Changes: Document loop replacement

.ci.sh

@@ -6,12 +6,10 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2025 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2017      Rolf Eike Beer <eike@sf-mail.de>
 # Copyright (c) 2019      Mohammed Khajapasha <mohammed.khajapasha@intel.com>
-# Copyright (c) 2019      Manish, Kumar <manish3.kumar@intel.com>
 # Copyright (c) 2019      Philippe Antoine <contact@catenacyber.fr>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -38,8 +36,10 @@ set -e
 if [[ ${RUNNER_OS} = macOS ]]; then
     latest_brew_python3_bin="$(ls -1d /usr/local/Cellar/python/3.*/bin | sort -n | tail -n1)"
     export PATH="${latest_brew_python3_bin}${PATH:+:}${PATH}"
+    export PATH="/usr/local/opt/coreutils/libexec/gnubin${PATH:+:}${PATH}"
+    export PATH="/usr/local/opt/findutils/libexec/gnubin${PATH:+:}${PATH}"
 elif [[ ${RUNNER_OS} = Linux ]]; then
-    export PATH="/usr/lib/llvm-21/bin:${PATH}"
+    export PATH="/usr/lib/llvm-15/bin:${PATH}"
 else
     echo "Unsupported RUNNER_OS \"${RUNNER_OS}\"." >&2
     exit 1
@@ -64,7 +64,10 @@ elif [[ ${MODE} = cmake-oos ]]; then
     cmake ${CMAKE_ARGS} ..
     make VERBOSE=1 CTEST_OUTPUT_ON_FAILURE=1 all test
     make DESTDIR="${PWD}"/ROOT install
-    find ROOT | cut -c 6- | sort
+    find ROOT -printf "%P\n" | sort
+elif [[ ${MODE} = clang-format ]]; then
+    ./apply-clang-format.sh
+    git diff --exit-code
 elif [[ ${MODE} = coverage-sh ]]; then
     ./coverage.sh
 else

.gitattributes

@@ -1,4 +0,0 @@
-* text=auto
-testdata/largefiles/* -text
-testdata/largefiles/README.txt text=auto
-*.bat text eol=crlf

.github/workflows/autotools-cmake.yml

@@ -5,9 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
+# Copyright (c) 2021-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -36,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -45,44 +42,23 @@ jobs:
   checks:
     name: Ensure that GNU Autotools and CMake build systems agree
     strategy:
-      fail-fast: false
       matrix:
         include:
-          - os: macos-14
+          - os: macos-11
             configure_args:
             cmake_args:
-          - os: ubuntu-22.04
+          - os: ubuntu-20.04
             configure_args:
             cmake_args:
-          - os: ubuntu-22.04
+          - os: ubuntu-20.04
             configure_args: --host=i686-w64-mingw32
             cmake_args: -DCMAKE_TOOLCHAIN_FILE=cmake/mingw-toolchain.cmake
-          - os: ubuntu-24.04
-            configure_args: >-
-              --enable-symbol-versioning
-              LDFLAGS=-Wl,--no-undefined-version
-            cmake_args: >-
-              -DEXPAT_SYMBOL_VERSIONING=ON
-              -DCMAKE_EXE_LINKER_FLAGS=-Wl,--no-undefined-version
-              -DCMAKE_MODULE_LINKER_FLAGS=-Wl,--no-undefined-version
-              -DCMAKE_SHARED_LINKER_FLAGS=-Wl,--no-undefined-version
-          - os: ubuntu-24.04
-            configure_args: >-
-              --enable-xml-attr-info
-              --enable-symbol-versioning
-              LDFLAGS=-Wl,--no-undefined-version
-            cmake_args: >-
-              -DEXPAT_ATTR_INFO=ON
-              -DEXPAT_SYMBOL_VERSIONING=ON
-              -DCMAKE_EXE_LINKER_FLAGS=-Wl,--no-undefined-version
-              -DCMAKE_MODULE_LINKER_FLAGS=-Wl,--no-undefined-version
-              -DCMAKE_SHARED_LINKER_FLAGS=-Wl,--no-undefined-version
     defaults:
       run:
         shell: bash
     runs-on: "${{ matrix.os }}"
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
 
     - name: (Linux) Install build dependencies
       if: "${{ runner.os == 'Linux' }}"
@@ -98,12 +74,12 @@ jobs:
     - name: (macOS) Install build dependencies
       if: "${{ runner.os == 'macOS' }}"
       run: |
-        brew uninstall cmake
         brew install \
             autoconf \
             automake \
             cmake \
             docbook2x \
+            gnu-sed \
             libtool \
             lzip
 
@@ -147,31 +123,11 @@ jobs:
         cd expat/expat-*.*.*/
 
         if [[ "${{ runner.os }}" == macOS ]]; then
-          # There is a known difference between Autotools and CMake for macOS:
-          #   Autotools:
-          #   - /usr/local/lib123/libexpat.<major>.dylib
-          #   - /usr/local/lib123/libexpat.dylib
-          #   CMake:
-          #   - /usr/local/lib123/libexpat.<major>.<minor>.<patch>.dylib
-          #   - /usr/local/lib123/libexpat.<major>.dylib
-          #   - /usr/local/lib123/libexpat.dylib
-          # We patch the CMake side in line here to get the differ below to empty.
-          ( cd build_cmake/ROOT/usr/local/lib*/cmake/expat-*/ \
-              && sed -E 's,(libexpat\.[0-9]+)\.[0-9]+\.[0-9]+(\.dylib),\1\2,' expat-noconfig.cmake > expat-noconfig-patched.cmake \
-              && ! diff -u0 expat-noconfig{,-patched}.cmake \
-              && mv expat-noconfig{-patched,}.cmake )
-
           # Autotools' LT_LIB_M has a hardcoded exclude for "*-*-darwin*" hosts,
           # while macOS does have libm and is successfully found by CMake.
           # We patch the CMake side in line here to get the differ below to empty.
-          #
-          # Both GNU and BSD sed can edit in-place without creating a backup,
-          # but not with the same syntax.  The syntax for editing in-place
-          # _with_ a backup however is the same, so do that, then remove the
-          # backup so it doesn't show up in the diff later.
-          sed -e 's,-lm,,' -i.bak \
-              build_cmake/ROOT/usr/local/lib*/pkgconfig/expat.pc
-          rm -f build_cmake/ROOT/usr/local/lib*/pkgconfig/expat.pc.bak
+          export PATH="$(brew --prefix)/opt/gnu-sed/libexec/gnubin:${PATH}"
+          sed 's,-lm,,' -i build_cmake/ROOT/usr/local/lib*/pkgconfig/expat.pc
         fi
 
         diff \
@@ -190,20 +146,9 @@ jobs:
 
     - name: (Linux except MinGW) Check for identical exported symbols from both build systems
       if: "${{ runner.os == 'Linux' && ! contains(matrix.configure_args, 'mingw') }}"
-      env:
-        maximum: "${{ contains(matrix.configure_args, '--enable-xml-attr-info') && 'true' || 'false' }}"
-        symbol_versioning: "${{ contains(matrix.configure_args, '--enable-symbol-versioning') && 'true' || 'false' }}"
       run: |
         list_shared_library_symbols_sh="${GITHUB_WORKSPACE}"/.github/workflows/scripts/list-shared-library-symbols.sh
-        if ${symbol_versioning} ; then
-            if ${maximum} ; then
-                exported_symbols_txt="${GITHUB_WORKSPACE}"/.github/workflows/data/exported-symbols-versioned-maximum.txt
-            else
-                exported_symbols_txt="${GITHUB_WORKSPACE}"/.github/workflows/data/exported-symbols-versioned-default.txt
-            fi
-        else
-            exported_symbols_txt="${GITHUB_WORKSPACE}"/.github/workflows/data/exported-symbols-unversioned.txt
-        fi
+        exported_symbols_txt="${GITHUB_WORKSPACE}"/.github/workflows/data/exported-symbols.txt
 
         set -x
         cd expat/expat-*.*.*/

.github/workflows/clang-format.yml

@@ -1,68 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2021-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Enforce clang-format clean code
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  clang_format:
-    name: Enforce clang-format clean code
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install clang-format 21
-      run: |-
-        set -x
-        source /etc/os-release
-        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main"
-        sudo apt-get update  # due to new repository
-        sudo apt-get install --yes --no-install-recommends -V \
-            clang-format-21 \
-            moreutils
-        echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}"
-
-    - name: Run clang-format
-      run: |
-        set -x
-        cd expat/
-        ./apply-clang-format.sh
-        git config color.diff always
-        git diff --exit-code  # i.e. fail CI when there is a diff (and present it)

