github.com/libexpat/libexpat/blob/master/expat/Changes) -> at the top of the `Changes` file. +> Expat has **unfixed security issues**! +> Please see https://github.com/libexpat/libexpat/issues/1160 for details. + +> [!NOTE] +> +> Starting 2026-08-01, for up to six months my work maintaining libexpat +> will be funded by the [City of Munich](https://en.wikipedia.org/wiki/Munich) +> as part of their [Open Source Sabbatical](https://opensource.muenchen.de/software/libexpat.html#open-source-sabbatical). +> Thank you! :heart: :pray: -# Expat, Release 2.8.2 +# Expat, Release 2.8.3 This is Expat, a C99 library for parsing [XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by diff -Nru expat-2.8.2/debian/changelog expat-2.8.3/debian/changelog --- expat-2.8.2/debian/changelog 2026-07-24 21:04:21.000000000 +0000 +++ expat-2.8.3/debian/changelog 2026-08-13 02:05:43.000000000 +0000 @@ -1,8 +1,17 @@ -expat (2.8.2-1~deb13u1) trixie-security; urgency=high +expat (2.8.3-1~deb13u1) trixie-security; urgency=high - * Upload 2.8.2 to trixie-security. + * Non-maintainer upload by the Security Team. + * Upload 2.8.3 to trixie-security. - -- Aron Xu Sat, 25 Jul 2026 05:04:21 +0800 + -- Aron Xu Thu, 13 Aug 2026 10:05:43 +0800 + +expat (2.8.3-1) unstable; urgency=high + + * New upstream release: + - fixes CVE-2026-72522: out of bounds read and resultant infinite loop + (closes: #1144064). + + -- Laszlo Boszormenyi (GCS) Tue, 11 Aug 2026 06:52:38 +0200 expat (2.8.2-1) unstable; urgency=high diff -Nru expat-2.8.2/expat/CMake.README expat-2.8.3/expat/CMake.README --- expat-2.8.2/expat/CMake.README 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/CMake.README 2026-08-10 21:49:33.000000000 +0000 @@ -3,25 +3,25 @@ The cmake based buildsystem for expat works on Windows (cygwin, mingw, Visual Studio) and should work on all other platform cmake supports. -Assuming ~/expat-2.8.2 is the source directory of expat, add a subdirectory +Assuming ~/expat-2.8.3 is the source directory of expat, add a subdirectory build and change into that directory: -~/expat-2.8.2$ mkdir build && cd build -~/expat-2.8.2/build$ +~/expat-2.8.3$ mkdir build && cd build +~/expat-2.8.3/build$ From that directory, call cmake first, then call make, make test and make install in the usual way: -~/expat-2.8.2/build$ cmake .. +~/expat-2.8.3/build$ cmake .. -- The C compiler identification is GNU -- The CXX compiler identification is GNU .... -- Configuring done -- Generating done --- Build files have been written to: /home/patrick/expat-2.8.2/build +-- Build files have been written to: /home/patrick/expat-2.8.3/build If you want to specify the install location for your files, append -DCMAKE_INSTALL_PREFIX=/your/install/path to the cmake call. -~/expat-2.8.2/build$ make && make test && make install +~/expat-2.8.3/build$ make && make test && make install Scanning dependencies of target expat [ 5%] Building C object CMakeFiles/expat.dir/lib/xmlparse.c.o [ 11%] Building C object CMakeFiles/expat.dir/lib/xmlrole.c.o diff -Nru expat-2.8.2/expat/CMakeLists.txt expat-2.8.3/expat/CMakeLists.txt --- expat-2.8.2/expat/CMakeLists.txt 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/CMakeLists.txt 2026-08-10 21:49:33.000000000 +0000 @@ -43,7 +43,7 @@ project(expat VERSION - 2.8.2 + 2.8.3 LANGUAGES C ) @@ -88,6 +88,15 @@ else() set(_EXPAT_SHARED_LIBS_DEFAULT ON) endif() + +# AIX has none(!) of the high quality entropy sources supported by Expat (e.g. +# getentropy(3)) but, unlike UNIX, has /dev/urandom availability guaranteed. +if(AIX) # needs CMake >=4.0 (or explicit `-DAIX=ON`) + set(_EXPAT_DEV_URANDOM_DEFAULT ON) +else() + set(_EXPAT_DEV_URANDOM_DEFAULT OFF) +endif() + if(NOT CMAKE_BUILD_TYPE) set(CMAKE_BUILD_TYPE NoConfig) # so that accessing EXPAT_*_POSTFIX will be waterproof endif() @@ -152,7 +161,7 @@ mark_as_advanced(EXPAT_NS) expat_shy_set(EXPAT_WARNINGS_AS_ERRORS OFF CACHE BOOL "Treat all compiler warnings as errors") if(UNIX OR _EXPAT_HELP) - expat_shy_set(EXPAT_DEV_URANDOM OFF CACHE BOOL "Define to include code reading entropy from `/dev/urandom'.") + expat_shy_set(EXPAT_DEV_URANDOM ${_EXPAT_DEV_URANDOM_DEFAULT} CACHE BOOL "Define to include code reading entropy from `/dev/urandom'.") mark_as_advanced(EXPAT_DEV_URANDOM) endif() if(UNIX OR WASI OR _EXPAT_HELP) @@ -182,6 +191,8 @@ if(NOT _EXPAT_HELP) expat_shy_set(_EXPAT_M32 OFF CACHE BOOL "(Unofficial!) Produce 32bit code with -m32") mark_as_advanced(_EXPAT_M32) + expat_shy_set(_EXPAT_MSVC_ASAN OFF CACHE BOOL "(Unofficial!) Activate AddressSanitizer with MSVC") + mark_as_advanced(_EXPAT_MSVC_ASAN) endif() if(EXPAT_BUILD_FUZZERS) @@ -206,7 +217,7 @@ # - https://cmake.org/cmake/help/latest/variable/MSVC_VERSION.html # - https://sourceforge.net/p/predef/wiki/Compilers/ # - https://en.wikipedia.org/wiki/Microsoft_Visual_Studio#History - set(_EXPAT_MSVC_REQUIRED_INT 1800) # i.e. 12.0/2013/1800; see PR #426 + set(_EXPAT_MSVC_REQUIRED_INT 1900) # i.e. 14.0/2015(Update 2)/1900 set(_EXPAT_MSVC_SUPPORTED_INT 1930) set(_EXPAT_MSVC_SUPPORTED_DISPLAY "Visual Studio 17.0/2022/${_EXPAT_MSVC_SUPPORTED_INT}") @@ -219,6 +230,12 @@ message(WARNING "Please use ${_EXPAT_MSVC_SUPPORTED_DISPLAY} or later. Thank you!") endif() endif() + + # Stop MSVC from trying to decode the source files using + # the Windows system code page encoding that could e.g. be Windows-936 + # on a Chinese Windows system rather than UTF-8. + # https://devblogs.microsoft.com/cppblog/new-options-for-managing-character-sets-in-the-microsoft-cc-compiler/ + add_compile_options(/source-charset:utf-8) endif() macro(_expat_copy_bool_int source_ref dest_ref) @@ -381,6 +398,10 @@ endforeach() endif() +if(_EXPAT_MSVC_ASAN) + add_compile_options(/fsanitize=address /Zi) +endif() + include_directories(${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_SOURCE_DIR}/lib) if(MSVC) add_definitions(-D_CRT_SECURE_NO_WARNINGS -wd4996) @@ -533,7 +554,7 @@ endforeach() set(LIBCURRENT 13) # sync -set(LIBREVISION 2) # with +set(LIBREVISION 3) # with set(LIBAGE 12) # configure.ac! math(EXPR LIBCURRENT_MINUS_AGE "${LIBCURRENT} - ${LIBAGE}") diff -Nru expat-2.8.2/expat/Changes expat-2.8.3/expat/Changes --- expat-2.8.2/expat/Changes 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/Changes 2026-08-10 21:49:33.000000000 +0000 @@ -6,29 +6,82 @@ |_| XML parser !