Navigation:
Browse pkgsrc
(this page)
textproc libxml2
CVSweb ] [ 
Homepage ] [ 
RSS ] [ 
Required by ] 2026-08-15 04:24:28 by Thomas Klausner | Files touched by this commit (2) |  |
Log message: libxml2: update to 2.15.3. From Showta Ishizaki in PR 60591. v2.15.3: Apr 15 2026 ### Security - parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion) - entities: copy children in xmlCopyEntity - c14n: Fix Type confusion in xmlC14NProcessAttrsAxis - python: Do not decref string after adding to the list (double-free / \ use-after-free) - c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free) ### Improvements - schemas: Fix relative schemaLocation resolution in XSI assembly in streaming mode - xmlreader: propagate reader resource loaders to validator parsers - python: Make python bindings python2 compatible - xmlregexp: Fix escape-sequence character range matching - xmlreader: Free input in xmlReaderForFd (memory-leak) - xmlstring: Free cur on every error for xmlStrncat (memory-leak) - catalog: Free xmlCatalogResolveCache on cleanup (memory leak) - Fix nanohttp.c build when --without-output - test: fix mismatched signed/unsigned comparison v2.15.2: Mar 03 2026 ### Security - CVE-2026-1757 fix: Memory leak in xmllint Shell - shell.c - CVE-2026-0990 fix: Prevent infinite recursion in xmlCatalogListXMLResolve - CVE-2026-0992 fix: Exponential behavior when handling - parser: Fix infinite loop in xmlCtxtParseContent - CVE-2025-10911 libxslt related: Ignore next/prev of documents when traversing XPath - CVE-2026-0989 fix: Add RelaxNG include limit - xmlIO: use size_t for buffer size reallocation - uri: fix signed integer overflow in xmlBuildRelativeURISafe - schematron: fix memory leaks on error paths in xmlSchematronParseRule - catalog: fix stack overflow from self-referencing SGML CATALOG entries ### Improvements - fuzz: Make fuzzy encoding match more lenient - Fix C14N type confusion - meson: Fix build with Meson < 1.3 - xmllint: Use zlib directly - xmllint: New option to separate xpath results using null, --xpath0 - autotools: Make valgrind actually check for leaks - meson: Add valgrind test setup - Fix xmlOutputBufferGetContent output when encoder is set - threads: don't force _WIN32_WINNT to Vista if it's set to a higher value - dist: Add generated documentation to the dist as "dist-doc" folder to simplify downstream packaging of doc - Fix xmlRemoveEntity removing from wrong hash table - use duplicating variant in relaxng to mitigate UAF - Fix memory leak in xmlTextWriterStartAttributeNS on OOM - meson: remove hardcoded buildtype=debug default - Fix memory leak of prefix in xmlTextWriterStartElementNS() - writer: Add a few extra NULL checks to avoid memory leaks on corrupt writer path. |
| 2026-02-19 16:09:47 by Thomas Klausner | Files touched by this commit (5) | |
Log message: libxml2: update to 2.15.1. docs disabled (which is the default) because after changes in 2.15 (see below) they need doxygen + libxslt, introducing a dependency cycle. v2.15.1: Oct 16 2025 ### Regressions - parser: Fix attribute normalization and standalone check ### Build - io: Handle clashing error codes on AIX - Fixed compilation error on GCC versions prior to 4.5 (Lars Erik Wik) - meson: Fix install dir of man pages ### Deprecations - tree: Undeprecate several struct members - io: Undeprecate xmlOutputBuffer members - valid: Undeprecate xmlValidGetPotentialChildren v2.15.0: Sep 15 2025 ### Major changes The API documentation is now generated with Doxygen. Building the documentation requires the new --with-docs configuration option as well as Doxygen, xsltproc and the DocBook 4 XSLT stylesheets. The Python bindings are disabled by default now. Building the bindings also requires Doxygen. Support for Schematron is now disabled by default. The parser option XML_PARSE_UNZIP is now required to read compressed data. HTML serialization and handling of character encodings