.github/workflows/clang-static-analyzer.yml

@@ -1,90 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025-2026 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Enforce Clang Static Analyzer (scan-build) clean code
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  clang_static_analyzer:
-    name: Enforce Clang Static Analyzer (scan-build) clean code
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install Clang 21 (including scan-build)
-      run: |-
-        set -x
-        source /etc/os-release
-        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main"
-        sudo apt-get update  # due to new repository
-        sudo apt-get install --yes --no-install-recommends -V \
-            clang-21 \
-            clang-tools-21
-        echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}"
-
-    - name: Build using scan-build
-      run: |
-        set -x
-
-        clang --version | head -n1
-        clang++ --version | head -n1
-
-        available_checkers="$(scan-build --help | grep -o '^ [+ ] [^. ]\+\.[^ ]\+' | sed 's,^.\{3\},,' | sort)"
-        [[ "$(wc -l <<<"${available_checkers}")" -ge 103 ]]  # self-test
-
-        enabled_checkers="$(grep -v \
-            -e '^optin\.performance\.Padding$' \
-            -e '^security\.insecureAPI\.strcpy$' \
-            <<<"${available_checkers}")"
-        [[ "$(wc -l <<<"${enabled_checkers}")" -ge 101 ]]  # self-test
-
-        scan-build \
-            -o html/ \
-            $(sed 's,^,-enable-checker ,' <<<"${enabled_checkers}") \
-            sh -c 'cmake -S expat/ -B build/ && make -C build -j$(nproc) VERBOSE=1'
-
-        rmdir html || false 'The report directory is non-empty, i.e. Clang Static Analyzer found an issue! Please download and inspect the zip file artifact attached to this CI run. Thanks!'
-
-    - name: Store scan-build report
-      if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-      with:
-        name: expat_scan_build_report_${{ github.sha }}
-        path: html/
-        if-no-files-found: ignore

.github/workflows/clang-tidy.yml

@@ -1,65 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2021-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Enforce clang-tidy clean code
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  clang_tidy:
-    name: Enforce clang-tidy clean code
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install clang-tidy 21
-      run: |-
-        set -x
-        source /etc/os-release
-        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main"
-        sudo apt-get update  # due to new repository
-        sudo apt-get install --yes --no-install-recommends -V \
-            clang-tidy-21
-        echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}"
-
-    - name: Run clang-tidy
-      run: |
-        set -x
-        cd expat/
-        ./apply-clang-tidy.sh

.github/workflows/cmake-required-version.yml

@@ -5,9 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021-2025 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
+# Copyright (c) 2021-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -36,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -44,9 +41,9 @@ permissions:
 jobs:
   checks:
     name: Ensure realistic minimum CMake version requirement
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
 
     - name: Install ancient CMake
       run: |
@@ -59,7 +56,7 @@ jobs:
         wget --no-verbose "${download_url}"
 
         chmod +x "${installer_filename}"
-        mkdir -p ~/.local/
+        mkdir ~/.local/
 
         ./"${installer_filename}" --prefix="${HOME}"/.local/ --skip-license
 

.github/workflows/codespell.yml

@@ -1,54 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2021-2024 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Enforce codespell-clean spelling
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  checks:
-    name: Enforce codespell-clean spelling
-    runs-on: ubuntu-22.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-    - uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579  # v2.2
-      with:
-        path: expat/
-        # "arameter" is from "[p]arameter" in xmlwf help output
-        # "otation" is from "[n]otation" in xmlwf help output
-        ignore_words_list: arameter,otation

.github/workflows/coverage.yml

@@ -5,10 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021-2025 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
-# Copyright (c) 2026      Rosen Penev <rosenp@gmail.com>
+# Copyright (c) 2021-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -37,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -49,7 +45,7 @@ jobs:
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
     - name: Install build dependencies
       run: |-
         set -x -u
@@ -61,16 +57,18 @@ jobs:
 
         sudo apt-get install --yes --no-install-recommends -V \
             cmake \
-            docbook-xml \
             docbook2x \
+            dos2unix \
             gcc-multilib \
             g++-multilib \
             lcov \
+            libbsd-dev \
             lzip \
             moreutils \
-            retry
+            ppa-purge
 
         # Install 32bit Wine
+        sudo ppa-purge -y ppa:ubuntu-toolchain-r/test  # to unblock
         sudo apt-get install --yes --no-install-recommends -V \
             mingw-w64 \
             wine-stable \
@@ -85,7 +83,7 @@ jobs:
         exec ./.ci.sh
 
     - name: Store coverage .info and HTML report
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce  # v3.1.2
       with:
         name: coverage
         path: expat/coverage__*/

.github/workflows/coverity-scan.yml

@@ -1,125 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2024-2025 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Upload build to Coverity Scan
-
-on:
-  push:
-    branches:
-      - master
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  coverity_scan_upload:
-    name: Upload build to Coverity Scan
-    # NOTE: The idea is not to bother fork repositories with a job
-    #       that is doomed to fail
-    if: ${{ github.repository == 'libexpat/libexpat' }}
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-      with:
-        # The next two lines ensure clean and public-only submissions
-        repository: libexpat/libexpat
-        ref: master
-        # This will allow to do "git describe --tags" further done
-        fetch-depth: 0
-
-    - name: Determine version string
-      id: determine_version
-      run: |-
-        set -x
-        tee    "${GITHUB_OUTPUT}" <<< "version=$(git describe --tags | sed -e 's,^R_,,' -e 's,_,.,g')"
-        tee -a "${GITHUB_OUTPUT}" <<< "git_commit=$(git rev-parse HEAD)"
-
-    - name: Install Clang 21
-      run: |-
-        set -x
-        source /etc/os-release
-        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main"
-        sudo apt-get update  # due to new repository
-        sudo apt-get install --yes --no-install-recommends -V \
-            clang-21 \
-            libclang-rt-21-dev \
-            llvm-21
-        echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}"
-
-    - name: Install build dependencies
-      run: |-
-        set -x
-        sudo apt-get install --yes --no-install-recommends -V \
-            libprotobuf-dev \
-            protobuf-compiler
-
-    - name: Configure using CMake
-      run: |
-        set -x -o pipefail
-
-        type -P clang clang++
-        clang --version | head -n1
-        clang++ --version | head -n1
-
-        cd expat/
-        args=(
-            -DEXPAT_BUILD_DOCS=OFF
-            -DEXPAT_BUILD_FUZZERS=ON
-
-            # Tune compilation of fuzzers to (1) pass all sanity checks from
-            # CMakeLists.txt (that e.g. require use of fuzzers with sanitizers)
-            # and (2) ideally speed up compilation since no machine or human
-            # will be running the binaries we build for nothing but Coverity:
-            -DCMAKE_C_COMPILER=clang
-            -DCMAKE_CXX_COMPILER=clang++
-            -DCMAKE_{C,CXX}_FLAGS='-O1 -g -fsanitize=address'
-            -DCMAKE_{EXE,MODULE,SHARED}_LINKER_FLAGS='-g -fsanitize=address'
-        )
-        cmake "${args[@]}" -S . -B .
-
-    - uses: vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85  # v1.8.0
-      with:
-        email: ${{ secrets.COVERITY_SCAN_EMAIL }}
-        token: ${{ secrets.COVERITY_SCAN_TOKEN }}
-        command: make VERBOSE=1
-        working-directory: "${{ github.workspace }}/expat"
-        version: "${{ steps.determine_version.outputs.version }}"
-        # NOTE: The commit here is not necessarily the same as ${{ github.sha }} that triggered the action.
-        description: "coverity-scan-action libexpat/libexpat / ${{ steps.determine_version.outputs.git_commit }}"
-
-    - name: Offer analysis tarball for inspection
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-      with:
-        name: expat_coverity_scan_upload_${{ github.sha }}
-        path: expat/cov-int.tgz
-        if-no-files-found: error

.github/workflows/cppcheck.yml

@@ -5,9 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021-2025 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
+# Copyright (c) 2021-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -36,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -44,14 +41,12 @@ permissions:
 jobs:
   checks:
     name: Run Cppcheck
-    runs-on: macos-14
+    runs-on: macos-11
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
     - name: Install runtime dependencies
       run: |
-        set -x
-        brew update
-        exec brew install cppcheck
+        exec brew install cppcheck findutils
     - name: Run Cppcheck
       run: |
         exec .github/workflows/scripts/mass-cppcheck.sh

.github/workflows/data/expat_config_h_cmake__expected.txt

@@ -5,10 +5,10 @@ HAVE_ARC4RANDOM
 HAVE_ARC4RANDOM_BUF
 HAVE_DLFCN_H
 HAVE_FCNTL_H
-HAVE_GETENTROPY
 HAVE_GETPAGESIZE
 HAVE_GETRANDOM
 HAVE_INTTYPES_H
+HAVE_LIBBSD
 HAVE_MEMORY_H
 HAVE_MMAP
 HAVE_STDINT_H
@@ -27,11 +27,11 @@ PACKAGE_STRING
 PACKAGE_TARNAME
 PACKAGE_URL
 PACKAGE_VERSION
+size_t
 STDC_HEADERS
 WORDS_BIGENDIAN
 XML_ATTR_INFO
 XML_CONTEXT_BYTES
 XML_DEV_URANDOM
 XML_DTD
-XML_GE
 XML_NS

.github/workflows/data/expat_config_h_in__expected.txt

@@ -4,16 +4,15 @@ BYTEORDER
 const
 HAVE_ARC4RANDOM
 HAVE_ARC4RANDOM_BUF
-HAVE_CXX11
 HAVE_DLFCN_H
 HAVE_FCNTL_H
-HAVE_GETENTROPY
 HAVE_GETPAGESIZE
 HAVE_GETRANDOM
 HAVE_INTTYPES_H
+HAVE_LIBBSD
+HAVE_MEMORY_H
 HAVE_MMAP
 HAVE_STDINT_H
-HAVE_STDIO_H
 HAVE_STDLIB_H
 HAVE_STRING_H
 HAVE_STRINGS_H
@@ -31,6 +30,7 @@ PACKAGE_STRING
 PACKAGE_TARNAME
 PACKAGE_URL
 PACKAGE_VERSION
+size_t
 STDC_HEADERS
 VERSION
 WORDS_BIGENDIAN
@@ -38,5 +38,4 @@ XML_ATTR_INFO
 XML_CONTEXT_BYTES
 XML_DEV_URANDOM
 XML_DTD
-XML_GE
 XML_NS

.github/workflows/data/exported-symbols-versioned-default.txt

@@ -1,72 +0,0 @@
-XML_DefaultCurrent@@LIBEXPAT_1.0.0
-XML_ErrorString@@LIBEXPAT_1.0.0
-XML_ExpatVersionInfo@@LIBEXPAT_1.95.3
-XML_ExpatVersion@@LIBEXPAT_1.95.0
-XML_ExternalEntityParserCreate@@LIBEXPAT_1.0.0
-XML_FreeContentModel@@LIBEXPAT_1.95.6
-XML_GetBase@@LIBEXPAT_1.0.0
-XML_GetBuffer@@LIBEXPAT_1.0.0
-XML_GetCurrentByteCount@@LIBEXPAT_1.1.0
-XML_GetCurrentByteIndex@@LIBEXPAT_1.0.0
-XML_GetCurrentColumnNumber@@LIBEXPAT_1.0.0
-XML_GetCurrentLineNumber@@LIBEXPAT_1.0.0
-XML_GetErrorCode@@LIBEXPAT_1.0.0
-XML_GetFeatureList@@LIBEXPAT_1.95.5
-XML_GetIdAttributeIndex@@LIBEXPAT_1.95.0
-XML_GetInputContext@@LIBEXPAT_1.95.0
-XML_GetParsingStatus@@LIBEXPAT_1.95.8
-XML_GetSpecifiedAttributeCount@@LIBEXPAT_1.1.0
-XML_MemFree@@LIBEXPAT_1.95.6
-XML_MemMalloc@@LIBEXPAT_1.95.6
-XML_MemRealloc@@LIBEXPAT_1.95.6
-XML_ParseBuffer@@LIBEXPAT_1.0.0
-XML_Parse@@LIBEXPAT_1.0.0
-XML_ParserCreate@@LIBEXPAT_1.0.0
-XML_ParserCreate_MM@@LIBEXPAT_1.95.0
-XML_ParserCreateNS@@LIBEXPAT_1.1.0
-XML_ParserFree@@LIBEXPAT_1.0.0
-XML_ParserReset@@LIBEXPAT_1.95.3
-XML_ResumeParser@@LIBEXPAT_1.95.8
-XML_SetAllocTrackerActivationThreshold@@LIBEXPAT_2.7.2
-XML_SetAllocTrackerMaximumAmplification@@LIBEXPAT_2.7.2
-XML_SetAttlistDeclHandler@@LIBEXPAT_1.95.0
-XML_SetBase@@LIBEXPAT_1.0.0
-XML_SetBillionLaughsAttackProtectionActivationThreshold@@LIBEXPAT_2.4.0
-XML_SetBillionLaughsAttackProtectionMaximumAmplification@@LIBEXPAT_2.4.0
-XML_SetCdataSectionHandler@@LIBEXPAT_1.1.0
-XML_SetCharacterDataHandler@@LIBEXPAT_1.0.0
-XML_SetCommentHandler@@LIBEXPAT_1.1.0
-XML_SetDefaultHandlerExpand@@LIBEXPAT_1.1.0
-XML_SetDefaultHandler@@LIBEXPAT_1.0.0
-XML_SetDoctypeDeclHandler@@LIBEXPAT_1.95.0
-XML_SetElementDeclHandler@@LIBEXPAT_1.95.0
-XML_SetElementHandler@@LIBEXPAT_1.0.0
-XML_SetEncoding@@LIBEXPAT_1.1.0
-XML_SetEndCdataSectionHandler@@LIBEXPAT_1.95.0
-XML_SetEndDoctypeDeclHandler@@LIBEXPAT_1.95.0
-XML_SetEndElementHandler@@LIBEXPAT_1.95.0
-XML_SetEndNamespaceDeclHandler@@LIBEXPAT_1.95.0
-XML_SetEntityDeclHandler@@LIBEXPAT_1.95.0
-XML_SetExternalEntityRefHandlerArg@@LIBEXPAT_1.1.0
-XML_SetExternalEntityRefHandler@@LIBEXPAT_1.0.0
-XML_SetHashSalt16Bytes@@LIBEXPAT_2.8.0
-XML_SetHashSalt@@LIBEXPAT_2.1.0
-XML_SetNamespaceDeclHandler@@LIBEXPAT_1.1.0
-XML_SetNotationDeclHandler@@LIBEXPAT_1.0.0
-XML_SetNotStandaloneHandler@@LIBEXPAT_1.1.0
-XML_SetParamEntityParsing@@LIBEXPAT_1.95.0
-XML_SetProcessingInstructionHandler@@LIBEXPAT_1.0.0
-XML_SetReparseDeferralEnabled@@LIBEXPAT_2.6.0
-XML_SetReturnNSTriplet@@LIBEXPAT_1.95.0
-XML_SetSkippedEntityHandler@@LIBEXPAT_1.95.4
-XML_SetStartCdataSectionHandler@@LIBEXPAT_1.95.0
-XML_SetStartDoctypeDeclHandler@@LIBEXPAT_1.95.0
-XML_SetStartElementHandler@@LIBEXPAT_1.95.0
-XML_SetStartNamespaceDeclHandler@@LIBEXPAT_1.95.0
-XML_SetUnknownEncodingHandler@@LIBEXPAT_1.0.0
-XML_SetUnparsedEntityDeclHandler@@LIBEXPAT_1.0.0
-XML_SetUserData@@LIBEXPAT_1.0.0
-XML_SetXmlDeclHandler@@LIBEXPAT_1.95.0
-XML_StopParser@@LIBEXPAT_1.95.8
-XML_UseForeignDTD@@LIBEXPAT_1.95.5
-XML_UseParserAsHandlerArg@@LIBEXPAT_1.0.0

.github/workflows/data/exported-symbols-versioned-maximum.txt

@@ -1,73 +0,0 @@
-XML_DefaultCurrent@@LIBEXPAT_1.0.0
-XML_ErrorString@@LIBEXPAT_1.0.0
-XML_ExpatVersionInfo@@LIBEXPAT_1.95.3
-XML_ExpatVersion@@LIBEXPAT_1.95.0
-XML_ExternalEntityParserCreate@@LIBEXPAT_1.0.0
-XML_FreeContentModel@@LIBEXPAT_1.95.6
-XML_GetAttributeInfo@@LIBEXPAT_2.1.0
-XML_GetBase@@LIBEXPAT_1.0.0
-XML_GetBuffer@@LIBEXPAT_1.0.0
-XML_GetCurrentByteCount@@LIBEXPAT_1.1.0
-XML_GetCurrentByteIndex@@LIBEXPAT_1.0.0
-XML_GetCurrentColumnNumber@@LIBEXPAT_1.0.0
-XML_GetCurrentLineNumber@@LIBEXPAT_1.0.0
-XML_GetErrorCode@@LIBEXPAT_1.0.0
-XML_GetFeatureList@@LIBEXPAT_1.95.5
-XML_GetIdAttributeIndex@@LIBEXPAT_1.95.0
-XML_GetInputContext@@LIBEXPAT_1.95.0
-XML_GetParsingStatus@@LIBEXPAT_1.95.8
-XML_GetSpecifiedAttributeCount@@LIBEXPAT_1.1.0
-XML_MemFree@@LIBEXPAT_1.95.6
-XML_MemMalloc@@LIBEXPAT_1.95.6
-XML_MemRealloc@@LIBEXPAT_1.95.6
-XML_ParseBuffer@@LIBEXPAT_1.0.0
-XML_Parse@@LIBEXPAT_1.0.0
-XML_ParserCreate@@LIBEXPAT_1.0.0
-XML_ParserCreate_MM@@LIBEXPAT_1.95.0
-XML_ParserCreateNS@@LIBEXPAT_1.1.0
-XML_ParserFree@@LIBEXPAT_1.0.0
-XML_ParserReset@@LIBEXPAT_1.95.3
-XML_ResumeParser@@LIBEXPAT_1.95.8
-XML_SetAllocTrackerActivationThreshold@@LIBEXPAT_2.7.2
-XML_SetAllocTrackerMaximumAmplification@@LIBEXPAT_2.7.2
-XML_SetAttlistDeclHandler@@LIBEXPAT_1.95.0
-XML_SetBase@@LIBEXPAT_1.0.0
-XML_SetBillionLaughsAttackProtectionActivationThreshold@@LIBEXPAT_2.4.0
-XML_SetBillionLaughsAttackProtectionMaximumAmplification@@LIBEXPAT_2.4.0
-XML_SetCdataSectionHandler@@LIBEXPAT_1.1.0
-XML_SetCharacterDataHandler@@LIBEXPAT_1.0.0
-XML_SetCommentHandler@@LIBEXPAT_1.1.0
-XML_SetDefaultHandlerExpand@@LIBEXPAT_1.1.0
-XML_SetDefaultHandler@@LIBEXPAT_1.0.0
-XML_SetDoctypeDeclHandler@@LIBEXPAT_1.95.0
-XML_SetElementDeclHandler@@LIBEXPAT_1.95.0
-XML_SetElementHandler@@LIBEXPAT_1.0.0
-XML_SetEncoding@@LIBEXPAT_1.1.0
-XML_SetEndCdataSectionHandler@@LIBEXPAT_1.95.0
-XML_SetEndDoctypeDeclHandler@@LIBEXPAT_1.95.0
-XML_SetEndElementHandler@@LIBEXPAT_1.95.0
-XML_SetEndNamespaceDeclHandler@@LIBEXPAT_1.95.0
-XML_SetEntityDeclHandler@@LIBEXPAT_1.95.0
-XML_SetExternalEntityRefHandlerArg@@LIBEXPAT_1.1.0
-XML_SetExternalEntityRefHandler@@LIBEXPAT_1.0.0
-XML_SetHashSalt16Bytes@@LIBEXPAT_2.8.0
-XML_SetHashSalt@@LIBEXPAT_2.1.0
-XML_SetNamespaceDeclHandler@@LIBEXPAT_1.1.0
-XML_SetNotationDeclHandler@@LIBEXPAT_1.0.0
-XML_SetNotStandaloneHandler@@LIBEXPAT_1.1.0
-XML_SetParamEntityParsing@@LIBEXPAT_1.95.0
-XML_SetProcessingInstructionHandler@@LIBEXPAT_1.0.0
-XML_SetReparseDeferralEnabled@@LIBEXPAT_2.6.0
-XML_SetReturnNSTriplet@@LIBEXPAT_1.95.0
-XML_SetSkippedEntityHandler@@LIBEXPAT_1.95.4
-XML_SetStartCdataSectionHandler@@LIBEXPAT_1.95.0
-XML_SetStartDoctypeDeclHandler@@LIBEXPAT_1.95.0
-XML_SetStartElementHandler@@LIBEXPAT_1.95.0
-XML_SetStartNamespaceDeclHandler@@LIBEXPAT_1.95.0
-XML_SetUnknownEncodingHandler@@LIBEXPAT_1.0.0
-XML_SetUnparsedEntityDeclHandler@@LIBEXPAT_1.0.0
-XML_SetUserData@@LIBEXPAT_1.0.0
-XML_SetXmlDeclHandler@@LIBEXPAT_1.95.0
-XML_StopParser@@LIBEXPAT_1.95.8
-XML_UseForeignDTD@@LIBEXPAT_1.95.5
-XML_UseParserAsHandlerArg@@LIBEXPAT_1.0.0

.github/workflows/data/exported-symbols.txt

@@ -27,8 +27,6 @@ XML_ParserCreateNS
 XML_ParserFree
 XML_ParserReset
 XML_ResumeParser
-XML_SetAllocTrackerActivationThreshold
-XML_SetAllocTrackerMaximumAmplification
 XML_SetAttlistDeclHandler
 XML_SetBase
 XML_SetBillionLaughsAttackProtectionActivationThreshold
@@ -50,13 +48,11 @@ XML_SetEntityDeclHandler
 XML_SetExternalEntityRefHandler
 XML_SetExternalEntityRefHandlerArg
 XML_SetHashSalt
-XML_SetHashSalt16Bytes
 XML_SetNamespaceDeclHandler
 XML_SetNotationDeclHandler
 XML_SetNotStandaloneHandler
 XML_SetParamEntityParsing
 XML_SetProcessingInstructionHandler
-XML_SetReparseDeferralEnabled
 XML_SetReturnNSTriplet
 XML_SetSkippedEntityHandler
 XML_SetStartCdataSectionHandler

.github/workflows/emscripten.yml

@@ -1,69 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025-2026 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Build with Emscripten
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  emscripten:
-    name: Build with Emscripten
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install build dependencies
-      run: |-
-        set -x
-        sudo apt-get update
-        sudo apt-get install --yes --no-install-recommends -V \
-            cmake \
-            emscripten \
-            make
-
-    - name: Build using Emscripten
-      run: |
-        cmake_args=(
-          -DCMAKE_C_FLAGS='-O1 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings'
-          -DCMAKE_CXX_FLAGS='-O2 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings'
-          -DEXPAT_BUILD_DOCS=OFF
-          -DEXPAT_SHARED_LIBS=OFF  # to silence warning; not supported by Emscripten
-          -DEXPAT_WARNINGS_AS_ERRORS=ON
-        )
-        set -x
-        emcmake cmake "${cmake_args[@]}" -S expat/ -B build/
-        emmake make -C build -j$(nproc) VERBOSE=1 all

.github/workflows/expat_config_h.yml

@@ -5,8 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2020-2025 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
+# Copyright (c) 2020-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -35,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -43,9 +41,9 @@ permissions:
 jobs:
   checks:
     name: Check expat_config.h.{in,cmake} for regressions
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
     - name: Check expat_config.h.{in,cmake} for regressions
       run: |
         set -v

.github/workflows/freebsd.yml

@@ -1,99 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2025      Daniel Engberg <daniel.engberg.lists@pyret.net>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Build in a FreeBSD VM
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  freebsd:
-    name: Build in a FreeBSD VM
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - uses: vmactions/freebsd-vm@77ed28d336d03fe19a3f4f7266c1d2c4714dd79d  # v1.5.2
-      with:
-        release: "15.0"
-        usesh: true
-
-        prepare: |
-          set -e -u -x
-          pkg install -y \
-              autoconf \
-              automake \
-              bash \
-              cmake-core \
-              libtool \
-              python3 \
-              wget
-
-        run: |
-          set -e -u -x
-
-          compile_flags='-Wall -Wextra -pedantic -O1 -pipe'
-          export CFLAGS="-std=c99 ${compile_flags}"
-          export CXXFLAGS="-std=c++11 ${compile_flags}"
-
-          cc -v
-          c++ -v
-
-          cd expat
-          ./buildconf.sh
-
-          # 1 of 2: GNU Autotools build system
-          mkdir build_autotools
-          cd build_autotools
-            ../configure
-            make -j2 CFLAGS="${CFLAGS} -Werror"
-            make check CFLAGS="${CFLAGS} -Werror" CXXFLAGS="${CXXFLAGS} -Werror"
-            make run-xmltest
-            make install DESTDIR="${PWD}/ROOT/"
-            find ROOT/
-          cd ..
-
-          # 2 of 2: CMake build system
-          mkdir build_cmake
-          cd build_cmake
-            cmake -S .. -B . -DEXPAT_WARNINGS_AS_ERRORS:BOOL=ON
-            make -j2 VERBOSE=1
-            make test VERBOSE=1
-            make run-xmltest VERBOSE=1
-            make install DESTDIR="${PWD}/ROOT/"
-            find ROOT/
-          cd ..

.github/workflows/fuzzing.yml

@@ -1,185 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2024-2026 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Run fuzzing regression tests
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  run_fuzzers:
-    name: Run fuzzing regression tests
-    strategy:
-      fail-fast: false
-      matrix:
-        fuzzer:
-          - xml_lpm_fuzzer
-          - xml_parse_fuzzer_UTF-8
-          - xml_parsebuffer_fuzzer_UTF-16LE
-    runs-on: ubuntu-24.04
-    env:
-      fuzzer: ${{ matrix.fuzzer }}
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install Clang 21
-      run: |-
-        set -x
-        source /etc/os-release
-        wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main"
-        sudo apt-get update  # due to new repository
-        sudo apt-get install --yes --no-install-recommends -V \
-            clang-21 \
-            libclang-rt-21-dev \
-            llvm-21
-        echo /usr/lib/llvm-21/bin >>"${GITHUB_PATH}"
-
-    - name: Install build dependencies
-      run: |-
-        set -x
-        sudo apt-get install --yes --no-install-recommends -V \
-            autoconf \
-            automake \
-            docbook2x \
-            libtool \
-            libprotobuf-dev \
-            lzip \
-            parallel \
-            protobuf-compiler
-
-    - name: Turn Git clone into Autotools "make dist" release tarball
-      run: |-
-        set -x
-        pushd expat/
-          ./buildconf.sh
-          ./configure
-          make dist
-        popd
-        tar xf expat/expat-*.tar.xz
-        rm -R expat/
-        mv expat-* expat
-
-    - name: Build Expat fuzzers
-      run: |
-        set -x -o pipefail
-
-        type -P clang clang++
-        clang --version | head -n1
-        clang++ --version | head -n1
-
-        cd expat/
-        args=(
-            # Build nothing but fuzzers
-            -DEXPAT_BUILD_DOCS=OFF
-            -DEXPAT_BUILD_EXAMPLES=OFF
-            -DEXPAT_BUILD_FUZZERS=ON
-            -DEXPAT_BUILD_PKGCONFIG=OFF
-            -DEXPAT_BUILD_TESTS=OFF
-            -DEXPAT_BUILD_TOOLS=OFF
-
-            # Tune compilation of fuzzers to use Clang with ASan and UBSan
-            -DCMAKE_C_COMPILER=clang
-            -DCMAKE_CXX_COMPILER=clang++
-            -DCMAKE_{C,CXX}_FLAGS='-Wall -Wextra -pedantic -O1 -g -fsanitize=address,undefined -fno-sanitize-recover=all -fno-omit-frame-pointer -fno-common -fprofile-instr-generate -fcoverage-mapping'
-            -DCMAKE_{EXE,MODULE,SHARED}_LINKER_FLAGS='-g -fsanitize=address,undefined'
-            -DEXPAT_WARNINGS_AS_ERRORS=ON
-        )
-        cmake "${args[@]}" -S . -B build
-        make -C build VERBOSE=1 -j$(nproc)
-
-        ./build/fuzz/xml_lpm_fuzzer -help=1
-
-    - name: Download and extract Expat fuzzing corpora
-      run: |-
-        set -x
-        cd expat/build/
-        wget -q -O corpus.zip "https://storage.googleapis.com/expat-backup.clusterfuzz-external.appspot.com/corpus/libFuzzer/expat_${fuzzer}/public.zip"
-        unzip -q -d c/ corpus.zip
-
-    - name: Run fuzzing regression tests (1 to 5 minutes)
-      run: |
-        fuzz_args=(
-            -print_final_stats=1
-            -rss_limit_mb=2560  # from OSS-Fuzz
-            -timeout=25         # from OSS-Fuzz
-        )
-
-        set -x -o pipefail
-        cd expat/build/
-
-        # Configure UBSan to show (non-default) stack traces for runtime errors
-        # NOTE: "halt_on_error=1" we don't need to add because of the
-        #       -fno-sanitize-recover=all for CFLAGS further up.
-        # NOTE: "abort_on_error=1" we don't need here because to CI,
-        #       a non-zero exit code is all that matters.
-        export UBSAN_OPTIONS='print_stacktrace=1'
-
-        mkdir coverage/
-        export LLVM_PROFILE_FILE=coverage/expat-%p.profraw
-
-        find c/ -type f | sort \
-            | parallel --max-args 1000 \
-                "fuzz/${fuzzer}" "${fuzz_args[@]}" \
-            |& tee fuzz-all.log
-
-    - name: Store fuzzing logs
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-      if: ${{ always() }}
-      with:
-        name: ${{ matrix.fuzzer }}_${{ github.sha }}_logs
-        path: expat/build/fuzz-*.log
-        if-no-files-found: error
-
-    - name: Render coverage report
-      run: |
-        set -x -o pipefail
-        cd expat/build/
-
-        # Merged and convert to a single indexed profile data file
-        llvm-profdata merge -sparse -o coverage/expat.profdata coverage/expat-*.profraw
-
-        # Render report
-        llvm-cov show fuzz/${fuzzer} -instr-profile=coverage/expat.profdata -show-branches=count -format=html -output-dir=coverage/html/
-        llvm-cov report fuzz/${fuzzer} -instr-profile=coverage/expat.profdata -show-functions -sources ../lib/ | tee coverage/report_functions.txt
-        llvm-cov report fuzz/${fuzzer} -instr-profile=coverage/expat.profdata                 -sources ../lib/ | tee coverage/report_files.txt
-
-    - name: Store coverage report
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-      with:
-        name: ${{ matrix.fuzzer }}_${{ github.sha }}_coverage
-        path: expat/build/coverage/
-        if-no-files-found: error

.github/workflows/linux.yml

@@ -5,12 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Copyright (c) 2023      Hanno Böck <hanno@gentoo.org>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
-# Copyright (c) 2026      Rosen Penev <rosenp@gmail.com>
-# Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
+# Copyright (c) 2021-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -39,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -48,29 +42,29 @@ jobs:
   checks:
     name: Perform checks
     strategy:
-      fail-fast: false
       matrix:
         include:
+          # NOTE: This is a quick port from .travis.yml in reaction to
+          #       stability issues at Travis CI.
           - MODE: cmake-oos
           - MODE: distcheck
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address
+          - MODE: clang-format
+          - MODE: cmake-oos
+            FLAT_ENV: CMAKE_ARGS="-DEXPAT_ATTR_INFO=ON -DEXPAT_BUILD_FUZZERS=ON -DCMAKE_C_FLAGS=-fsanitize=address -DCMAKE_CXX_FLAGS=-fsanitize=address -DCMAKE_EXE_LINKER_FLAGS=-fsanitize=address -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++"
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS=-DEXPAT_ATTR_INFO=ON
           - MODE: qa-sh
-            FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS=-DEXPAT_CONTEXT_BYTES=0
+            FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS=-DEXPAT_CONTEXT_BYTES=OFF
           - MODE: qa-sh
-            FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS="-DEXPAT_DTD=OFF -DEXPAT_GE=ON"
-          - MODE: qa-sh
-            FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS="-DEXPAT_DTD=OFF -DEXPAT_GE=OFF"
+            FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS=-DEXPAT_DTD=OFF
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS=-DEXPAT_LARGE_SIZE=ON
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS=-DEXPAT_MIN_SIZE=ON
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address CMAKE_ARGS=-DEXPAT_NS=OFF
-          - MODE: qa-sh
-            FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=cfi
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=memory
           - MODE: qa-sh
@@ -85,22 +79,34 @@ jobs:
             FLAT_ENV: CC=i686-w64-mingw32-gcc CXX=i686-w64-mingw32-g++ LD=i686-w64-mingw32-ld QA_PROCESSOR=gcov CMAKE_ARGS="-DCMAKE_SYSTEM_NAME=Windows -DWIN32=ON -DMINGW=ON -DEXPAT_ATTR_INFO=ON"
           - MODE: qa-sh
             FLAT_ENV: CC=i686-w64-mingw32-gcc CXX=i686-w64-mingw32-g++ LD=i686-w64-mingw32-ld QA_PROCESSOR=gcov CMAKE_ARGS="-DCMAKE_SYSTEM_NAME=Windows -DWIN32=ON -DMINGW=ON -DEXPAT_ATTR_INFO=ON -DEXPAT_CHAR_TYPE=wchar_t"
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-20.04
     env:
       CFLAGS: -g3 -pipe
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
     - name: Install build dependencies (MinGW)
       if: "${{ contains(matrix.FLAT_ENV, 'mingw') }}"
       run: |-
-        set -x
+        set -x -u -o pipefail
+        source /etc/os-release
+
+        # Get rid of packages installed from ppa:ondrej/php so that we will be able to install wine32:i386 without conflicts
+        # (see issue https://github.com/actions/virtual-environments/issues/4589)
+        # In detail we:
+        #   1. Remove all packages that ppa:ondrej/php has but plain Ubuntu doesn't, e.g. everything PHP
+        #   2. Revert (remaining) packages that ppa:ondrej/php and plain Ubuntu share, back to the plain Ubuntu version
+        #   3. Assert that no packages from ppa:ondrej/php are left installed
+        dpkg -l | grep '^ii' | grep -F deb.sury.org | awk '{print $2}' | grep '^php' \
+          | xargs -r -t sudo apt-get remove --yes libpcre2-posix3 libzip4
+        dpkg -l | grep '^ii' | grep -F deb.sury.org | awk '{print $2}' | sed "s,\$,/${UBUNTU_CODENAME}," \
+          | xargs -r -t sudo apt-get install --yes --no-install-recommends --allow-downgrades -V
+        ! dpkg -l | grep '^ii' | grep -F deb.sury.org
 
         # Install 32bit Wine
         sudo dpkg --add-architecture i386  # for wine32
         sudo apt-get update  # due to new architecture
         sudo apt-get install --yes --no-install-recommends -V \
             mingw-w64 \
-            retry \
             wine-stable \
             wine32:i386
     - name: Install build dependencies (Non-MinGW)
@@ -109,21 +115,23 @@ jobs:
         set -x
         source /etc/os-release
         wget -O - https://apt.llvm.org/llvm-snapshot.gpg.key | sudo apt-key add -
-        sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-21 main"
+        sudo add-apt-repository "deb https://apt.llvm.org/${UBUNTU_CODENAME}/ llvm-toolchain-${UBUNTU_CODENAME}-15 main"
         sudo apt-get update  # due to new repository
-        # NOTE: Please note the version-specific ${PATH} extension for Clang adding /usr/lib/llvm-21/bin in .ci.sh
+        # NOTE: Please note the version-specific ${PATH} extension for Clang in .ci.sh
         sudo apt-get install --yes --no-install-recommends -V \
-            clang-21 \
-            libclang-rt-21-dev \
-            llvm-21
+            clang-15 \
+            clang-format-15 \
+            libclang-rt-15-dev
     - name: Install build dependencies (common)
       run: |-
         sudo apt-get install --yes --no-install-recommends -V \
             cmake \
             docbook2x \
+            dos2unix \
             gcc-multilib \
             g++-multilib \
             lcov \
+            libbsd-dev \
             lzip \
             moreutils
     - name: Perform check "${{ matrix.MODE }}"

.github/workflows/macos.yml

@@ -5,9 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2020-2025 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
+# Copyright (c) 2020-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -36,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -46,15 +43,17 @@ jobs:
     name: Perform checks
     strategy:
       matrix:
-        os: [macos-14, macos-15]
         include:
+          # NOTE: This is a quick port from .travis.yml in reaction to
+          #       Homebrew issues at Travis CI.  While we have the matrix
+          #       in two places, please keep the two files in sync.  Thank you!
           - MODE: cmake-oos
           - MODE: distcheck
           - MODE: qa-sh
             FLAT_ENV: CC=clang CXX=clang++ LD=clang++ QA_SANITIZER=address
-    runs-on: ${{ matrix.os }}
+    runs-on: macos-11
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
     - name: Install build dependencies
       run: |
         sudo rm /usr/local/bin/2to3  # so that "brew link" will work

.github/workflows/musl.yml

@@ -1,69 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Build with musl
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  musl:
-    name: Build with musl
-    runs-on: ubuntu-22.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install build dependencies
-      run: |-
-        set -x
-        sudo apt-get update
-        sudo apt-get install --yes --no-install-recommends -V \
-            cmake \
-            musl-tools
-
-    - name: Build using musl-tools
-      run: |
-        cmake_args=(
-          -DCMAKE_C_COMPILER=musl-gcc
-          -DCMAKE_CXX_COMPILER=g++  # musl-tools does not support C++
-          -DCMAKE_C_FLAGS='-O1 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings'
-          -DCMAKE_CXX_FLAGS='-O0 -pipe'
-          -DEXPAT_BUILD_DOCS=OFF
-          -DEXPAT_WARNINGS_AS_ERRORS=ON
-        )
-        set -x
-        cmake "${cmake_args[@]}" -S expat/ -B build/
-        make -C build -j$(nproc) VERBOSE=1 all

.github/workflows/perl-integration.yml

@@ -1,97 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025-2026 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Run Perl XML::Parser integration tests
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  perl_integration:
-    name: Run Perl XML::Parser integration tests
-    strategy:
-      fail-fast: false
-      matrix:
-        xml_parser_commit:
-          - "7096c4e45a62a23837382cf822d8c2dab780a3a1"  # ==2.47 without AI
-          - "16fff0b90acbfb788f4c16ddc7c594ece91b5089"  # ==2.59    with AI
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install system dependencies
-      if: "${{ matrix.xml_parser_commit != '7096c4e45a62a23837382cf822d8c2dab780a3a1' }}"
-      run: |
-        set -x
-        sudo apt-get update
-        sudo apt-get install --yes --no-install-recommends -V \
-            libfile-sharedir-install-perl \
-            libfile-sharedir-perl
-
-    - name: Build and replace system Expat
-      run: |
-        set -x
-
-        cd expat/
-        args=(
-            # Replace system Expat
-            -DCMAKE_INSTALL_PREFIX=/usr
-
-            # Build nothing but core library
-            -DEXPAT_BUILD_DOCS=OFF
-            -DEXPAT_BUILD_EXAMPLES=OFF
-            -DEXPAT_BUILD_TESTS=OFF
-            -DEXPAT_BUILD_TOOLS=OFF
-        )
-        cmake "${args[@]}" -S . -B build
-        make -C build VERBOSE=1 -j$(nproc)
-        sudo make -C build VERBOSE=1 install
-
-    - name: Run Perl XML::Parser integration tests
-      env:
-        xml_parser_commit: "${{ matrix.xml_parser_commit }}"
-      run: |
-        set -x
-
-        # NOTE: The version pin is for CI stability.
-        git -c init.defaultbranch=main init XML-Parser/
-        cd XML-Parser/
-        git fetch --depth 1 https://github.com/cpan-authors/XML-Parser "${xml_parser_commit}"
-        git -c advice.detachedHead=false checkout FETCH_HEAD
-
-        perl Makefile.PL
-        make -j$(nproc)
-        make test

.github/workflows/scripts/list_exported_macros.sh

@@ -6,7 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2020-2023 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2020-2021 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -28,4 +28,4 @@
 # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 # USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-grep -Eo '(define|undef) [a-zA-Z0-9_]+' "${1}" | awk '{print $2}' | grep -vw if | sort -u
+grep -Eo '(define|undef) [a-zA-Z0-9_]+' "${1}" | awk '{print $2}' | sort -u

.github/workflows/scripts/mass-cppcheck.sh

@@ -6,8 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
+# Copyright (c) 2021 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -32,36 +31,32 @@
 PS4='# '
 set -e -u -o pipefail -x
 
+if [[ "$(uname -s)" =~ ^Darwin ]]; then
+    export PATH="/usr/local/opt/findutils/libexec/gnubin${PATH:+:}${PATH}"
+fi
+
 cppcheck --version
 
-for xml_context_bytes in 0 1024; do
-    for xml_ge in 0 1; do
-        cppcheck_args=(
-            --quiet
-            --error-exitcode=1
-            --force
-            --check-level=exhaustive
-            --inline-suppr
-            '-D__has_attribute(x)=1'
-            '-D__has_feature(x)=1'
-            '-DEXPAT_FMT_SIZE_T(x)=%llu'
-            '-DEXPAT_FMT_ULL(x)=%llu'
-            -DXML_CONTEXT_BYTES=${xml_context_bytes}
-            -DXML_GE=${xml_ge}
-        )
+find --version | head -n1
 
-        find_args=(
-            -type f \(
-                -name \*.cpp
-                -o -name \*.c
-            \)
-            -not \(  # Exclude .c files that are merely included by other files
-                -name xmltok_ns.c
-                -o -name xmltok_impl.c
-            \)
-            -exec cppcheck "${cppcheck_args[@]}" {} +
-        )
+cppcheck_args=(
+    --quiet
+    --error-exitcode=1
+    --force
+    --suppress=objectIndex
+    --suppress=unknownMacro
+)
 
-        time find . "${find_args[@]}"
-    done
-done
+find_args=(
+    -type f \(
+        -name \*.cpp
+        -o -name \*.c
+    \)
+    -not \(  # Exclude .c files that are merely included by other files
+        -name xmltok_ns.c
+        -o -name xmltok_impl.c
+    \)
+    -exec cppcheck "${cppcheck_args[@]}" {} +
+)
+
+exec find "${find_args[@]}"

.github/workflows/solaris.yml

@@ -1,104 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Build in a Solaris VM
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  solaris:
-    name: Build in a Solaris VM
-    runs-on: ubuntu-24.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312  # v1.3.8
-      with:
-        release: "11.4-gcc"  # with GCC 14 as of 2026-01-11
-        usesh: true
-
-        prepare: |
-          set -e -u -x
-
-          # NOTE: Exit code 0 means "all now installed and all not before".
-          #       Exit code 3 means "all now installed and some not before".
-          #       Exit code 4 means "all now installed and all already before".
-          #       Command "pkg list -a" can show a list of packages available.
-          pkg install \
-            autoconf \
-            automake \
-            bash \
-            cmake \
-            gnu-make \
-            gnu-sed \
-            libtool \
-            || [ $? -eq 3 -o $? -eq 4 ]  # see comment block above
-
-        run: |
-          set -e -u -x
-
-          compile_flags='-Wall -Wextra -pedantic -O1 -pipe'
-          export CFLAGS="-std=c99 ${compile_flags}"
-          export CXXFLAGS="-std=c++11 ${compile_flags}"
-
-          gcc -v
-          g++ -v
-
-          cd expat
-          ./buildconf.sh
-
-          # 1 of 2: GNU Autotools build system
-          mkdir build_autotools
-          cd build_autotools
-            ../configure
-            gmake -j2 CFLAGS="${CFLAGS} -Werror"
-            gmake check CFLAGS="${CFLAGS} -Werror" CXXFLAGS="${CXXFLAGS} -Werror"
-            gmake run-xmltest
-            gmake install DESTDIR="${PWD}/ROOT/"
-            find ROOT/
-          cd ..
-
-          # 2 of 2: CMake build system
-          mkdir build_cmake
-          cd build_cmake
-            cmake -S .. -B . -DEXPAT_WARNINGS_AS_ERRORS:BOOL=ON
-            gmake -j2 VERBOSE=1
-            gmake test VERBOSE=1
-            gmake run-xmltest VERBOSE=1
-            gmake install DESTDIR="${PWD}/ROOT/"
-            find ROOT/
-          cd ..

.github/workflows/valid-xml.yml

@@ -5,8 +5,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2021-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2023      Joyce Brum <joycebrum@google.com>
+# Copyright (c) 2021-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -35,7 +34,6 @@ on:
   push:
   schedule:
     - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
 
 permissions:
   contents: read
@@ -43,57 +41,21 @@ permissions:
 jobs:
   checks:
     name: Ensure well-formed and valid XML
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-20.04
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9  # v3.5.3
 
     - name: Install build dependencies
-      env:
-        tidy_version: 5.8.0
       run: |-
         set -x
         sudo apt-get update
         sudo apt-get install --yes --no-install-recommends -V \
             docbook \
             libxml2-utils \
-            moreutils \
             w3c-sgml-lib
 
-        # NOTE: Ubuntu 24.04 has tidy 5.6.0 while we need more recent tidy 5.8.0
-        wget --progress=dot:giga "https://github.com/htacg/tidy-html5/releases/download/${tidy_version}/tidy-${tidy_version}-Linux-64bit.deb"
-        sudo apt-get install --yes "./tidy-${tidy_version}-Linux-64bit.deb"
-
-    - name: Enforce clean XML
-      run: |
-        tidy_args=(
-            --indent 1
-            --tidy-mark no
-            --vertical-space yes
-            --wrap 90
-            --write-back yes
-        )
-        set -x -o pipefail
-
-        # Re-indent XHTML
-        tidy "${tidy_args[@]}" expat/doc/reference.html
-
-        # Drop trailing whitespace
-        sed 's, \+$,,' -i.bak expat/doc/reference.html
-
-        # Replace leading tabs by spaces
-        expand -i -t 2 expat/doc/xmlwf.xml | sponge expat/doc/xmlwf.xml
-
-        git -c color.ui=yes diff --exit-code  # i.e. show diff and fail CI if there is a diff
-
     - name: Ensure well-formed and valid XML
       run: |
         set -x
-
-        # Target offline validation rather than online (for robust CI)
-        sed 's,http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd,file:///usr/share/sgml/docbook/dtd/4.2/docbookx.dtd,' -i expat/doc/xmlwf.xml
-        sed 's,http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd,file:///usr/share/xml/w3c-sgml-lib/schema/dtd/REC-xhtml1-20020801/xhtml1-strict.dtd,' -i expat/doc/reference.html
-
-        # We're using unshare(1) to take internet access away forcefully
-        # so that we'll notice whenever our all-offline validation stops being all-offline
-        unshare --map-root-user --net -- xmllint --nonet --noout --valid expat/doc/reference.html
-        unshare --map-root-user --net -- xmllint --nonet --noout --valid expat/doc/xmlwf.xml
+        xmllint --noout --valid expat/doc/reference.html
+        xmllint --noout --valid expat/doc/xmlwf.xml