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -!! Expat is UNDERSTAFFED and WITHOUT FUNDING. !! -!! ~~~~~~~~~~~~ !! -!! The following topics need *additional skilled C developers* to progress !! -!! in a timely manner or at all (loosely ordered by descending priority): !! -!! _______________________ !! -!! - teaming up on fixing the UNFIXED SECURITY ISSUES listed at: !! -!! """"""""""""""""""""""" !! -!! https://github.com/libexpat/libexpat/issues/1160 !! +!! Expat has UNFIXED SECURITY ISSUES! !! +!! Please see https://github.com/libexpat/libexpat/issues/1160 for details. !! !! !! -!! - teaming up on researching and fixing future security reports and !! -!! ClusterFuzz findings with few-days-max response times in communication !! -!! in order to (1) have a sound fix ready before the end of a 90 days !! -!! grace period and (2) in a sustainable manner, !! -!! !! -!! - implementing and auto-testing XML 1.0r5 support !! -!! (needs discussion before pull requests), !! -!! !! -!! For details, please reach out via e-mail to sebastian@pipping.org so we !! -!! can schedule a voice call on the topic, in English or German. !! -!! !! -!! THANK YOU! Sebastian Pipping -- Berlin, 2026-03-17 !! +!! Starting 2026-08-01, for up to six months my work maintaining libexpat !! +!! will be funded by the City of Munich as part of their !! +!! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html) !! +!! — thank you! !! +!! Sebastian Pipping -- Berlin, 2026-08-03 !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +Release 2.8.3 Mon August 10 2026 + Security fixes: + #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting + infinite loop caused by treating low surrogates (Unicode) + the same as high surrogates in functions *_toUtf16. + Needs Expat compiled with 16bit character support + (e.g. with Firefox and/or on Windows) to be affected. + Upstream CVSS 3.1 vector: + AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) + (Note the "AV:N" for network/remote, the "AV:L" in NVD by + Mitre is mistaken.) + Original bug report from Mozilla at: + https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 + + Bug fixes: + #1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2) + #1286 lib: Reject empty version in the XML declaration + #1305 #1306 lib: Fix printf format for AIX + + Other changes: + #1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX + #1295 CMake|Windows: Add a 64bit MinGW toolchain file + #1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8 + #1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later + #1300 Document the current wrap-around issues with functions + - XML_GetCurrentByteIndex + - XML_GetCurrentColumnNumber + - XML_GetCurrentLineNumber + - XML_GetAttributeInfo + explicitly. + #1303 Address Clang Static Analyzer 22 warning + `core.NullPointerArithm` + #1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2) + to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/ + for what these numbers do + + Infrastructure: + #1311 CI: Limit workflow runtime and package installation runtime + #1310 CI: Pin Cppcheck version for a robust CI + #1310 CI: Migrate Cppcheck CI from macOS to Linux + #1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten + and WASI SDK + #1304 CI: Activate AddressSanitizer for MSVC Windows CI + #1308 CI: Introduce zizmor static analysis for GitHub Actions + #1308 CI: Start using `persist-credentials: false` with Git checkout + #1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions + #1302 #1303 CI: Bump Clang from 21 to 22 + #1293 #1294 Update project status for 2026-08 + #1301 #1307 Add SPDX license identifiers to the source code + + Special thanks to: + Evgeny Kotkov + Henri Sivonen + Kartik Kenchi + Matthew Fernandez + Matthew Wozniczka + Stan Ulbrych + Tuukka Pasanen + William Woodruff + and + Anthropic + City of Munich Open Source Sabbatical + Mozilla Security Team + Subversion + zizmor static analysis + Release 2.8.2 Thu June 25 2026 Security fixes: #1246 CVE-2026-50219 -- Disallow calls to functions @@ -124,6 +177,10 @@ through moderately sized crafted XML input (CWE-407). Please note that a layer of compression around XML can significantly reduce the minimum attack payload size. + Upstream CVSS 3.1 vector: + AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) + (Note the "AV:N" for network/remote and the "AC:L" + for low complexity; the NVD entry from Mitre is mistaken.) Other changes: #1209 #1213 Drop more casts related to `void *` that C99 does not need diff -Nru expat-2.8.2/expat/Makefile.am expat-2.8.3/expat/Makefile.am --- expat-2.8.2/expat/Makefile.am 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/Makefile.am 2026-08-10 21:49:33.000000000 +0000 @@ -75,7 +75,8 @@ cmake/autotools/expat-noconfig__macos.cmake.in \ cmake/autotools/expat-noconfig__windows.cmake.in \ cmake/autotools/expat-package-init.cmake \ - cmake/mingw-toolchain.cmake \ + cmake/mingw-toolchain-win32.cmake \ + cmake/mingw-toolchain-win64.cmake \ \ CMakeLists.txt \ CMake.README \ diff -Nru expat-2.8.2/expat/README.md expat-2.8.3/expat/README.md --- expat-2.8.2/expat/README.md 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/README.md 2026-08-10 21:49:33.000000000 +0000 @@ -6,12 +6,18 @@ > [!CAUTION] > -> Expat is **understaffed** and without funding. -> There is a [call for help with details](https://github.com/libexpat/libexpat/blob/master/expat/Changes) -> at the top of the `Changes` file. +> Expat has **unfixed security issues**! +> Please see https://github.com/libexpat/libexpat/issues/1160 for details. + +> [!NOTE] +> +> Starting 2026-08-01, for up to six months my work maintaining libexpat +> will be funded by the [City of Munich](https://en.wikipedia.org/wiki/Munich) +> as part of their [Open Source Sabbatical](https://opensource.muenchen.de/software/libexpat.html#open-source-sabbatical). +> Thank you! :heart: :pray: -# Expat, Release 2.8.2 +# Expat, Release 2.8.3 This is Expat, a C99 library for parsing [XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by diff -Nru expat-2.8.2/expat/cmake/mingw-toolchain-win32.cmake expat-2.8.3/expat/cmake/mingw-toolchain-win32.cmake --- expat-2.8.2/expat/cmake/mingw-toolchain-win32.cmake 1970-01-01 00:00:00.000000000 +0000 +++ expat-2.8.3/expat/cmake/mingw-toolchain-win32.cmake 2026-08-10 21:49:33.000000000 +0000 @@ -0,0 +1,37 @@ +# __ __ _ +# ___\ \/ /_ __ __ _| |_ +# / _ \\ /| '_ \ / _` | __| +# | __// \| |_) | (_| | |_ +# \___/_/\_\ .