is more in line with the HTML5 spec now. More accessors for xmlParserCtxt were added. ### Deprecations More internal functions and struct members were deprecated. ### Removals The built-in HTTP client and support for LZMA compression were removed. The custom Windows build system in `win32` was removed in favor of CMake. ### Planned removals The Python bindings and support for Schematron validation are planned to be removed in the 2.16 release. The following features are considered for removal: - Modules API (xmlmodule.h) - Support for zlib compressed file I/O RELAX NG support is still in a bad state and a long-term removal candidate. |
| 2026-01-07 09:49:50 by Thomas Klausner | Files touched by this commit (2525) |
Log message: *: recursive bump for icu 78.1 |
| 2026-01-01 11:02:49 by Roland Illig | Files touched by this commit (3) | |
Log message: textproc/libxml2: remove unknown configure options, update homepage |
| 2025-09-14 12:00:43 by Adam Ciarcinski | Files touched by this commit (2) | |
Log message: libxml2: updated to 2.14.6 v2.14.6: Sep 8 2025 Regressions - valid: Don't add ids when validating entity content - Fix initGenericErrorDefaultFunc(NULL) (Samuel Thibault) - valid: Undeprecate xmlAdd*Decl - globals: Include HTMLparser.h, fixing Windows build - io: Fix reading from pipes like stdin on Windows Security - regexp: Avoid integer overflow and OOB array access - tree: Guard against atype corruption Improvements - parser: Fix xmlSaturatedAddSizeT argument type |
| 2025-07-16 10:04:25 by Adam Ciarcinski | Files touched by this commit (2) | |
Log message: libxml2: updated to 2.14.5 v2.14.5: Jul 10 2025 Regressions - html: Don't abort on encoding errors - parser: Fix handling of invalid char refs in recovery mode - xmllint: Print document even in case of XInclude errors - xmllint: Fix --xinclude --path Security - schematron: Fix memory safety issues in xmlSchematronReportOutput - Schematron: Fix null pointer dereference leading to DoS (Michael Mann) - Fix potential buffer overflows of interactive shell (Michael Mann) Improvements - parser: Fix xmlCtxtIsStopped Build systems and portability - schemas: Fix compilation with pre-C99 MSVC - cmake: Add missing endif() in libxml2-config.cmake.in - Fix CMake iconv handling after change to private dependency (Markus Rickert) |
| 2025-06-17 13:09:23 by Adam Ciarcinski | Files touched by this commit (2) | |
Log message: libxml2 py-libxml2: updated to 2.14.4 2.14.4 Regressions - parser: Fix parsing of PublicIds and VersionNums - parser: Fix custom SAX parsers without cdataBlock handler - error: Fix initGenericErrorDefaultFunc compatibility macro again - io: Make xmlOutputBufferCreate* not free encoder on error - reader: Fix null deref on malloc failure - Revert "meson: Install libxml2.py" Security - tree: Fix integer overflow in xmlBuildQName Improvements - parser: Use parser context as default in resource loader - parser: Only validate EnumerationTypes when requested - parser: Undeprecate some parser context members Build systems - cmake: Avoid overlinking with non-CMake libxml2-config.cmake - cmake: Make iconv a private dependency |
| 2025-05-27 23:43:35 by Adam Ciarcinski | Files touched by this commit (4) | |
Log message: libxml2 py-libxml2: updated to 2.14.3 v2.14.3: May 13 2025 Regressions - reader: Fix reading compressed data - parser: Make undeclared entities in XML content fatal - save: Fix XML escape table - save: Fix xmlSave with NULL encoding - Revert "valid: Remove duplicate error messages when streaming" Bug fixes - save: Fix serialization of attribute defaults containing < - io: Fix linkage of __xml*BufferCreateFilename functions Build systems - cmake: Fix installation directories in libxml2-config.cmake - meson: Install libxml2.py Improvements - parser: Make xmlCtxtGetValidCtxt depend on VALID_ENABLED - html: Avoid HTML_PARSE_HTML5 clashing with XML_PARSE_NOENT |
New packages: