@crossbind/port-expat-wasm 2.0.0-beta.56 → 2.0.0-beta.58

package/dist/prebuilt/wasm-wasm32-mt-release/crossbind-source.fingerprint

@@ -1 +1 @@
-68b007f5969f34d51d32f17a55ba453d4390d0034e28ea7b6ac2d3f830e6978f
+0c0db74057090b7ae342bee68078049b7d068e74aa4ff6c2b3f0bf0546a9cd06

package/dist/prebuilt/wasm-wasm32-mt-release/include/expat.h

@@ -1096,7 +1096,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
 */
 #  define XML_MAJOR_VERSION 2
 #  define XML_MINOR_VERSION 8
-#  define XML_MICRO_VERSION 3
+#  define XML_MICRO_VERSION 4
 
 #  ifdef __cplusplus
 }

package/dist/prebuilt/wasm-wasm32-mt-release/include/expat_config.h

@@ -70,7 +70,7 @@
 #define PACKAGE_NAME "expat"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "expat 2.8.3"
+#define PACKAGE_STRING "expat 2.8.4"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "expat"
@@ -79,7 +79,7 @@
 #  define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.8.3"
+#define PACKAGE_VERSION "2.8.4"
 
 /* Define to 1 if you have the ANSI C header files. */
 #  ifndef STDC_HEADERS

package/dist/prebuilt/wasm-wasm32-mt-release/lib/cmake/{expat-2.8.3 → expat-2.8.4}/expat-config-version.cmake

@@ -9,19 +9,19 @@
 # The variable CVF_VERSION must be set before calling configure_file().
 
 
-set(PACKAGE_VERSION "2.8.3")
+set(PACKAGE_VERSION "2.8.4")
 
 if(PACKAGE_VERSION VERSION_LESS PACKAGE_FIND_VERSION)
   set(PACKAGE_VERSION_COMPATIBLE FALSE)
 else()
 
-  if("2.8.3" MATCHES "^([0-9]+)\\.")
+  if("2.8.4" MATCHES "^([0-9]+)\\.")
     set(CVF_VERSION_MAJOR "${CMAKE_MATCH_1}")
     if(NOT CVF_VERSION_MAJOR VERSION_EQUAL 0)
       string(REGEX REPLACE "^0+" "" CVF_VERSION_MAJOR "${CVF_VERSION_MAJOR}")
     endif()
   else()
-    set(CVF_VERSION_MAJOR "2.8.3")
+    set(CVF_VERSION_MAJOR "2.8.4")
   endif()
 
   if(PACKAGE_FIND_VERSION_RANGE)

package/dist/prebuilt/wasm-wasm32-mt-release/lib/pkgconfig/expat.pc

@@ -4,7 +4,7 @@ libdir=${exec_prefix}/lib
 includedir=${prefix}/include
 
 Name: expat
-Version: 2.8.3
+Version: 2.8.4
 Description: expat XML parser
 URL: https://libexpat.github.io/
 Libs: -L${libdir} -lexpat