__/ \__,_|\__| +# |_| XML parser +# +# Copyright (c) 2019 Expat development team +# Licensed under the MIT license: +# +# Permission is hereby granted, free of charge, to any person obtaining +# a copy of this software and associated documentation files (the +# "Software"), to deal in the Software without restriction, including +# without limitation the rights to use, copy, modify, merge, publish, +# distribute, sublicense, and/or sell copies of the Software, and to permit +# persons to whom the Software is furnished to do so, subject to the +# following conditions: +# +# The above copyright notice and this permission notice shall be included +# in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN +# NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, +# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE +# USE OR OTHER DEALINGS IN THE SOFTWARE. + +set(CMAKE_SYSTEM_NAME Windows) + +set(CMAKE_C_COMPILER i686-w64-mingw32-gcc) +set(CMAKE_CXX_COMPILER i686-w64-mingw32-g++) +set(CMAKE_RC_COMPILER i686-w64-mingw32-windres) + +set(WIN32 ON) +set(MINGW ON) diff -Nru expat-2.8.2/expat/cmake/mingw-toolchain-win64.cmake expat-2.8.3/expat/cmake/mingw-toolchain-win64.cmake --- expat-2.8.2/expat/cmake/mingw-toolchain-win64.cmake 1970-01-01 00:00:00.000000000 +0000 +++ expat-2.8.3/expat/cmake/mingw-toolchain-win64.cmake 2026-08-10 21:49:33.000000000 +0000 @@ -0,0 +1,37 @@ +# __ __ _ +# ___\ \/ /_ __ __ _| |_ +# / _ \\ /| '_ \ / _` | __| +# | __// \| |_) | (_| | |_ +# \___/_/\_\ .__/ \__,_|\__| +# |_| XML parser +# +# Copyright (c) 2026 Expat development team +# Licensed under the MIT license: +# +# Permission is hereby granted, free of charge, to any person obtaining +# a copy of this software and associated documentation files (the +# "Software"), to deal in the Software without restriction, including +# without limitation the rights to use, copy, modify, merge, publish, +# distribute, sublicense, and/or sell copies of the Software, and to permit +# persons to whom the Software is furnished to do so, subject to the +# following conditions: +# +# The above copyright notice and this permission notice shall be included +# in all copies or substantial portions of the Software. +# +# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, +# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF +# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN +# NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, +# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR +# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE +# USE OR OTHER DEALINGS IN THE SOFTWARE. + +set(CMAKE_SYSTEM_NAME Windows) + +set(CMAKE_C_COMPILER x86_64-w64-mingw32-gcc) +set(CMAKE_CXX_COMPILER x86_64-w64-mingw32-g++) +set(CMAKE_RC_COMPILER x86_64-w64-mingw32-windres) + +set(WIN32 ON) +set(MINGW ON) diff -Nru expat-2.8.2/expat/cmake/mingw-toolchain.cmake expat-2.8.3/expat/cmake/mingw-toolchain.cmake --- expat-2.8.2/expat/cmake/mingw-toolchain.cmake 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/cmake/mingw-toolchain.cmake 1970-01-01 00:00:00.000000000 +0000 @@ -1,37 +0,0 @@ -# __ __ _ -# ___\ \/ /_ __ __ _| |_ -# / _ \\ /| '_ \ / _` | __| -# | __// \| |_) | (_| | |_ -# \___/_/\_\ .__/ \__,_|\__| -# |_| XML parser -# -# Copyright (c) 2019 Expat development team -# Licensed under the MIT license: -# -# Permission is hereby granted, free of charge, to any person obtaining -# a copy of this software and associated documentation files (the -# "Software"), to deal in the Software without restriction, including -# without limitation the rights to use, copy, modify, merge, publish, -# distribute, sublicense, and/or sell copies of the Software, and to permit -# persons to whom the Software is furnished to do so, subject to the -# following conditions: -# -# The above copyright notice and this permission notice shall be included -# in all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, -# EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF -# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN -# NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, -# DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR -# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE -# USE OR OTHER DEALINGS IN THE SOFTWARE. - -set(CMAKE_SYSTEM_NAME Windows) - -set(CMAKE_C_COMPILER i686-w64-mingw32-gcc) -set(CMAKE_CXX_COMPILER i686-w64-mingw32-g++) -set(CMAKE_RC_COMPILER i686-w64-mingw32-windres) - -set(WIN32 ON) -set(MINGW ON) diff -Nru expat-2.8.2/expat/configure.ac expat-2.8.3/expat/configure.ac --- expat-2.8.2/expat/configure.ac 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/configure.ac 2026-08-10 21:49:33.000000000 +0000 @@ -90,7 +90,7 @@ dnl LIBCURRENT=13 # sync -LIBREVISION=2 # with +LIBREVISION=3 # with LIBAGE=12 # CMakeLists.txt! AC_CONFIG_HEADERS([expat_config.h]) diff -Nru expat-2.8.2/expat/coverage.sh expat-2.8.3/expat/coverage.sh --- expat-2.8.2/expat/coverage.sh 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/coverage.sh 2026-08-10 21:49:33.000000000 +0000 @@ -6,7 +6,7 @@ # \___/_/\_\ .__/ \__,_|\__| # |_| XML parser # -# Copyright (c) 2017-2025 Sebastian Pipping +# Copyright (c) 2017-2026 Sebastian Pipping # Copyright (c) 2018 Marco Maggi # Copyright (c) 2019 Mohammed Khajapasha # Copyright (c) 2026 Rosen Penev @@ -98,7 +98,7 @@ cmake_args+=( -DEXPAT_CONTEXT_BYTES=${xml_context} ) fi - ${with_mingw} && cmake_args+=( -DCMAKE_TOOLCHAIN_FILE="${abs_source_dir}"/cmake/mingw-toolchain.cmake ) + ${with_mingw} && cmake_args+=( -DCMAKE_TOOLCHAIN_FILE="${abs_source_dir}"/cmake/mingw-toolchain-win32.cmake ) ${with_m32} && cmake_args+=( -D_EXPAT_M32=ON ) ${with_ge} || cmake_args+=( -DEXPAT_GE=OFF ) ${with_dtd} || cmake_args+=( -DEXPAT_DTD=OFF ) diff -Nru expat-2.8.2/expat/doc/reference.html expat-2.8.3/expat/doc/reference.html --- expat-2.8.2/expat/doc/reference.html 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/doc/reference.html 2026-08-10 21:49:33.000000000 +0000 @@ -53,7 +53,7 @@

