Fedora Account System
Red Hat Associate
Red Hat Customer
Releases retrieved: 2.8.2 Upstream release that is considered latest: 2.8.2 Current version/release in rawhide: 2.8.1-1.fc45 URL: https://libexpat.github.io Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_Monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/770/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/expat
Scratch build failed. Details below: BuilderException: Build failed: Command '['rpmbuild', '-D', '_sourcedir .', '-D', '_topdir .', '-bs', '/var/tmp/thn-s07wbn3w/expat.spec']' returned non-zero exit status 1. StdOut: setting SOURCE_DATE_EPOCH=1782345600 error: Bad file: expat-2.8.2.tar.gz: No such file or directory error: Bad file: expat-2.8.2.tar.gz.asc: No such file or directory RPM build errors: Bad file: expat-2.8.2.tar.gz: No such file or directory Bad file: expat-2.8.2.tar.gz.asc: No such file or directory Traceback: File "/usr/local/lib/python3.14/site-packages/hotness/use_cases/package_scratch_build_use_case.py", line 55, in build result = self.builder.build(request.package, request.opts) File "/usr/local/lib/python3.14/site-packages/hotness/builders/koji.py", line 251, in build raise BuilderException( str(exc), value=output, std_out=std_out, std_err=std_err ) If you think this issue is caused by some bug in the-new-hotness, please report it on the-new-hotness issue tracker: https://github.com/fedora-infra/the-new-hotness/issues
Created attachment 2146635 [details] Update to 2.8.2 (#2492962)
Releases retrieved: 2.8.3 Upstream release that is considered latest: 2.8.3 Current version/release in rawhide: 2.8.1-2.fc45 URL: https://libexpat.github.io Please consult the package updates policy before you issue an update to a stable branch: https://docs.fedoraproject.org/en-US/fesco/Updates_Policy/ More information about the service that created this bug can be found at: https://docs.fedoraproject.org/en-US/package-maintainers/Upstream_Release_Monitoring Please keep in mind that with any upstream change, there may also be packaging changes that need to be made. Specifically, please remember that it is your responsibility to review the new version to ensure that the licensing is still correct and that no non-free or legally problematic items have been added upstream. Based on the information from Anitya: https://release-monitoring.org/project/770/ To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/expat
Scratch build failed. Details below: BuilderException: Build failed: Command '['rpmbuild', '-D', '_sourcedir .', '-D', '_topdir .', '-bs', '/var/tmp/thn-n0gl7_i_/expat.spec']' returned non-zero exit status 1. StdOut: setting SOURCE_DATE_EPOCH=1786320000 error: Bad file: expat-2.8.3.tar.gz: No such file or directory error: Bad file: expat-2.8.3.tar.gz.asc: No such file or directory RPM build errors: Bad file: expat-2.8.3.tar.gz: No such file or directory Bad file: expat-2.8.3.tar.gz.asc: No such file or directory Traceback: File "/usr/local/lib/python3.14/site-packages/hotness/use_cases/package_scratch_build_use_case.py", line 55, in build result = self.builder.build(request.package, request.opts) File "/usr/local/lib/python3.14/site-packages/hotness/builders/koji.py", line 251, in build raise BuilderException( str(exc), value=output, std_out=std_out, std_err=std_err ) If you think this issue is caused by some bug in the-new-hotness, please report it on the-new-hotness issue tracker: https://github.com/fedora-infra/the-new-hotness/issues
Created attachment 2154216 [details] Update to 2.8.3 (#2492962)
(In reply to Upstream Release Monitoring from comment #3) > Releases retrieved: 2.8.3 > Upstream release that is considered latest: 2.8.3 > Current version/release in rawhide: 2.8.1-2.fc45 > URL: https://libexpat.github.io > Based on the information from Anitya: https://release-monitoring.org/project/770/ > To change the monitoring settings for the project, please visit: https://src.fedoraproject.org/rpms/expat Release 2.8.3 Mon August 10 2026 Security fixes: #1296 CVE-2026-72522 -- Fix an out-of-bounds read and the resulting infinite loop caused by treating low surrogates (Unicode) the same as high surrogates in functions *_toUtf16. Needs Expat compiled with 16bit character support (e.g. with Firefox and/or on Windows) to be affected. Upstream CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5) (Note the "AV:N" for network/remote, the "AV:L" in NVD by Mitre is mistaken.) Original bug report from Mozilla at: https://bugzilla.mozilla.org/show_bug.cgi?id=2053153 Bug fixes: #1297 #1300 lib: Fix support for 2+ GiB documents (regression from 2.8.2) #1286 lib: Reject empty version in the XML declaration #1305 #1306 lib: Fix printf format for AIX Other changes: #1309 CMake|AIX: Enable EXPAT_DEV_URANDOM by default for AIX #1295 CMake|Windows: Add a 64bit MinGW toolchain file #1287 #1289 CMake|Windows: Start invoking MSVC with /source-charset:utf-8 #1289 CMake|Windows: Start requiring MSVC 2015 Update 2 or later #1300 Document the current wrap-around issues with functions - XML_GetCurrentByteIndex - XML_GetCurrentColumnNumber - XML_GetCurrentLineNumber - XML_GetAttributeInfo explicitly. #1303 Address Clang Static Analyzer 22 warning `core.NullPointerArithm` #1313 #1314 Version info bumped from 13:2:12 (libexpat*.so.1.12.2) to 13:3:12 (libexpat*.so.1.12.3); see https://verbump.de/ for what these numbers do Infrastructure: #1311 CI: Limit