staging/xback/tools/expat, branch master

tools/expat: update to 2.9.0

2026-10-11T07:45:53Z

Includes fixes for: - CVE-2026-93990 - CVE-2026-102633 - CVE-2026-77214 Full changelog: https://github.com/libexpat/libexpat/blob/R_2_9_0/expat/Changes Signed-off-by: Yanase Yuki Link: https://github.com/openwrt/openwrt/pull/25752 Signed-off-by: Nick Hainke

tools: cache the configure results of eleven more autotools tools

2026-09-22T18:29:59Z

Configure stage without a cache against a warm cache: mtools 3.34 s -> 0.28 s gengetopt 4.39 s -> 2.13 s fakeroot 10.97 s -> 8.73 s xz 4.32 s -> 2.17 s libressl 3.07 s -> 1.46 s flex 12.32 s -> 10.98 s expat 2.74 s -> 1.52 s bc 1.34 s -> 0.38 s dosfstools 3.13 s -> 2.54 s libtool 2.86 s -> 2.29 s mtd-utils 4.06 s -> 3.56 s flex, fakeroot, dosfstools and mtd-utils run autoreconf in the same stage, and the cache does not reach that part. Each of the eleven configures the same way with a warm cache as it does without one: the check configures three times, without a cache, with a cold cache and with a warm cache, and every generated file of the first and the last run is identical. A static scan of each configure script found no cache check that changes CFLAGS, CPPFLAGS, LDFLAGS or LIBS without restoring it. patchelf, mklibs and automake pass the same check but gain less than half a second, so they stay out. make world after make tools/clean now takes 121 s against 177 s with cold caches. Signed-off-by: John Crispin

tools/expat: update to 2.8.4

2026-09-12T14:49:17Z

This version bump includes fixes for the following CVEs: - CVE-2026-66046 - CVE-2026-72522 - CVE-2026-76641 - CVE-2026-76956 - CVE-2026-76957 Full release notes: https://github.com/libexpat/libexpat/blob/master/expat/Changes Signed-off-by: Wei-Ting Yang Link: https://github.com/openwrt/openwrt/pull/25134 Signed-off-by: Hauke Mehrtens

tools/expat: update to 2.8.2

2026-07-02T14:36:16Z

This version bump includes fixes for the following CVEs: - CVE-2026-41080 - CVE-2026-45186 - CVE-2026-50219 - CVE-2026-56131 - CVE-2026-56132 - CVE-2026-56403 - CVE-2026-56404 - CVE-2026-56405 - CVE-2026-56406 - CVE-2026-56407 - CVE-2026-56408 - CVE-2026-56409 - CVE-2026-56410 - CVE-2026-56411 - CVE-2026-56412 Full release notes: https://github.com/libexpat/libexpat/blob/master/expat/Changes Signed-off-by: Wei-Ting Yang Link: https://github.com/openwrt/openwrt/pull/24016 Signed-off-by: Robert Marko

tools/expat: update to 2.7.5

2026-04-20T06:50:19Z

Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_5/expat/Changes Fixes: CVE-2026-32776 CVE-2026-32777 CVE-2026-32778 Link: https://github.com/openwrt/openwrt/pull/23007 Signed-off-by: Nick Hainke

tools/expat: fix PKG_CPE_ID

2026-03-14T19:34:36Z

cpe:/a:libexpat_project:libexpat is the correct CPE ID for expat: https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libexpat_project:libexpat Fixes: ff59f3f4bdb56c779579aaa11b815f4c83abbac5 (tools/expat: fix PKG_CPE_ID) Signed-off-by: Fabrice Fontaine Link: https://github.com/openwrt/openwrt/pull/22406 Signed-off-by: Hauke Mehrtens

tools/expat: update to 2.7.4

2026-02-07T08:06:52Z

Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_4/expat/Changes Fixes: CVE-2026-24515 CVE-2026-25210 Link: https://github.com/openwrt/openwrt/pull/21907 Signed-off-by: Nick Hainke

expat: Update to 2.7.3

2025-09-27T21:49:44Z

Fixes: CVE-2025-59375 Regression from: CVE-2024-8176 Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_3/expat/Changes Signed-off-by: Ted Hess

tools/expat: fix compilation with ccache

2025-07-29T19:33:12Z

Even though expat is a C library, the configure script tests both C and C++ compilers so a fix is needed for the latter. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/19594 Signed-off-by: Robert Marko

tools/expat: bump to 2.7.1 to fix several CVEs

2025-04-06T18:01:46Z

Addresses CVE-2024-8176 and CVE-2024-50602. Changelog: https://github.com/libexpat/libexpat/blob/R_2_7_1/expat/Changes Fixes: https://github.com/openwrt/packages/issues/26255 Fixes: https://github.com/advisories/GHSA-9hcv-xw76-m4h6 Fixes: https://github.com/advisories/GHSA-79wf-qgrg-2p6c Signed-off-by: George Sapkin Link: https://github.com/openwrt/openwrt/pull/18421 Signed-off-by: Hauke Mehrtens