- The Expat XML Parser Release 2.8.2 + The Expat XML Parser Release 2.8.3

@@ -2917,6 +2917,13 @@ XML_GetCurrentColumnNumber. +

+ Note: Type XML_Index is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro XML_LARGE_SIZE. +

+

XML_GetCurrentLineNumber

@@ -2930,6 +2937,13 @@ 1. +

+ Note: Type XML_Size is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro XML_LARGE_SIZE. +

+

XML_GetCurrentColumnNumber

@@ -2943,6 +2957,13 @@ position. The first column is reported as 0. +

+ Note: Type XML_Size is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro XML_LARGE_SIZE. +

+

XML_GetCurrentByteCount

@@ -3405,6 +3426,13 @@ XML_GetSpecifiedAttributeCount(parser) / 2. +

+ Note: Type XML_Index is known to wrap around on + 32bit platforms and 64bit Windows unless Expat has been compiled with + (non-default and uncommon) macro XML_LARGE_SIZE. +

+

XML_SetEncoding

diff -Nru expat-2.8.2/expat/doc/xmlwf.xml expat-2.8.3/expat/doc/xmlwf.xml --- expat-2.8.2/expat/doc/xmlwf.xml 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/doc/xmlwf.xml 2026-08-10 21:49:33.000000000 +0000 @@ -21,7 +21,7 @@ "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [ Scott"> Bronson"> - June 25, 2026"> + August 10, 2026"> 1"> bronson@rinspin.com"> diff -Nru expat-2.8.2/expat/examples/element_declarations.c expat-2.8.3/expat/examples/element_declarations.c --- expat-2.8.2/expat/examples/element_declarations.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/examples/element_declarations.c 2026-08-10 21:49:33.000000000 +0000 @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include diff -Nru expat-2.8.2/expat/examples/elements.c expat-2.8.3/expat/examples/elements.c --- expat-2.8.2/expat/examples/elements.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/examples/elements.c 2026-08-10 21:49:33.000000000 +0000 @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include diff -Nru expat-2.8.2/expat/examples/outline.c expat-2.8.3/expat/examples/outline.c --- expat-2.8.2/expat/examples/outline.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/examples/outline.c 2026-08-10 21:49:33.000000000 +0000 @@ -34,6 +34,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include diff -Nru expat-2.8.2/expat/lib/ascii.h expat-2.8.3/expat/lib/ascii.h --- expat-2.8.2/expat/lib/ascii.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/ascii.h 2026-08-10 21:49:33.000000000 +0000 @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define ASCII_A 0x41 diff -Nru expat-2.8.2/expat/lib/asciitab.h expat-2.8.3/expat/lib/asciitab.h --- expat-2.8.2/expat/lib/asciitab.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/asciitab.h 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x00 */ BT_NONXML, BT_NONXML, BT_NONXML, BT_NONXML, diff -Nru expat-2.8.2/expat/lib/expat.h expat-2.8.3/expat/lib/expat.h --- expat-2.8.2/expat/lib/expat.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/expat.h 2026-08-10 21:49:33.000000000 +0000 @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_INCLUDED @@ -1094,7 +1096,7 @@ */ # define XML_MAJOR_VERSION 2 # define XML_MINOR_VERSION 8 -# define XML_MICRO_VERSION 2 +# define XML_MICRO_VERSION 3 # ifdef __cplusplus } diff -Nru expat-2.8.2/expat/lib/expat_external.h expat-2.8.3/expat/lib/expat_external.h --- expat-2.8.2/expat/lib/expat_external.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/expat_external.h 2026-08-10 21:49:33.000000000 +0000 @@ -36,6 +36,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef Expat_External_INCLUDED diff -Nru expat-2.8.2/expat/lib/fallthrough.h expat-2.8.3/expat/lib/fallthrough.h --- expat-2.8.2/expat/lib/fallthrough.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/fallthrough.h 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef FALLTHROUGH_H diff -Nru expat-2.8.2/expat/lib/iasciitab.h expat-2.8.3/expat/lib/iasciitab.h --- expat-2.8.2/expat/lib/iasciitab.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/iasciitab.h 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* Like asciitab.h, except that 0xD has code BT_S rather than BT_CR */ diff -Nru expat-2.8.2/expat/lib/internal.h expat-2.8.3/expat/lib/internal.h --- expat-2.8.2/expat/lib/internal.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/internal.h 2026-08-10 21:49:33.000000000 +0000 @@ -53,6 +53,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(__GNUC__) && defined(__i386__) && ! defined(__MINGW32__) @@ -123,20 +125,11 @@ # define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" # endif #else +# include // PRIdPTR, PRIuPTR # define EXPAT_FMT_LLX(midpart) "%" midpart "llx" # define EXPAT_FMT_ULL(midpart) "%" midpart "llu" -# if ! defined(ULONG_MAX) -# error Compiler did not define ULONG_MAX for us -# elif ULONG_MAX == 18446744073709551615u // 2^64-1 -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "lu" -# elif defined(__wasm32__) // 32bit mode Emscripten or WASI SDK -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu" -# else -# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "d" -# define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u" -# endif +# define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart PRIdPTR +# define EXPAT_FMT_SIZE_T(midpart) "%" midpart PRIuPTR #endif #ifndef UNUSED_P diff -Nru expat-2.8.2/expat/lib/latin1tab.h expat-2.8.3/expat/lib/latin1tab.h --- expat-2.8.2/expat/lib/latin1tab.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/latin1tab.h 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_OTHER, BT_OTHER, BT_OTHER, BT_OTHER, diff -Nru expat-2.8.2/expat/lib/memory_sanitizer.h expat-2.8.3/expat/lib/memory_sanitizer.h --- expat-2.8.2/expat/lib/memory_sanitizer.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/memory_sanitizer.h 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(MEMORY_SANITIZER_H) diff -Nru expat-2.8.2/expat/lib/nametab.h expat-2.8.3/expat/lib/nametab.h --- expat-2.8.2/expat/lib/nametab.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/nametab.h 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ static const unsigned namingBitmap[] = { diff -Nru expat-2.8.2/expat/lib/random_arc4random.c expat-2.8.3/expat/lib/random_arc4random.c --- expat-2.8.2/expat/lib/random_arc4random.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_arc4random.c 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_arc4random.h" diff -Nru expat-2.8.2/expat/lib/random_arc4random.h expat-2.8.3/expat/lib/random_arc4random.h --- expat-2.8.2/expat/lib/random_arc4random.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_arc4random.h 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_ACR4RANDOM_H) diff -Nru expat-2.8.2/expat/lib/random_arc4random_buf.c expat-2.8.3/expat/lib/random_arc4random_buf.c --- expat-2.8.2/expat/lib/random_arc4random_buf.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_arc4random_buf.c 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_arc4random_buf.h" diff -Nru expat-2.8.2/expat/lib/random_arc4random_buf.h expat-2.8.3/expat/lib/random_arc4random_buf.h --- expat-2.8.2/expat/lib/random_arc4random_buf.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_arc4random_buf.h 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_ACR4RANDOM_BUF_H) diff -Nru expat-2.8.2/expat/lib/random_dev_urandom.c expat-2.8.3/expat/lib/random_dev_urandom.c --- expat-2.8.2/expat/lib/random_dev_urandom.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_dev_urandom.c 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_dev_urandom.h" diff -Nru expat-2.8.2/expat/lib/random_dev_urandom.h expat-2.8.3/expat/lib/random_dev_urandom.h --- expat-2.8.2/expat/lib/random_dev_urandom.