package/dist/prebuilt/wasm-wasm32-mt-release/share/doc/expat/changelog

@@ -16,6 +16,71 @@
 !!                                   Sebastian Pipping -- Berlin, 2026-08-03 !!
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
+Release 2.8.4 Mon August 31 2026
+        Security fixes:
+     #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
+                    "attribute isCdata lookups" that allowed denial of service
+                    attacks through moderately sized crafted XML input
+                    (CWE-407).
+                    The vulnerability is closely related to past CVE-2026-45186
+                    that was fixed with Expat 2.8.1.
+                    Please note that a layer of compression around XML can
+                    significantly reduce the minimum attack payload size.
+                    Upstream CVSS 3.1 vector:
+                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
+                    (Note the "AV:N" for network/remote.)
+           #1322  CVE-2026-76957 -- Protect custom encoding callbacks from
+                    parser re-entry. The vulnerability is closely related to
+                    past issues CVE-2026-50219, CVE-2026-56131 and
+                    CVE-2026-56412 that were all fixed with Expat 2.8.2.
+           #1326  CVE-2026-76956 -- Fix inverted getentropy() return handling
+                    Allows for hash flooding denial of services in
+                    configurations where getentropy is configured or detected
+                    as the only high quality entropy extractor.
+                    Upstream CVSS 3.1 vector:
+                    AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9)
+                    (Note the "AV:N" for network/remote.)
+
+        Other changes:
+     #1332 #1333  CMake: Only add `/source-charset:utf-8` when `/utf-8` is not
+                    present
+           #1315  lib: Resolve (currently unreachable) undefined behavior from
+                    overshifting a signed int to the left
+     #1325 #1334  lib: Support read-only hash table lookup with keys that are
+                    not zero-terminated
+           #1340  lib: Use a C99 bool for `ENTITY.open`
+           #1319  Fix typo in comment
+           #1320  Sync file headers
+     #1328 #1329  Version info bumped from 13:3:12 (libexpat*.so.1.12.3)
+                    to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/
+                    for what these numbers do
+
+        Infrastructure:
+     #1317 #1335  CI: Cover compilation and execution with Fil-C
+           #1337  CI: Cover compilation and execution on riscv64
+           #1338  CI: Cover compilation and execution with Clang-based MinGW
+           #1339  CI: Cover compilation and execution on (big-endian) s390x
+           #1316  CI: Run test suite with musl, also
+           #1336  CI: Bump WASI SDK from 33 to 34
+           #1345  CI: Bump Clang from 22 to 23
+
+        Special thanks to:
+            Alberto Maschietto
+            Alexander Bluhm
+            Berkay Eren Ürün
+            Darren Carreras
+            Fabian Wahle (Hap Security)
+            Matteo Forzan
+            Matthew Fernandez
+            Sorrashut Kaewtaworn
+            Wade Sparks III
+            Zeyou Liu
+                 and
+            City of Munich Open Source Sabbatical
+            Moonshot AI
+            VulnCheck
+            Z.ai
+
 Release 2.8.3 Mon August 10 2026
         Security fixes:
            #1296  CVE-2026-72522 -- Fix an out-of-bounds read and the resulting

package/dist/prebuilt/wasm-wasm32-st-release/crossbind-source.fingerprint

@@ -1 +1 @@
-68b007f5969f34d51d32f17a55ba453d4390d0034e28ea7b6ac2d3f830e6978f
+0c0db74057090b7ae342bee68078049b7d068e74aa4ff6c2b3f0bf0546a9cd06

package/dist/prebuilt/wasm-wasm32-st-release/include/expat.h

@@ -1096,7 +1096,7 @@ XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
 */
 #  define XML_MAJOR_VERSION 2
 #  define XML_MINOR_VERSION 8
-#  define XML_MICRO_VERSION 3
+#  define XML_MICRO_VERSION 4
 
 #  ifdef __cplusplus
 }

package/dist/prebuilt/wasm-wasm32-st-release/include/expat_config.h

@@ -70,7 +70,7 @@
 #define PACKAGE_NAME "expat"
 
 /* Define to the full name and version of this package. */
-#define PACKAGE_STRING "expat 2.8.3"
+#define PACKAGE_STRING "expat 2.8.4"
 
 /* Define to the one symbol short name of this package. */
 #define PACKAGE_TARNAME "expat"
@@ -79,7 +79,7 @@
 #  define PACKAGE_URL ""
 
 /* Define to the version of this package. */
-#define PACKAGE_VERSION "2.8.3"
+#define PACKAGE_VERSION "2.8.4"
 
 /* Define to 1 if you have the ANSI C header files. */
 #  ifndef STDC_HEADERS

package/dist/prebuilt/wasm-wasm32-st-release/lib/cmake/{expat-2.8.3 → expat-2.8.4}/expat-config-version.cmake

@@ -9,19 +9,19 @@
 # The variable CVF_VERSION must be set before calling configure_file().
 
 
-set(PACKAGE_VERSION "2.8.3")
+set(PACKAGE_VERSION "2.8.4")
 
 if(PACKAGE_VERSION VERSION_LESS PACKAGE_FIND_VERSION)
   set(PACKAGE_VERSION_COMPATIBLE FALSE)
 else()
 
-  if("2.8.3" MATCHES "^([0-9]+)\\.")
+  if("2.8.4" MATCHES "^([0-9]+)\\.")
     set(CVF_VERSION_MAJOR "${CMAKE_MATCH_1}")
     if(NOT CVF_VERSION_MAJOR VERSION_EQUAL 0)
       string(REGEX REPLACE "^0+" "" CVF_VERSION_MAJOR "${CVF_VERSION_MAJOR}")
     endif()
   else()
-    set(CVF_VERSION_MAJOR "2.8.3")
+    set(CVF_VERSION_MAJOR "2.8.4")
   endif()
 
   if(PACKAGE_FIND_VERSION_RANGE)

package/dist/prebuilt/wasm-wasm32-st-release/lib/pkgconfig/expat.pc

@@ -4,7 +4,7 @@ libdir=${exec_prefix}/lib
 includedir=${prefix}/include
 
 Name: expat
-Version: 2.8.3
+Version: 2.8.4
 Description: expat XML parser
 URL: https://libexpat.github.io/
 Libs: -L${libdir} -lexpat

package/dist/prebuilt/wasm-wasm32-st-release/share/doc/expat/changelog

@@ -16,6 +16,71 @@
 !!                                   Sebastian Pipping -- Berlin, 2026-08-03 !!
 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
 
+Release 2.8.4 Mon August 31 2026
+        Security fixes:
+     #1321 #1331  CVE-2026-66046, CVE-2026-76641 -- Fix quadratic runtime from
+                    "attribute isCdata lookups" that allowed denial of service
+                    attacks through moderately sized crafted XML input
+                    (CWE-407).
+                    The vulnerability is closely related to past CVE-2026-45186
+                    that was fixed with Expat 2.8.1.
+                    Please note that a layer of compression around XML can
+                    significantly reduce the minimum attack payload size.
+                    Upstream CVSS 3.1 vector:
+                    AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 7.5)
+                    (Note the "AV:N" for network/remote.)
+           #1322  CVE-2026-76957 -- Protect custom encoding callbacks from
+                    parser re-entry. The vulnerability is closely related to
+                    past issues CVE-2026-50219, CVE-2026-56131 and
+                    CVE-2026-56412 that were all fixed with Expat 2.8.2.
+           #1326  CVE-2026-76956 -- Fix inverted getentropy() return handling
+                    Allows for hash flooding denial of services in
+                    configurations where getentropy is configured or detected
+                    as the only high quality entropy extractor.
+                    Upstream CVSS 3.1 vector:
+                    AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (CVSS score: 5.9)
+                    (Note the "AV:N" for network/remote.)
+
+        Other changes:
+     #1332 #1333  CMake: Only add `/source-charset:utf-8` when `/utf-8` is not
+                    present
+           #1315  lib: Resolve (currently unreachable) undefined behavior from
+                    overshifting a signed int to the left
+     #1325 #1334  lib: Support read-only hash table lookup with keys that are
+                    not zero-terminated
+           #1340  lib: Use a C99 bool for `ENTITY.open`
+           #1319  Fix typo in comment
+           #1320  Sync file headers
+     #1328 #1329  Version info bumped from 13:3:12 (libexpat*.so.1.12.3)
+                    to 13:4:12 (libexpat*.so.1.12.4); see https://verbump.de/
+                    for what these numbers do
+
+        Infrastructure:
+     #1317 #1335  CI: Cover compilation and execution with Fil-C
+           #1337  CI: Cover compilation and execution on riscv64
+           #1338  CI: Cover compilation and execution with Clang-based MinGW
+           #1339  CI: Cover compilation and execution on (big-endian) s390x
+           #1316  CI: Run test suite with musl, also
+           #1336  CI: Bump WASI SDK from 33 to 34
+           #1345  CI: Bump Clang from 22 to 23
+
+        Special thanks to:
+            Alberto Maschietto
+            Alexander Bluhm
+            Berkay Eren Ürün
+            Darren Carreras
+            Fabian Wahle (Hap Security)
+            Matteo Forzan
+            Matthew Fernandez
+            Sorrashut Kaewtaworn
+            Wade Sparks III
+            Zeyou Liu
+                 and
+            City of Munich Open Source Sabbatical
+            Moonshot AI
+            VulnCheck
+            Z.ai
+
 Release 2.8.3 Mon August 10 2026
         Security fixes:
            #1296  CVE-2026-72522 -- Fix an out-of-bounds read and the resulting

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@crossbind/port-expat-wasm",
-  "version": "2.0.0-beta.56",
-  "nativeVersion": "2.8.3",
+  "version": "2.0.0-beta.58",
+  "nativeVersion": "2.8.4",
   "description": "WebAssembly build of the precompiled Expat XML parser library, built with crossbind. Use it together with the main package @crossbind/port-expat.",
   "homepage": "https://github.com/crossbind/crossbind/tree/main/ports/expat#readme",
   "repository": {
@@ -20,10 +20,10 @@
     "wasm"
   ],
   "dependencies": {
-    "@crossbind/port-expat": "^2.0.0-beta.56"
+    "@crossbind/port-expat": "^2.0.0-beta.58"
   },
   "devDependencies": {
-    "crossbind": "^2.0.0-beta.56"
+    "crossbind": "^2.0.0-beta.58"
   },
   "scripts": {
     "build": "crossbind build -p wasm",