@crossbind/port-expat-wasi 2.0.0-beta.58 → 2.0.0-beta.62

package/dist/prebuilt/CMakeLists.txt

@@ -51,7 +51,7 @@ if(NOT PACKAGE_HOST_INDEX EQUAL -1)
         target_link_libraries("${PROJECT_NAME}" INTERFACE "${PROJECT_LIBS_DIR}")
     endif()
 
-    if(NOT APPLE)
+    if(NOT (APPLE AND CMAKE_SYSTEM_NAME STREQUAL "iOS"))
         target_include_directories("${PROJECT_NAME}" INTERFACE "${PROJECT_SOURCE_DIR}/${PROJECT_TARGET_HOST}/include")
     endif()
 endif()

package/dist/prebuilt/wasi-wasm32-st-release/crossbind-source.fingerprint

@@ -1 +1 @@
-0c0db74057090b7ae342bee68078049b7d068e74aa4ff6c2b3f0bf0546a9cd06
+4f1d9c23ac3254bc7a76b76c9be59df1d38190282ef5e199f57ccab1bda192e6

package/dist/prebuilt/wasi-wasm32-st-release/include/expat.h

@@ -20,6 +20,7 @@
    Copyright (c) 2023      Sony Corporation / Snild Dolkow <snild@sony.com>
    Copyright (c) 2024      Taichi Haradaguchi <20001722@ymail.ne.jp>
    Copyright (c) 2025      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Copyright (c) 2026      Braian Plaku <braianplaku@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -921,7 +922,9 @@ XML_SetParamEntityParsing(XML_Parser parser,
    Returns 1 if successful, 0 when called after parsing has started.
    Note: If parser == NULL, the function will do nothing and return 0.
    DEPRECATED since Expat 2.8.0.
+   Please use XML_SetHashSalt16Bytes instead.
 */
+XML_ATTR_DEPRECATED("please use XML_SetHashSalt16Bytes instead")
 XMLPARSEAPI(int)
 XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt);
 
@@ -1040,8 +1043,11 @@ enum XML_FeatureEnum {
   XML_FEATURE_MIN_SIZE,
   XML_FEATURE_SIZEOF_XML_CHAR,
   XML_FEATURE_SIZEOF_XML_LCHAR,
+  /* Added in Expat 2.0.0. */
   XML_FEATURE_NS,
+  /* Added in Expat 2.0.1. */
   XML_FEATURE_LARGE_SIZE,
+  /* Added in Expat 2.1.0. */
   XML_FEATURE_ATTR_INFO,
   /* Added in Expat 2.4.0. */
   XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT,
@@ -1096,7 +1102,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
 */
 #  define XML_MAJOR_VERSION 2
 #  define XML_MINOR_VERSION 8
-#  define XML_MICRO_VERSION 4
+#  define XML_MICRO_VERSION 5
 
 #  ifdef __cplusplus
 }

package/dist/prebuilt/wasi-wasm32-st-release/include/expat_config.h

@@ -70,7 +70,7 @@
 #define PACKAGE_NAME "expat"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "expat 2.8.4"
+#define PACKAGE_STRING "expat 2.8.5"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "expat"
@@ -79,7 +79,7 @@
 #  define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.8.4"
+#define PACKAGE_VERSION "2.8.5"
 
 /* Define to 1 if you have the ANSI C header files. */
 #  ifndef STDC_HEADERS

package/dist/prebuilt/wasi-wasm32-st-release/include/expat_external.h

@@ -16,6 +16,7 @@
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
    Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
+   Copyright (c) 2026      Braian Plaku <braianplaku@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -125,6 +126,17 @@
 #    define XML_ATTR_ALLOC_SIZE(x)
 #  endif
 
+/* Marks a function that Expat still provides but that callers should move off
+   of. */
+#  if defined(__clang__) || defined(__GNUC__)
+#    define XML_ATTR_DEPRECATED(message)                                       \
+      __attribute__((__deprecated__(message)))
+#  elif defined(_MSC_VER)
+#    define XML_ATTR_DEPRECATED(message) __declspec(deprecated(message))
+#  else
+#    define XML_ATTR_DEPRECATED(message) // empty i.e. no deprecation
+#  endif
+
 #  define XMLPARSEAPI(type) XMLIMPORT type XMLCALL
 
 #  ifdef __cplusplus

package/dist/prebuilt/wasi-wasm32-st-release/lib/cmake/{expat-2.8.4 → expat-2.8.5}/expat-config-version.cmake

@@ -9,19 +9,19 @@
 # The variable CVF_VERSION must be set before calling configure_file().
 