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_dev_urandom.h 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_DEV_URANDOM_H) diff -Nru expat-2.8.2/expat/lib/random_getentropy.c expat-2.8.3/expat/lib/random_getentropy.c --- expat-2.8.2/expat/lib/random_getentropy.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_getentropy.c 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_getentropy.h" diff -Nru expat-2.8.2/expat/lib/random_getentropy.h expat-2.8.3/expat/lib/random_getentropy.h --- expat-2.8.2/expat/lib/random_getentropy.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_getentropy.h 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_GETENTROPY_H) diff -Nru expat-2.8.2/expat/lib/random_getrandom.c expat-2.8.3/expat/lib/random_getrandom.c --- expat-2.8.2/expat/lib/random_getrandom.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_getrandom.c 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" // for HAVE_GETRANDOM, HAVE_SYSCALL_GETRANDOM diff -Nru expat-2.8.2/expat/lib/random_getrandom.h expat-2.8.3/expat/lib/random_getrandom.h --- expat-2.8.2/expat/lib/random_getrandom.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_getrandom.h 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_GETRANDOM_H) diff -Nru expat-2.8.2/expat/lib/random_rand_s.c expat-2.8.3/expat/lib/random_rand_s.c --- expat-2.8.2/expat/lib/random_rand_s.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_rand_s.c 2026-08-10 21:49:33.000000000 +0000 @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "random_rand_s.h" diff -Nru expat-2.8.2/expat/lib/random_rand_s.h expat-2.8.3/expat/lib/random_rand_s.h --- expat-2.8.2/expat/lib/random_rand_s.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/random_rand_s.h 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if ! defined(RANDOM_RAND_S_H) diff -Nru expat-2.8.2/expat/lib/siphash.h expat-2.8.3/expat/lib/siphash.h --- expat-2.8.2/expat/lib/siphash.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/siphash.h 2026-08-10 21:49:33.000000000 +0000 @@ -8,6 +8,8 @@ * * 1. https://www.131002.net/siphash/siphash24.c * 2. https://www.131002.net/siphash/ + * + * SPDX-License-Identifier: CC0-1.0 * -------------------------------------------------------------------------- * HISTORY: * diff -Nru expat-2.8.2/expat/lib/utf8tab.h expat-2.8.3/expat/lib/utf8tab.h --- expat-2.8.2/expat/lib/utf8tab.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/utf8tab.h 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* 0x80 */ BT_TRAIL, BT_TRAIL, BT_TRAIL, BT_TRAIL, diff -Nru expat-2.8.2/expat/lib/winconfig.h expat-2.8.3/expat/lib/winconfig.h --- expat-2.8.2/expat/lib/winconfig.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/winconfig.h 2026-08-10 21:49:33.000000000 +0000 @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef WINCONFIG_H diff -Nru expat-2.8.2/expat/lib/xcsinc.c expat-2.8.3/expat/lib/xcsinc.c --- expat-2.8.2/expat/lib/xcsinc.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xcsinc.c 2026-08-10 21:49:33.000000000 +0000 @@ -6,7 +6,7 @@ \___/_/\_\ .__/ \__,_|\__| |_| XML parser - Copyright (c) 2022 Sebastian Pipping + Copyright (c) 2022-2026 Sebastian Pipping Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -27,8 +27,14 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ +#if defined(XML_UNICODE) && defined(XML_UNICODE_WCHAR_T) +# include +#endif + static size_t xcslen(const XML_Char *s) { #ifdef XML_UNICODE diff -Nru expat-2.8.2/expat/lib/xmlparse.c expat-2.8.3/expat/lib/xmlparse.c --- expat-2.8.2/expat/lib/xmlparse.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmlparse.c 2026-08-10 21:49:33.000000000 +0000 @@ -1,4 +1,4 @@ -/* 5de44e6750c6cc78818f06ed552f522a1241df0299395250e1792cb339389daf (2.8.2+) +/* ee5f82c3ffd57c5224394ba46f348dbce466d34d6c925a527ae46b1cfe6adf1d (2.8.3+) __ __ _ ___\ \/ /_ __ __ _| |_ / _ \\ /| '_ \ / _` | __| @@ -50,6 +50,7 @@ Copyright (c) 2026 Nick Begg Copyright (c) 2026 Kartik Kenchi Copyright (c) 2026 Haris Hussain + Copyright (c) 2026 Evgeny Kotkov Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -70,6 +71,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define XML_BUILDING_EXPAT 1 @@ -93,10 +96,10 @@ #include #include /* memset(), memcpy() */ #include -#include /* INT_MAX, LLONG_MAX, LONG_MAX, UINT_MAX */ +#include /* INT_MAX, UINT_MAX */ #include /* fprintf */ #include /* getenv */ -#include /* SIZE_MAX, uintptr_t */ +#include /* SIZE_MAX, UINT64_MAX, uint64_t, uintptr_t */ #include /* isnan */ #include @@ -211,12 +214,6 @@ #endif -#ifdef XML_LARGE_SIZE -# define XML_INDEX_MAX LLONG_MAX -#else -# define XML_INDEX_MAX LONG_MAX -#endif - /* Round up n to be a multiple of sz, where sz is a power of 2. */ #define ROUND_UP(n, sz) (((n) + ((sz) - 1)) & ~((sz) - 1)) @@ -719,7 +716,7 @@ char *m_bufferEnd; // past last character to be parsed const char *m_bufferLim; // allocated end of m_buffer - XML_Index m_parseEndByteIndex; + uint64_t m_parseEndByteIndex; const char *m_parseEndPtr; size_t m_partialTokenBytesBefore; /* used in heuristic to avoid O(n^2) */ XML_Bool m_reparseDeferralEnabled; @@ -2312,7 +2309,7 @@ int nLeftOver; enum XML_Status result; /* Detect overflow (a+b > MAX <==> b > MAX-a) */ - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2430,7 +2427,7 @@ } // Detect and avoid integer overflow - if (len > XML_INDEX_MAX - parser->m_parseEndByteIndex) { + if ((uint64_t)len > UINT64_MAX - parser->m_parseEndByteIndex) { parser->m_errorCode = XML_ERROR_NO_MEMORY; parser->m_eventPtr = parser->m_eventEndPtr = NULL; parser->m_processor = errorProcessor; @@ -2692,9 +2689,15 @@ XML_GetCurrentByteIndex(XML_Parser parser) { if (parser == NULL) return -1; - if (parser->m_eventPtr) + if (parser->m_eventPtr) { + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. return (XML_Index)(parser->m_parseEndByteIndex - (parser->m_parseEndPtr - parser->m_eventPtr)); + } return -1; } @@ -2736,7 +2739,12 @@ parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.lineNumber + 1; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)(parser->m_position.lineNumber + 1); } XML_Size XMLCALL @@ -2748,7 +2756,12 @@ parser->m_eventPtr, &parser->m_position); parser->m_positionPtr = parser->m_eventPtr; } - return parser->m_position.columnNumber; + // NOTE: XML_Size is known to wrap around for >2 4iB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. + return (XML_Size)parser->m_position.columnNumber; } void XMLCALL @@ -3905,14 +3918,22 @@ if (! attId) return XML_ERROR_NO_MEMORY; #ifdef XML_ATTR_INFO + // NOTE: XML_Index is known to wrap around for >2 GiB content + // on 32bit machines and 64bit Windows, unless (non-default and + // uncommon) XML_LARGE_SIZE is defined. + // That's a bug and it only lives on because we cannot break + // ABI compatibility of public API. currAttInfo->nameStart - = parser->m_parseEndByteIndex - (parser->m_parseEndPtr - currAtt->name); + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->name)); currAttInfo->nameEnd = currAttInfo->nameStart + XmlNameLength(enc, currAtt->name); - currAttInfo->valueStart = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valuePtr); - currAttInfo->valueEnd = parser->m_parseEndByteIndex - - (parser->m_parseEndPtr - currAtt->valueEnd); + currAttInfo->valueStart + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valuePtr)); + currAttInfo->valueEnd + = (XML_Index)(parser->m_parseEndByteIndex + - (parser->m_parseEndPtr - currAtt->valueEnd)); #endif /* Detect duplicate attributes by their