workflow runtime and package installation runtime #1310 CI: Pin Cppcheck version for a robust CI #1310 CI: Migrate Cppcheck CI from macOS to Linux #1312 CI: Get CFLAGS and CXXFLAGS back in sync for both Emscripten and WASI SDK #1304 CI: Activate AddressSanitizer for MSVC Windows CI #1308 CI: Introduce zizmor static analysis for GitHub Actions #1308 CI: Start using `persist-credentials: false` with Git checkout #1219 CI: Add a 7 day cooldown to Dependabot for GitHub Actions #1302 #1303 CI: Bump Clang from 21 to 22 #1293 #1294 Update project status for 2026-08 #1301 #1307 Add SPDX license identifiers to the source code Special thanks to: Evgeny Kotkov Henri Sivonen Kartik Kenchi Matthew Fernandez Matthew Wozniczka Stan Ulbrych Tuukka Pasanen William Woodruff and Anthropic City of Munich Open Source Sabbatical Mozilla Security Team Subversion zizmor static analysis Release 2.8.2 Thu June 25 2026 Security fixes: #1246 CVE-2026-50219 -- Disallow calls to functions `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`, `XML_ParserFree`, `XML_ParserReset` to guard e.g. Expat bindings from memory corruption; this CPython issue is related: https://github.com/python/cpython/issues/146169 #1267 CVE-2026-56131 -- Protect XML_ResumeParser from being called from a handler, plugging a hole in the fix to CVE-2026-50219 #1272 CVE-2026-56132 -- Fix out-of-bound scaffolding index store in `doProlog` #1229 #1232 CVE-2026-56403 -- Integer overflow in `storeAtts` #1249 CVE-2026-56404 -- Integer overflow in `addBinding` #1251 CVE-2026-56405 -- Integer overflow in `getAttributeId` #1255 CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer` #1262 CVE-2026-56407 -- Integer overflow in `textLen` handling #565 CVE-2026-56408 -- Integer overflow in `copyString` (commit 16e2efd867ea8567ffa012210b52ef5918e20817) #1259 CVE-2026-56409 -- xmlwf: Integer overflow in output path join #1252 CVE-2026-56410 -- xmlwf: Integer overflow in `resolveSystemId` #1263 CVE-2026-56411 -- xmlwf: Integer overflow in notation list allocation #1278 CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in `doCdataSection`, plugging a hole in the fix to CVE-2026-50219 Bug fixes: #1260 xmlwf: Escape names and base URI in meta output #1266 xmlwf: Pick a safe quote for notation system and public IDs Other changes: #1257 CMake|Autotools: Stop using /dev/urandom by default #1244 #1254 CMake: Fix guard for Unix sources of entropy #1183 #1270 CMake|Windows: Add missing export for symbol `XML_SetHashSalt16Bytes` #1236 CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced #1283 Limit output indentation for EXPAT_ENTITY_DEBUG=1 and allow unlimited indentation via EXPAT_ENTITY_DEBUG=2 #565 Replace some loops by use of `memcpy`, `strlen`, `wcslen` #1220 lib: Use a size_t for group sizes #1221 lib: Fix too-conservative integer overflow check when appending raw name #1222 lib: Simplify attribute allocation/management logic #1224 Update fallthrough annotations to satisfy Clang and GCC #1226 lib: Remove unnecessary void * casts in random code #1228 lib: Reduce scope of locals in storeAtts #1230 lib: Count attributes with size_t variables #1238 Minor get-buffer improvements #1239 #1240 lib|tests: Include header expat_config.h first #1241 lib: Shrink size of XML_GetBuffer #1242 lib: Remove a legacy comment #1243 lib: XML_ParserReset: Extract repeated linked-list move logic #1243 lib: Unify entity free lists #1247 lib: Fix use of '0' as boolean literal #1248 lib: Make XML_Index overflow check more intuitive #1256 lib: Use size_t for counting string/URI lengths #1258 lib: XML_GetInputContext: Remove use of 0 for NULL #1261 Comment typo fixes #1275 Teach Memory Sanitizer semantics of randomization functions #1276 #1281 Version info bumped from 13:1:12 (libexpat*.so.1.12.1) to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/ for what these numbers do Infrastructure: #1231 perl-integration.yml: Bump to XML::Parser 2.59 #1237 emscripten.yml: Bump from Ubuntu 22.04 to 24.04 #1183 #1271 windows-build.yml: Cover completeness of file libexpat.def.cmake #1274 linux.yml: Make llvm-symbolizer available in CI Special thanks to: Alessandro Gario Asher Darden Christoph Reiter Haris Hussain Matthew Fernandez Kartik Kenchi Nick Begg Sajin S Yousef Shanableh and Anthropic Astra Security Trail of Bits
FEDORA-2026-fefd0cbb42 (expat-2.8.3-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-fefd0cbb42
FEDORA-2026-b4cd43a7dc (expat-2.8.3-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-b4cd43a7dc
FEDORA-2026-f27833fa59 (expat-2.8.3-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-f27833fa59
FEDORA-2026-f27833fa59 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-f27833fa59` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-f27833fa59 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-b4cd43a7dc has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-b4cd43a7dc` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-b4cd43a7dc See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-fefd0cbb42 has been pushed to the Fedora 45 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-fefd0cbb42` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-fefd0cbb42 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2026-b4cd43a7dc (expat-2.8.3-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-f27833fa59 (expat-2.8.3-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report.