 
-set(PACKAGE_VERSION "2.8.4")
+set(PACKAGE_VERSION "2.8.5")
 
 if(PACKAGE_VERSION VERSION_LESS PACKAGE_FIND_VERSION)
   set(PACKAGE_VERSION_COMPATIBLE FALSE)
 else()
 
-  if("2.8.4" MATCHES "^([0-9]+)\\.")
+  if("2.8.5" MATCHES "^([0-9]+)\\.")
     set(CVF_VERSION_MAJOR "${CMAKE_MATCH_1}")
     if(NOT CVF_VERSION_MAJOR VERSION_EQUAL 0)
       string(REGEX REPLACE "^0+" "" CVF_VERSION_MAJOR "${CVF_VERSION_MAJOR}")
     endif()
   else()
-    set(CVF_VERSION_MAJOR "2.8.4")
+    set(CVF_VERSION_MAJOR "2.8.5")
   endif()
 
   if(PACKAGE_FIND_VERSION_RANGE)

package/dist/prebuilt/wasi-wasm32-st-release/lib/pkgconfig/expat.pc

@@ -4,7 +4,7 @@ libdir=${exec_prefix}/lib
 includedir=${prefix}/include
 
 Name: expat
-Version: 2.8.4
+Version: 2.8.5
 Description: expat XML parser
 URL: https://libexpat.github.io/
 Libs: -L${libdir} -lexpat