QNames. This does not work when namespace processing is turned on and different prefixes for the same @@ -6554,11 +6575,12 @@ // Check if entity is complete, if not, mark down how much of it is // processed. A XML_SUSPENDED check here is not required as // appendAttributeValue will never suspend the parser. - if (textEnd != nextInEntity) { + if (nextInEntity < textEnd) { entity->processed = (int)(nextInEntity - (const char *)entity->textPtr); continue; } + assert(nextInEntity == textEnd); // Entity is complete. We cannot close it here since we need to first // process its possible inner entities (which are added to the @@ -8192,7 +8214,7 @@ pool->freeBlocks = tem; memcpy(pool->blocks->s, pool->start, (pool->end - pool->start) * sizeof(XML_Char)); - pool->ptr = pool->blocks->s + (pool->ptr - pool->start); + pool->ptr = pool->blocks->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = pool->blocks->s; pool->end = pool->start + pool->blocks->size; return XML_TRUE; @@ -8205,7 +8227,8 @@ /* NOTE: Needs to be calculated prior to calling `realloc` to avoid dangling pointers: */ - const ptrdiff_t offsetInsideBlock = pool->ptr - pool->start; + const ptrdiff_t offsetInsideBlock + = EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); if (blockSize < 0) { /* This condition traps a situation where either more than @@ -8268,8 +8291,9 @@ tem->next = pool->blocks; pool->blocks = tem; if (pool->ptr != pool->start) - memcpy(tem->s, pool->start, (pool->ptr - pool->start) * sizeof(XML_Char)); - pool->ptr = tem->s + (pool->ptr - pool->start); + memcpy(tem->s, pool->start, + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start) * sizeof(XML_Char)); + pool->ptr = tem->s + EXPAT_SAFE_PTR_DIFF(pool->ptr, pool->start); pool->start = tem->s; pool->end = tem->s + blockSize; } diff -Nru expat-2.8.2/expat/lib/xmlrole.c expat-2.8.3/expat/lib/xmlrole.c --- expat-2.8.2/expat/lib/xmlrole.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmlrole.c 2026-08-10 21:49:33.000000000 +0000 @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff -Nru expat-2.8.2/expat/lib/xmlrole.h expat-2.8.3/expat/lib/xmlrole.h --- expat-2.8.2/expat/lib/xmlrole.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmlrole.h 2026-08-10 21:49:33.000000000 +0000 @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlRole_INCLUDED diff -Nru expat-2.8.2/expat/lib/xmltok.c expat-2.8.3/expat/lib/xmltok.c --- expat-2.8.2/expat/lib/xmltok.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmltok.c 2026-08-10 21:49:33.000000000 +0000 @@ -12,7 +12,7 @@ Copyright (c) 2002 Greg Stein Copyright (c) 2002-2016 Karl Waclawek Copyright (c) 2005-2009 Steven Solie - Copyright (c) 2016-2024 Sebastian Pipping + Copyright (c) 2016-2026 Sebastian Pipping Copyright (c) 2016 Pascal Cuoq Copyright (c) 2016 Don Lewis Copyright (c) 2017 Rhodri James @@ -26,6 +26,7 @@ Copyright (c) 2023 Hanno Böck Copyright (c) 2025 Alfonso Gregory Copyright (c) 2026 Nick Begg + Copyright (c) 2026 Kartik Kenchi Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -46,6 +47,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" @@ -705,9 +708,10 @@ enum XML_Convert_Result res = XML_CONVERT_COMPLETED; \ UNUSED_P(enc); \ fromLim = *fromP + (((fromLim - *fromP) >> 1) << 1); /* shrink to even */ \ - /* Avoid copying first half only of surrogate */ \ + /* Avoid copying the first half (2 bytes) of surrogate pairs (4 bytes) */ \ if (fromLim - *fromP > ((toLim - *toP) << 1) \ - && (GET_HI(fromLim - 2) & 0xF8) == 0xD8) { \ + && /* are the last two bytes a high surrogate (0xD800-0xDBFF)? */ \ + (GET_HI(fromLim - 2) & 0xFC) == 0xD8) { \ fromLim -= 2; \ res = XML_CONVERT_INPUT_INCOMPLETE; \ } \ @@ -1177,6 +1181,13 @@ *versionPtr = val; if (versionEndPtr) *versionEndPtr = ptr; + /* The version number must not be empty; VersionNum requires at least + one character. The encoding and standalone pseudo-attributes below + already reject an empty value, so keep version consistent. */ + if (val == ptr - enc->minBytesPerChar) { + *badPtr = val; + return 0; + } if (! parsePseudoAttribute(enc, ptr, end, &name, &nameEnd, &val, &ptr)) { *badPtr = ptr; return 0; diff -Nru expat-2.8.2/expat/lib/xmltok.h expat-2.8.3/expat/lib/xmltok.h --- expat-2.8.2/expat/lib/xmltok.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmltok.h 2026-08-10 21:49:33.000000000 +0000 @@ -10,7 +10,7 @@ Copyright (c) 2000 Clark Cooper Copyright (c) 2002 Fred L. Drake, Jr. Copyright (c) 2002-2005 Karl Waclawek - Copyright (c) 2016-2024 Sebastian Pipping + Copyright (c) 2016-2026 Sebastian Pipping Copyright (c) 2017 Rhodri James Licensed under the MIT license: @@ -32,11 +32,15 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifndef XmlTok_INCLUDED # define XmlTok_INCLUDED 1 +# include // uint64_t + # ifdef __cplusplus extern "C" { # endif @@ -145,8 +149,8 @@ typedef struct position { /* first line and first column are 0 not 1 */ - XML_Size lineNumber; - XML_Size columnNumber; + uint64_t lineNumber; + uint64_t columnNumber; } POSITION; typedef struct { diff -Nru expat-2.8.2/expat/lib/xmltok_impl.c expat-2.8.3/expat/lib/xmltok_impl.c --- expat-2.8.2/expat/lib/xmltok_impl.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmltok_impl.c 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_IMPL_C diff -Nru expat-2.8.2/expat/lib/xmltok_impl.h expat-2.8.3/expat/lib/xmltok_impl.h --- expat-2.8.2/expat/lib/xmltok_impl.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmltok_impl.h 2026-08-10 21:49:33.000000000 +0000 @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ enum { diff -Nru expat-2.8.2/expat/lib/xmltok_ns.c expat-2.8.3/expat/lib/xmltok_ns.c --- expat-2.8.2/expat/lib/xmltok_ns.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/lib/xmltok_ns.c 2026-08-10 21:49:33.000000000 +0000 @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef XML_TOK_NS_C diff -Nru expat-2.8.2/expat/tests/acc_tests.c expat-2.8.3/expat/tests/acc_tests.c --- expat-2.8.2/expat/tests/acc_tests.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/acc_tests.c 2026-08-10 21:49:33.000000000 +0000 @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff -Nru expat-2.8.2/expat/tests/acc_tests.h expat-2.8.3/expat/tests/acc_tests.h --- expat-2.8.2/expat/tests/acc_tests.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/acc_tests.h 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/alloc_tests.c expat-2.8.3/expat/tests/alloc_tests.c --- expat-2.8.2/expat/tests/alloc_tests.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/alloc_tests.c 2026-08-10 21:49:33.000000000 +0000 @@ -41,6 +41,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff -Nru expat-2.8.2/expat/tests/alloc_tests.h expat-2.8.3/expat/tests/alloc_tests.h --- expat-2.8.2/expat/tests/alloc_tests.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/alloc_tests.h 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/basic_tests.c expat-2.8.3/expat/tests/basic_tests.c --- expat-2.8.2/expat/tests/basic_tests.