.github/workflows/wasi_sdk.yml

@@ -1,72 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2025      Atrem Borovik <polzovatellllk@gmail.com>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Build with WASI SDK
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  wasi_sdk:
-    name: Build with WASI SDK
-    runs-on: ubuntu-22.04
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - name: Install build dependencies
-      env:
-        wasi_sdk_major: "33"
-        wasi_sdk_minor: "0"
-      run: |-
-        set -x -u
-        wget "https://github.com/WebAssembly/wasi-sdk/releases/download/wasi-sdk-${wasi_sdk_major}/wasi-sdk-${wasi_sdk_major}.${wasi_sdk_minor}-x86_64-linux.deb"
-        sudo apt-get install --yes "./wasi-sdk-${wasi_sdk_major}.${wasi_sdk_minor}-x86_64-linux.deb"
-
-    - name: Build using WASI SDK
-      run: |
-        cmake_args=(
-          -DCMAKE_TOOLCHAIN_FILE=/opt/wasi-sdk/share/cmake/wasi-sdk-p1.cmake
-          -DCMAKE_C_FLAGS='-O1 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings'
-          -DCMAKE_CXX_FLAGS='-O2 -pipe -Wall -Wextra -pedantic -Wno-overlength-strings'
-          -DEXPAT_BUILD_DOCS=OFF
-          -DEXPAT_BUILD_TESTS=OFF
-          -DEXPAT_SHARED_LIBS=OFF
-          -DEXPAT_WARNINGS_AS_ERRORS=ON
-        )
-        set -x
-        cmake "${cmake_args[@]}" -S expat/ -B build/
-        make -C build -j$(nproc) VERBOSE=1 all

.github/workflows/windows-binaries.yml

@@ -1,211 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025-2026 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Build Windows binaries
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  windows_binaries:
-    name: Build ${{ matrix.expat_platform }} binaries
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runs-on: windows-2022
-            cmake_build_type: Debug
-            cmake_generator: Visual Studio 17 2022
-            cmake_platform: Win32
-            expat_char_type: char
-            expat_dll: libexpatd.dll
-            expat_platform: win32
-          - runs-on: windows-2022
-            cmake_build_type: Debug
-            cmake_generator: Visual Studio 17 2022
-            cmake_platform: x64
-            expat_char_type: wchar_t
-            expat_dll: libexpatwd.dll
-            expat_platform: win64
-    defaults:
-      run:
-        shell: bash
-    runs-on: "${{ matrix.runs-on }}"
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57  # v3.0.0
-
-    - name: Install Inno Setup
-      shell: pwsh
-      run: |-
-        Invoke-WebRequest -Uri https://github.com/jrsoftware/issrc/releases/download/is-6_1_2/innosetup-6.1.2.exe -OutFile D:\\is.exe
-        Start-Process -FilePath D:\\is.exe -ArgumentList "/VERYSILENT", "/SUPPRESSMSGBOXES", "/NORESTART" -Wait
-
-    - name: 'Add Inno Setup compiler to ${PATH}'
-      run: |-
-        echo 'C:\Program Files (x86)\Inno Setup 6' >> "${GITHUB_PATH}"
-
-    - name: Install Innoextract
-      env:
-        version: 1.9
-      run: |-
-        set -x
-        mkdir innoextract
-        cd innoextract
-        export PATH="${PATH}:/c/msys64/usr/bin"  # for wget
-        wget -q https://github.com/dscharrer/innoextract/releases/download/${version}/innoextract-${version}-windows.zip
-        unzip innoextract-${version}-windows.zip
-        echo "${GITHUB_WORKSPACE}\innoextract" >> "${GITHUB_PATH}"
-
-    - name: Prepare win64 installer
-      if: "${{ matrix.expat_platform == 'win64' }}"
-      run: |-
-        bat_sed_args=(
-          -e 's,-A Win32,-A x64,g'
-          -e 's,win32,win64,g'
-        )
-        inno_sed_args=(
-          -e 's,^OutputDir=win32,OutputDir=win64,'
-          -e 's,win32bin,win64bin,'
-          -e 's,win32\\bin,win64\\bin,g'
-        )
-        set -x
-        cd expat
-        mkdir win64
-
-        sed "${bat_sed_args[@]}" win32/build_expat_iss.bat > win64/build_expat_iss.bat
-        ! grep -i win32 win64/build_expat_iss.bat  # i.e. assert success
-
-        sed "${inno_sed_args[@]}" win32/expat.iss > win64/expat.iss
-        ! grep 'win32\\bin' win64/expat.iss  # i.e. assert success
-        grep win32 win64/expat.iss  # purely informational
-
-    - name: Build installer (and the Expat binaries that go into it)
-      env:
-        expat_platform: ${{ matrix.expat_platform }}
-      run: |-
-        set -x
-        cd expat
-
-        cmd < "${expat_platform}"/build_expat_iss.bat
-
-        ls -lh "${expat_platform}"/*.exe
-        cp -v "${expat_platform}"/expat-*bin-*.*.*.exe /d/expat-installer.exe
-
-    - name: Create .zip file from installer content
-      env:
-        expat_platform: ${{ matrix.expat_platform }}
-      run: |-
-        export PATH="${PATH}:/c/Program Files/7-Zip"
-        set -x
-
-        cd "expat/${expat_platform}"
-        zip_name="$(echo expat-*bin-*.exe | sed 's,\.exe$,.zip,')"
-
-        # Workaround issues with innoextract 1.9 as documented at
-        # https://github.com/dscharrer/innoextract/issues/178#issue-2505033557
-        innoextract -l expat-*bin-*.exe \
-            | awk -F'"' '{print $2}' \
-            | xargs dirname \
-            | sort -u \
-            | xargs mkdir -v -p
-
-        innoextract -e expat-*bin-*.exe
-
-        ls -lh app/Bin/
-
-        ( cd app && 7z a -tzip -mx=9 ../"${zip_name}" . )
-
-    - name: Offer binaries for download
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
-      with:
-        name: expat_${{ matrix.expat_platform }}_${{ github.sha }}
-        path: expat/${{ matrix.expat_platform }}/expat-win*bin-*.*.*.*
-        if-no-files-found: error
-
-    - name: Run installer
-      shell: pwsh
-      run: |-
-        Start-Process -FilePath D:\\expat-installer.exe -ArgumentList "/VERYSILENT", "/SUPPRESSMSGBOXES", "/NORESTART" -Wait
-
-    - name: Build installed code — Configure
-      env:
-        cmake_build_type: ${{ matrix.cmake_build_type }}
-        cmake_generator: ${{ matrix.cmake_generator }}
-        cmake_platform: ${{ matrix.cmake_platform }}
-        expat_char_type: ${{ matrix.expat_char_type }}
-      run: |-
-        cmake_args=(
-          -A "${cmake_platform}"
-          -G "${cmake_generator}"
-          -DCMAKE_BUILD_TYPE="${cmake_build_type}"
-          -DEXPAT_CHAR_TYPE="${expat_char_type}"
-          -DEXPAT_WARNINGS_AS_ERRORS=ON
-          -Wdev
-          -Wdeprecated
-        )
-        set -x
-        cd '/c/Program Files (x86)/Expat '*/Source
-        mkdir build
-        cmake -S . -B build "${cmake_args[@]}"
-
-    - name: Build installed code — Build
-      env:
-        cmake_build_type: ${{ matrix.cmake_build_type }}
-      run: |-
-        msbuild_args=(
-          -m
-          -property:Configuration="${cmake_build_type}"
-        )
-        set -x
-        cd '/c/Program Files (x86)/Expat '*/Source/build
-        MSBuild.exe "${msbuild_args[@]}" expat.sln
-
-    - name: Build installed code — Run tests
-      env:
-        cmake_build_type: ${{ matrix.cmake_build_type }}
-        expat_dll: ${{ matrix.expat_dll }}
-      run: |-
-        ctest_args=(
-          --build-config "${cmake_build_type}"
-          --output-on-failure
-          --parallel 2
-        )
-        set -x
-        cd '/c/Program Files (x86)/Expat '*/Source/build
-        cp -v "${cmake_build_type}/${expat_dll}" "tests/${cmake_build_type}/"
-        ctest "${ctest_args[@]}"

