[Midnightbsd-cvs] [MidnightBSD/mports] a5e89f: textproc/expat2: update to 2.8.5 (#1608)

[Lucas Holt]

  Branch: refs/heads/master
  Home:   https://github.com/MidnightBSD/mports
  Commit: a5e89f4e3ed115038c72090814ae64c9b0eade85
      https://github.com/MidnightBSD/mports/commit/a5e89f4e3ed115038c72090814ae64c9b0eade85
  Author: Lucas Holt <luke at foolishgames.com>
  Date:   2026-09-23 (Wed, 23 Sep 2026)

  Changed paths:
    M textproc/expat2/Makefile
    M textproc/expat2/distinfo
    M textproc/expat2/pkg-plist

  Log Message:
  -----------
  textproc/expat2: update to 2.8.5 (#1608)

Updates `textproc/expat2` from 2.8.4 to 2.8.5, to match the base system.

## Why
2.8.5 is a security release. It fixes **CVE-2026-93990** (CVSS 9.8):
Expat didn't reject a UTF-16 high surrogate that isn't followed by a low
surrogate, so malformed UTF-16 could reach the application. There are
also a few bug fixes (an OOM-related memory leak, xmlwf output-close
error handling, and alignment on CHERI).

Upstream changelog:
https://github.com/libexpat/libexpat/blob/R_2_8_5/expat/Changes

## Changes
- `DISTVERSION` 2.8.4 → 2.8.5, distinfo regenerated. The SHA256 matches
the digest of the GitHub release asset.
- pkg-plist: `lib/libexpat.so.1.12.4` → `lib/libexpat.so.1.12.5`.

The libtool version goes from 13:4:12 to 13:5:12. The SONAME is still
`libexpat.so.1` (checked with readelf), so **dependents don't need a
PORTREVISION bump.** COPYING is unchanged (MIT).

## Testing
- `bmake package` succeeded, with no plist errors.
- `bmake test` with `WITH=TEST`: the upstream suite passes (`runtests`
PASS, 0 FAIL).
- portlint: no fatal errors.

Upstream note: the next release will drop the disabled-by-default
`ATTR_INFO` and `MIN_SIZE` features. The port doesn't enable either.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

## Summary by Sourcery

Update the Expat port to version 2.8.5 to incorporate the latest
security and stability fixes.

Bug Fixes:
- Update Expat to the 2.8.5 security release, addressing malformed
UTF-16 surrogate handling and upstream memory, output handling, and
alignment issues.

Chores:
- Refresh package checksums and the installed shared-library filename
for Expat 2.8.5.

Signed-off-by: Lucas Holt <luke at foolishgames.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MidnightBSD/mports/settings/notifications