package/dist/prebuilt/wasi-wasm32-st-release/share/doc/expat/changelog

@@ -13,9 +13,94 @@
 !! will be funded by the City of Munich as part of their                     !!
 !! Open Source Sabbatical (https://opensource.muenchen.de/sabbatical.html)   !!
 !! — thank you!                                                              !!
-!!                                   Sebastian Pipping -- Berlin, 2026-08-03 !!
+!!                                                                           !!
+!! If your business relies on Expat beyond January 2027, please consider     !!
+!! funding the maintenance of Expat to ensure its health and security for    !!
+!! you and others. Thank you!                                                !!
+!!                                                                           !!
+!!                                   Sebastian Pipping -- Berlin, 2026-09-22 !!
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
+Release 2.8.5 Tue September 22 2026
+        Security fixes:
+           #1282  CVE-2026-93990 -- Reject high surrogates not followed by a
+                    low surrogate during UTF-16 decoding; previously, malformed
+                    UTF-16 could be smuggled into the application using Expat
+                    and could cause arbitrary damage there, depending on how
+                    malformed UTF-16 was handled inside the application;
+                    validation was not their job but Expat's. This is similar
+                    to past vulnerability CVE-2022-25235.
+                    Upstream CVSS 3.1 vector:
+                    AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVSS score: 9.8)
+
+///////////////////////////////////////////////////////////////////////////////
+// The next release will drop two (disabled-by-default) features:            //
+//                                                                           //
+// - ATTR_INFO (-DXML_ATTR_INFO, -DEXPAT_ATTR_INFO, --enable-xml-attr-info,  //
+//              function XML_GetAttributeInfo, struct XML_AttrInfo)          //
+// - MIN_SIZE (-DXML_MIN_SIZE, -DEXPAT_MIN_SIZE)                             //
+//                                                                           //
+// If you need them in 2026 and beyond, please share your scenario at        //
+// GitHub issues #1370 (for ATTR_INFO) and/or #1379 (for MIN_SIZE). Thanks!  //
+///////////////////////////////////////////////////////////////////////////////
+
+        Bug fixes:
+           #1346  lib: Fix OOM-related memory leak on a failed overflow check
+           #1371  lib: Fix memory alignment for architectures with 128bit
+                    pointers like CHERI-RISC-V
+           #1367  xmlwf: Handle errors when closing output files
+
+        Other changes:
+           #1354  lib: Reject an XML declaration version other than `1.[0-9]+`
+                    (which is less strict than XML 1.0r4 (fourth edition)
+                    and matches XML 1.0r5 (fifth edition))
+           #1362  lib: Make Clang, GCC and MSVC warn about use of function
+                    XML_SetHashSalt that is deprecated since Expat 2.8.0
+           #1357  lib: Drop internal macros FASTCALL, PTRCALL, PTRFASTCALL
+           #1367  xmlwf: Document that with `-k` the last error determines the
+                    xmlwf exit code in `--help` output
+           #1367  xmlwf: Make exit code 3 documentation match exit code 2 more
+                    closely in `--help` output
+     #1352 #1353  CMake|Windows: Refrain from adding `/source-charset:utf-8`
+                    for MSVC
+     #1366 #1374  Autotools: Be explicit about the minimum required version of
+                    GNU Automake, currently version 1.13 of 2012-12-28
+           #1351  Autotools|macOS: Sync CMake templates with CMake 4.4.3
+           #1349  Replace some internal use of XML_Bool with standard bool
+           #1364  tests: Propagate xmltest.sh failures via exit status
+           #1360  tests|xmlwf: Add `#include "expat_config.h"` where missing
+           #1355  tests: Start covering hash table operation
+     #1350 #1369  tests: Drop __cplusplus leftovers
+           #1378  tests: Fix tail pointer when unlinking the last tracked
+                    allocation
+           #1376  docs: Emphasize that XML_StopParser is not immediate
+           #1381  docs: Sync XML_FeatureEnum value list in doc/reference.html
+     #1356 #1361  Version info bumped from 13:4:12 (libexpat*.so.1.12.4)
+                    to 13:5:12 (libexpat*.so.1.12.5); see https://verbump.de/
+                    for what these numbers do
+
+        Infrastructure:
+           #1347  Add missing .gitignore entries
+           #1360  CI: Detect missing `#include "expat_config.h"`
+           #1368  CI: Bump MinGW Clang from 23.0.1 to 23.1.1
+           #1377  CI: Bump Fil-C from 0.684 to 0.685
+           #1380  CI: Bump Cppcheck from 2.21.0 to 2.22.0
+           #1372  CI: Extract helper script `apply-htmltidy.sh`
+     #1366 #1374  Autotools: Start to also produce .tar.bz3 release tarballs
+
+        Special thanks to:
+            Afonso Januário
+            Braian Plaku
+            Florian Schmaus
+            Huang Wenbin
+            Kamila Szewczyk
+            Kartik Kenchi
+            Leo Camus
+            Matthew Fernandez
+            Stan Ulbrych
+                 and
+            City of Munich Open Source Sabbatical
+
 Release 2.8.4 Mon August 31 2026
         Security fixes:
      #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@crossbind/port-expat-wasi",
-  "version": "2.0.0-beta.58",
-  "nativeVersion": "2.8.4",
+  "version": "2.0.0-beta.62",
+  "nativeVersion": "2.8.5",
   "description": "WASI build of the precompiled Expat XML parser library, built with crossbind. Use it together with the main package @crossbind/port-expat.",
   "homepage": "https://github.com/crossbind/crossbind/tree/main/ports/expat#readme",
   "repository": {
@@ -20,10 +20,10 @@
     "wasi"
   ],
   "dependencies": {
-    "@crossbind/port-expat": "^2.0.0-beta.58"
+    "@crossbind/port-expat": "^2.0.0-beta.62"
   },
   "devDependencies": {
-    "crossbind": "^2.0.0-beta.58"
+    "crossbind": "^2.0.0-beta.62"
   },
   "scripts": {
     "build": "crossbind build -p wasi",