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/basic_tests.c 2026-08-10 21:49:33.000000000 +0000 @@ -22,6 +22,7 @@ Copyright (c) 2024-2026 Berkay Eren Ürün Copyright (c) 2026 Francesco Bertolaccini Copyright (c) 2026 Matthew Fernandez + Copyright (c) 2026 Kartik Kenchi Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -42,6 +43,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) @@ -51,7 +54,7 @@ #include "expat_config.h" #include - +#include // ULONG_MAX #include #include #include @@ -67,6 +70,21 @@ #include "siphash.h" #include "basic_tests.h" +#define EXPAT_TESTS_ASAN 1 + +#if defined(__has_feature) +# if ! __has_feature(address_sanitizer) +# undef EXPAT_TESTS_ASAN +# define EXPAT_TESTS_ASAN 0 +# endif +#endif + +#if ULONG_MAX == 18446744073709551615u // 2^64-1 +# define EXPAT_TESTS_64BIT 1 +#else +# define EXPAT_TESTS_64BIT 0 +#endif + static void basic_setup(void) { g_parser = XML_ParserCreate(NULL); @@ -971,6 +989,14 @@ } END_TEST +START_TEST(test_xmldecl_empty_version) { + expect_failure("\n" + "", + XML_ERROR_XML_DECL, + "Failed to report empty version in XML declaration"); +} +END_TEST + /* Regression test for SF bug #584832. */ START_TEST(test_unknown_encoding_internal_entity) { const char *text = "\n" @@ -3429,12 +3455,16 @@ if (s != XML_STATUS_OK) xml_failure(parser); +// Avoid running into "AddressSanitizer: out of memory" on 32bit Windows +#if ! defined(_WIN32) || EXPAT_TESTS_ASAN == 0 || EXPAT_TESTS_64BIT == 1 // XML_CONTEXT_BYTES of the prefix may remain in the buffer; // subtracting the whole prefix is easiest, and close enough. assert_true(XML_GetBuffer(parser, maxbuf - prefix_len) != NULL); // The limit should be consistent; no prefix should allow us to // reach above the max buffer size. assert_true(XML_GetBuffer(parser, maxbuf + 1) == NULL); +#endif + XML_ParserFree(parser); } } @@ -6647,6 +6677,7 @@ tcase_add_test(tc_basic, test_xmldecl_invalid); tcase_add_test(tc_basic, test_xmldecl_missing_attr); tcase_add_test(tc_basic, test_xmldecl_missing_value); + tcase_add_test(tc_basic, test_xmldecl_empty_version); tcase_add_test__if_xml_ge(tc_basic, test_unknown_encoding_internal_entity); tcase_add_test(tc_basic, test_unrecognised_encoding_internal_entity); tcase_add_test__ifdef_xml_dtd(tc_basic, test_ext_entity_set_encoding); diff -Nru expat-2.8.2/expat/tests/basic_tests.h expat-2.8.3/expat/tests/basic_tests.h --- expat-2.8.2/expat/tests/basic_tests.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/basic_tests.h 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/chardata.c expat-2.8.3/expat/tests/chardata.c --- expat-2.8.2/expat/tests/chardata.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/chardata.c 2026-08-10 21:49:33.000000000 +0000 @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff -Nru expat-2.8.2/expat/tests/chardata.h expat-2.8.3/expat/tests/chardata.h --- expat-2.8.2/expat/tests/chardata.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/chardata.h 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/common.c expat-2.8.3/expat/tests/common.c --- expat-2.8.2/expat/tests/common.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/common.c 2026-08-10 21:49:33.000000000 +0000 @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff -Nru expat-2.8.2/expat/tests/common.h expat-2.8.3/expat/tests/common.h --- expat-2.8.2/expat/tests/common.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/common.h 2026-08-10 21:49:33.000000000 +0000 @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/dummy.c expat-2.8.3/expat/tests/dummy.c --- expat-2.8.2/expat/tests/dummy.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/dummy.c 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat.h" diff -Nru expat-2.8.2/expat/tests/dummy.h expat-2.8.3/expat/tests/dummy.h --- expat-2.8.2/expat/tests/dummy.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/dummy.h 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/handlers.c expat-2.8.3/expat/tests/handlers.c --- expat-2.8.2/expat/tests/handlers.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/handlers.c 2026-08-10 21:49:33.000000000 +0000 @@ -42,6 +42,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff -Nru expat-2.8.2/expat/tests/handlers.h expat-2.8.3/expat/tests/handlers.h --- expat-2.8.2/expat/tests/handlers.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/handlers.h 2026-08-10 21:49:33.000000000 +0000 @@ -41,6 +41,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/memcheck.c expat-2.8.3/expat/tests/memcheck.c --- expat-2.8.2/expat/tests/memcheck.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/memcheck.c 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include diff -Nru expat-2.8.2/expat/tests/memcheck.h expat-2.8.3/expat/tests/memcheck.h --- expat-2.8.2/expat/tests/memcheck.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/memcheck.h 2026-08-10 21:49:33.000000000 +0000 @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/minicheck.c expat-2.8.3/expat/tests/minicheck.c --- expat-2.8.2/expat/tests/minicheck.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/minicheck.c 2026-08-10 21:49:33.000000000 +0000 @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff -Nru expat-2.8.2/expat/tests/minicheck.h expat-2.8.3/expat/tests/minicheck.h --- expat-2.8.2/expat/tests/minicheck.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/minicheck.h 2026-08-10 21:49:33.000000000 +0000 @@ -37,6 +37,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/misc_tests.c expat-2.8.3/expat/tests/misc_tests.c --- expat-2.8.2/expat/tests/misc_tests.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/misc_tests.c 2026-08-10 21:49:33.000000000 +0000 @@ -22,6 +22,7 @@ Copyright (c) 2025 Berkay Eren Ürün Copyright (c) 2026 Matthew Fernandez Copyright (c) 2026 Kartik Kenchi + Copyright (c) 2026 Evgeny Kotkov Licensed under the MIT license: Permission is hereby granted, free of charge, to any person obtaining @@ -42,6 +43,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) @@ -214,7 +217,7 @@ if (! versions_equal(&read_version, &parsed_version)) fail("Version mismatch"); - if (xcstrcmp(version_text, XCS("expat_2.8.2")) + if (xcstrcmp(version_text, XCS("expat_2.8.3")) != 0) /* needs bump on releases */ fail("XML_*_VERSION in expat.h out of sync?\n"); } @@ -836,6 +839,70 @@ } END_TEST +// General attack payload idea by Jason Kratzer of Mozilla +START_TEST(test_misc_low_surrogate_mozilla_bug_2053153) { + const char doc_before[] = "<\0!\0D\0O\0C\0T\0Y\0P\0E\0 \0d\0 \0[\0\n\0" + " \0 \0<\0!\0E\0N\0T\0I\0T\0Y\0 \0e\0 \0'\0"; + const char doc_after[] = "'\0>\0\n\0]\0>\0\n\0" + "<\0r\0 \0a\0=\0'\0&\0e\0;\0'\0/\0>\0\n\0"; + + for (size_t i = 1021; i <= 1025; i++) { + set_subtest("[%d]", (int)i); + + XML_Parser parser = XML_ParserCreate(NULL); + + assert_true(_XML_Parse_SINGLE_BYTES(parser, doc_before, + (int)sizeof(doc_before) - 1, + /*isFinal=*/XML_FALSE)); + + for (size_t j = 0; j < i; j++) { + assert_true( + _XML_Parse_SINGLE_BYTES(parser, "a\\0", 2, /*isFinal=*/XML_FALSE)); + } + + // Thinking Python, this is: + // ''.join([f'\\x{e:02x}' for e in '😀'.encode('UTF-16-LE')]) + assert_true(_XML_Parse_SINGLE_BYTES(parser, "\x3d\xd8\x00\xde", 4, + /*isFinal=*/XML_FALSE)); + + assert_true(_XML_Parse_SINGLE_BYTES( + parser, doc_after, (int)sizeof(doc_after) - 1, /*isFinal=*/XML_TRUE)); + + XML_ParserFree(parser); + } +} +END_TEST + +START_TEST(test_misc_input_2gb) { + XML_Parser parser; + const char *const doc = ""; + unsigned long long offset = 0; + char buf[4096]; + + if (g_chunkSize != 0) { + return; // this test is slow, and doesn't use _XML_Parse_SINGLE_BYTES(). + } + + memset(buf, ' ', sizeof(buf)); + + parser = XML_ParserCreate(NULL); + + assert_true(XML_Parse(parser, doc, (int)strlen(doc), XML_FALSE) + == XML_STATUS_OK); + offset += strlen(doc); + + while (offset < 2ULL * 1024 * 1024 * 1024) { + assert_true(XML_Parse(parser, buf, sizeof(buf), XML_FALSE) + == XML_STATUS_OK); + offset += sizeof(buf); + } + + assert_true(XML_Parse(parser, NULL, 0, XML_TRUE) == XML_STATUS_OK); + + XML_ParserFree(parser); +} +END_TEST + void make_miscellaneous_test_case(Suite *s) { TCase *tc_misc = tcase_create("miscellaneous tests"); @@ -869,4 +936,6 @@ tcase_add_test(tc_misc, test_misc_no_infinite_loop_issue_1161); tcase_add_test(tc_misc, test_misc_calls_forbidden_from_handlers); tcase_add_test(tc_misc, test_misc_resume_parser_forbidden_from_handler); + tcase_add_test(tc_misc, test_misc_input_2gb); + tcase_add_test(tc_misc, test_misc_low_surrogate_mozilla_bug_2053153); } diff -Nru expat-2.8.2/expat/tests/misc_tests.h expat-2.8.3/expat/tests/misc_tests.h --- expat-2.8.2/expat/tests/misc_tests.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/misc_tests.h 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/ns_tests.c expat-2.8.3/expat/tests/ns_tests.c --- expat-2.8.2/expat/tests/ns_tests.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/ns_tests.c 2026-08-10 21:49:33.000000000 +0000 @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff -Nru expat-2.8.2/expat/tests/ns_tests.h expat-2.8.3/expat/tests/ns_tests.h --- expat-2.8.2/expat/tests/ns_tests.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/ns_tests.h 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/nsalloc_tests.c expat-2.8.3/expat/tests/nsalloc_tests.c --- expat-2.8.2/expat/tests/nsalloc_tests.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/nsalloc_tests.c 2026-08-10 21:49:33.000000000 +0000 @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff -Nru expat-2.8.2/expat/tests/nsalloc_tests.h expat-2.8.3/expat/tests/nsalloc_tests.h --- expat-2.8.2/expat/tests/nsalloc_tests.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/nsalloc_tests.h 2026-08-10 21:49:33.000000000 +0000 @@ -38,6 +38,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/tests/runtests.c expat-2.8.3/expat/tests/runtests.c --- expat-2.8.2/expat/tests/runtests.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/runtests.c 2026-08-10 21:49:33.000000000 +0000 @@ -40,6 +40,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff -Nru expat-2.8.2/expat/tests/structdata.c expat-2.8.3/expat/tests/structdata.c --- expat-2.8.2/expat/tests/structdata.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/structdata.c 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #if defined(NDEBUG) diff -Nru expat-2.8.2/expat/tests/structdata.h expat-2.8.3/expat/tests/structdata.h --- expat-2.8.2/expat/tests/structdata.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/tests/structdata.h 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/win32/expat.iss expat-2.8.3/expat/win32/expat.iss --- expat-2.8.2/expat/win32/expat.iss 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/win32/expat.iss 2026-08-10 21:49:33.000000000 +0000 @@ -38,7 +38,7 @@ ; OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE ; USE OR OTHER DEALINGS IN THE SOFTWARE. -#define expatVer "2.8.2" +#define expatVer "2.8.3" [Setup] AppName=Expat diff -Nru expat-2.8.2/expat/xmlwf/codepage.c expat-2.8.3/expat/xmlwf/codepage.c --- expat-2.8.2/expat/xmlwf/codepage.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/codepage.c 2026-08-10 21:49:33.000000000 +0000 @@ -32,6 +32,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "codepage.h" diff -Nru expat-2.8.2/expat/xmlwf/codepage.h expat-2.8.3/expat/xmlwf/codepage.h --- expat-2.8.2/expat/xmlwf/codepage.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/codepage.h 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ int codepageMap(int cp, int *map); diff -Nru expat-2.8.2/expat/xmlwf/ct.c expat-2.8.3/expat/xmlwf/ct.c --- expat-2.8.2/expat/xmlwf/ct.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/ct.c 2026-08-10 21:49:33.000000000 +0000 @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define CHARSET_MAX 41 diff -Nru expat-2.8.2/expat/xmlwf/filemap.h expat-2.8.3/expat/xmlwf/filemap.h --- expat-2.8.2/expat/xmlwf/filemap.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/filemap.h 2026-08-10 21:49:33.000000000 +0000 @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include /* INT_MAX */ diff -Nru expat-2.8.2/expat/xmlwf/readfilemap.c expat-2.8.3/expat/xmlwf/readfilemap.c --- expat-2.8.2/expat/xmlwf/readfilemap.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/readfilemap.c 2026-08-10 21:49:33.000000000 +0000 @@ -35,6 +35,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include diff -Nru expat-2.8.2/expat/xmlwf/unixfilemap.c expat-2.8.3/expat/xmlwf/unixfilemap.c --- expat-2.8.2/expat/xmlwf/unixfilemap.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/unixfilemap.c 2026-08-10 21:49:33.000000000 +0000 @@ -33,6 +33,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include diff -Nru expat-2.8.2/expat/xmlwf/win32filemap.c expat-2.8.3/expat/xmlwf/win32filemap.c --- expat-2.8.2/expat/xmlwf/win32filemap.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/win32filemap.c 2026-08-10 21:49:33.000000000 +0000 @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define STRICT 1 diff -Nru expat-2.8.2/expat/xmlwf/xmlfile.c expat-2.8.3/expat/xmlwf/xmlfile.c --- expat-2.8.2/expat/xmlwf/xmlfile.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmlfile.c 2026-08-10 21:49:33.000000000 +0000 @@ -39,6 +39,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff -Nru expat-2.8.2/expat/xmlwf/xmlfile.h expat-2.8.3/expat/xmlwf/xmlfile.h --- expat-2.8.2/expat/xmlwf/xmlfile.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmlfile.h 2026-08-10 21:49:33.000000000 +0000 @@ -31,6 +31,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #define XML_MAP_FILE 01 diff -Nru expat-2.8.2/expat/xmlwf/xmlmime.c expat-2.8.3/expat/xmlwf/xmlmime.c --- expat-2.8.2/expat/xmlwf/xmlmime.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmlmime.c 2026-08-10 21:49:33.000000000 +0000 @@ -30,6 +30,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include diff -Nru expat-2.8.2/expat/xmlwf/xmlmime.h expat-2.8.3/expat/xmlwf/xmlmime.h --- expat-2.8.2/expat/xmlwf/xmlmime.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmlmime.h 2026-08-10 21:49:33.000000000 +0000 @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #ifdef __cplusplus diff -Nru expat-2.8.2/expat/xmlwf/xmltchar.h expat-2.8.3/expat/xmlwf/xmltchar.h --- expat-2.8.2/expat/xmlwf/xmltchar.h 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmltchar.h 2026-08-10 21:49:33.000000000 +0000 @@ -29,6 +29,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ /* Ensures compile-time constants are consistent */ diff -Nru expat-2.8.2/expat/xmlwf/xmlwf.c expat-2.8.3/expat/xmlwf/xmlwf.c --- expat-2.8.2/expat/xmlwf/xmlwf.c 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmlwf.c 2026-08-10 21:49:33.000000000 +0000 @@ -43,6 +43,8 @@ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + + SPDX-License-Identifier: MIT */ #include "expat_config.h" diff -Nru expat-2.8.2/expat/xmlwf/xmlwf_helpgen.py expat-2.8.3/expat/xmlwf/xmlwf_helpgen.py --- expat-2.8.2/expat/xmlwf/xmlwf_helpgen.py 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmlwf_helpgen.py 2026-08-10 21:49:33.000000000 +0000 @@ -28,6 +28,8 @@ # DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE # USE OR OTHER DEALINGS IN THE SOFTWARE. +# +# SPDX-License-Identifier: MIT import argparse from textwrap import dedent diff -Nru expat-2.8.2/expat/xmlwf/xmlwf_helpgen.sh expat-2.8.3/expat/xmlwf/xmlwf_helpgen.sh --- expat-2.8.2/expat/xmlwf/xmlwf_helpgen.sh 2026-06-25 14:07:00.000000000 +0000 +++ expat-2.8.3/expat/xmlwf/xmlwf_helpgen.sh 2026-08-10 21:49:33.000000000 +0000 @@ -27,6 +27,8 @@ # DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE # USE OR OTHER DEALINGS IN THE SOFTWARE. +# +# SPDX-License-Identifier: MIT ./xmlwf/xmlwf_helpgen.py | sed \ -e 's,usage: ,usage:,' \