.github/workflows/windows-build.yml

@@ -1,149 +0,0 @@
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2025-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2026      Tania Somanna <tsomanna@qti.qualcomm.com>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-name: Build on Windows
-
-on:
-  pull_request:
-  push:
-  schedule:
-    - cron: '0 2 * * 5'  # Every Friday at 2am
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  windows_build:
-    name: Build on Windows (${{ matrix.runs-on }}, ${{ matrix.cmake_platform }}, ${{ matrix.expat_char_type }})
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - runs-on: windows-2022
-            cmake_build_type: Debug
-            cmake_generator: Visual Studio 17 2022
-            cmake_platform: Win32
-            expat_char_type: char
-            expat_dll: libexpatd.dll
-            expat_sln: expat.sln
-          - runs-on: windows-2022
-            cmake_build_type: Debug
-            cmake_generator: Visual Studio 17 2022
-            cmake_platform: x64
-            expat_char_type: wchar_t
-            expat_dll: libexpatwd.dll
-            expat_sln: expat.sln
-          - runs-on: windows-11-arm
-            cmake_build_type: Debug
-            cmake_generator: Visual Studio 17 2022
-            cmake_platform: ARM64
-            expat_char_type: wchar_t
-            expat_dll: libexpatwd.dll
-            expat_sln: expat.sln
-          - runs-on: windows-2025-vs2026
-            cmake_build_type: Debug
-            cmake_generator: Visual Studio 18 2026
-            cmake_platform: Win32
-            expat_char_type: char
-            expat_dll: libexpatd.dll
-            expat_sln: expat.slnx
-          - runs-on: windows-2025-vs2026
-            cmake_build_type: Debug
-            cmake_generator: Visual Studio 18 2026
-            cmake_platform: x64
-            expat_char_type: wchar_t
-            expat_dll: libexpatwd.dll
-            expat_sln: expat.slnx
-    defaults:
-      run:
-        shell: bash
-    runs-on: "${{ matrix.runs-on }}"
-    steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-
-    - uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57  # v3.0.0
-
-    - name: Configure
-      env:
-        cmake_build_type: ${{ matrix.cmake_build_type }}
-        cmake_generator: ${{ matrix.cmake_generator }}
-        cmake_platform: ${{ matrix.cmake_platform }}
-        expat_char_type: ${{ matrix.expat_char_type }}
-      run: |-
-        cmake_args=(
-          -A "${cmake_platform}"
-          -G "${cmake_generator}"
-          -DCMAKE_BUILD_TYPE="${cmake_build_type}"
-          -DEXPAT_CHAR_TYPE="${expat_char_type}"
-          -DEXPAT_WARNINGS_AS_ERRORS=ON
-          -Wdev
-          -Wdeprecated
-        )
-        set -x
-        cd expat
-        mkdir build
-        cmake -S . -B build "${cmake_args[@]}"
-
-    - name: Build
-      env:
-        cmake_build_type: ${{ matrix.cmake_build_type }}
-        expat_sln: ${{ matrix.expat_sln }}
-      run: |-
-        msbuild_args=(
-          -m
-          -property:Configuration="${cmake_build_type}"
-        )
-        set -x
-        cd expat/build
-        MSBuild.exe "${msbuild_args[@]}" "${expat_sln}"
-
-    - name: Run tests
-      env:
-        cmake_build_type: ${{ matrix.cmake_build_type }}
-        expat_dll: ${{ matrix.expat_dll }}
-      run: |-
-        ctest_args=(
-          --build-config "${cmake_build_type}"
-          --output-on-failure
-          --parallel 2
-        )
-        set -x
-        cd expat/build
-        cp -v "${cmake_build_type}/${expat_dll}" "tests/${cmake_build_type}/"
-        ctest "${ctest_args[@]}"
-
-    - name: Ensure that file libexpat.def.cmake is not missing any symbols
-      run: |
-        symbols_txt="${GITHUB_WORKSPACE}"/.github/workflows/data/exported-symbols-unversioned.txt
-        while read line ; do
-            symbol="$(tr -d '\r' <<<"${line}")"  # drops trailing carriage return
-            ( set -x ; grep -q -F " ${symbol} @" expat/lib/libexpat.def.cmake )  # i.e. fail CI if symbol is missing
-        done < "${symbols_txt}"

.mailmap

@@ -1,22 +1,13 @@
 # This file is used by "git log"
-Alfonso Gregory <gfunni234@gmail.com>
 Ben Wagner <bungeman@chromium.org>
-Berkay Eren Ürün <berkay.ueruen@siemens.com> <berkay.ueruen@tum.de>
-Christian Ng <christianrng@berkeley.edu> <10689391+Laserbear@users.noreply.github.com>
-Donghee Na <donghee.na@python.org>
 Franek Korta <fkorta@gmail.com>
 Hanno Böck <hanno@gentoo.org>
-Hanno Böck <hanno@gentoo.org> <990588+hannob@users.noreply.github.com>
-Haris Hussain <hextheshadow0x@gmail.com>
 James Clark <jjc@jclark.com> <jclark@users.sourceforge.net>
 José Gutiérrez de la Concha <jose@zeroc.com>
-Joyce Brum <joycebrum@google.com>
 Karl Waclawek <karl@waclawek.net> <karl.waclawek@qlinesolutions.com>
 Karl Waclawek <karl@waclawek.net> <kwaclaw@users.sourceforge.net>
-Kartik Kenchi <netliomax25@gmail.com>
 Kishore Kunche <kishore.kunche@intel.com>
 Martin Ettl <ettl.martin78@googlemail.com> <orbitcowboy@web.de>
-Owain Davies <owaind@bath.edu>
 Rhodri James <rhodri@wildebeest.org.uk> <rhodri@kynesim.co.uk>
 Rolf Eike Beer <eike@sf-mail.de> <eb@emlix.com>
 Sebastian Pipping <sebastian@pipping.org> <hartwork@users.sourceforge.net>

Brewfile

@@ -1,7 +1,10 @@
 brew "autoconf"
 brew "automake"
 brew "cmake"
+brew "coreutils"
 brew "docbook2x"
+brew "dos2unix"
+brew "findutils"
 brew "gcc"
 brew "gettext"
 brew "ghostscript"

CONTRIBUTING.md

@@ -1,102 +0,0 @@
-# Hi! :wave:
-
-Thanks for your interest in contributing to the libexpat project or "Expat"! :+1:
-
-> [!TIP]
-> TL;DR: **The best move before creating a pull request**
-> that is big, complex, and/or controversial
-> is to [open a new issue](https://github.com/libexpat/libexpat/issues)
-> and discuss options moving forward :pray: :beers:
-
-Below, I'll document what Expat needs and does not need, at this time.
-
-
-# What Expat needs (and does not need) in general
-
-Expat is:
-
-- in maintenance mode,
-- unfunded,
-- understaffed,
-- complex,
-- 25+ years old in some regards,
-- meant to support parsing of XML files that exceed available RAM,
-- written in the memory-unsafe language C99,
-- is [used in many places](https://libexpat.github.io/doc/users/),
-  both in [hardware](https://libexpat.github.io/doc/users/#hardware)
-  and in [software](https://libexpat.github.io/doc/users/),
-- implementing [XML 1.0 *Fourth* Edition](https://www.w3.org/TR/2006/REC-xml-20060816/),
-- targeting environments that are relevant today
-  and/or up to 5 years into the past.
-
-
-## What kinds of pull requests will be welcome
-
-Pull requests will be most welcome when they:
-
-- are small,
-- are easy to review,
-- have low risk,
-- have had GitHub Actions CI run and all-green already
-  in your public fork repository,
-- help both you and the libexpat project :tada:
-
-The need for additional tests or CI will depend on the specific pull request.
-
-
-## What kinds of pull requests will *not* be welcome
-
-Pull requests will *not* be welcome when:
-
-- the changes are big, complex, high risk, controversial
-  and/or hard to review,
-- the exact change has been said "no" to in the past,
-- the changes break API or ABI backwards compatibility,
-- it fixes an issue for an unsupported
-  (or no-longer supported) environment, and/or
-- it introduces new features
-  (without prior discussion and agreement
-  in a dedicated issue).
-
-Specific examples of things known to *not* be welcome:
-
-- Mass-changing things.
-- Fixing things for some stone age version of Visual Studio.
-- Adding support to ignore or recover from malformed XML.
-- Adding support for XML streaming.
-- Making the C code compile with a C++ compiler.
-- Adding support for XML 1.0r5 without prior discussion.
-- Adding support for XML 1.1 in general.
-- Adding additional build systems.
-
-
-# What Expat needs on a technical level
-
-- All new C code and changes to existing C code must:
-  - pass all existing CI
-    (that includes
-    [ASan](https://clang.llvm.org/docs/AddressSanitizer.html),
-    [UBSan](https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html),
-    [clang-format](https://clang.llvm.org/docs/ClangFormat.html),
-    [Cppcheck](https://cppcheck.sourceforge.io/),
-    [codespell](https://github.com/codespell-project/codespell),
-    ..),
-  - conform to C99,
-  - check returns from `malloc`/`realloc` for `NULL`,
-  - not use recursion (when it can be controlled by user input),
-  - have integer overflow in mind,
-  - have undefined behavior in mind, and
-  - have security in mind in general.
-- A commit should be about one — and just one — of these things:
-  - fixing a bug,
-  - improving something,
-  - adding something new,
-  - doing a refactoring, or
-  - adjusting whitespace.
-
-
-# Providing feedback
-
-Thanks for your interest and attention! :+1:
-
-I'm happy about [constructive feedback](mailto:sebastian@pipping.org) to this document — thank you! :pray:

COPYING

@@ -1,5 +1,5 @@
 Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper
-Copyright (c) 2001-2026 Expat maintainers
+Copyright (c) 2001-2022 Expat maintainers
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

appveyor.yml

@@ -0,0 +1,146 @@
+# AppVeyor configuration
+#                          __  __            _
+#                       ___\ \/ /_ __   __ _| |_
+#                      / _ \\  /| '_ \ / _` | __|
+#                     |  __//  \| |_) | (_| | |_
+#                      \___/_/\_\ .__/ \__,_|\__|
+#                               |_| XML parser
+#
+# Copyright (c) 2017      José Gutiérrez de la Concha <jose@zeroc.com>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017      Franek Korta <fkorta@gmail.com>
+# Licensed under the MIT license:
+#
+# Permission is  hereby granted,  free of charge,  to any  person obtaining
+# a  copy  of  this  software   and  associated  documentation  files  (the
+# "Software"),  to  deal in  the  Software  without restriction,  including
+# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
+# distribute, sublicense, and/or sell copies of the Software, and to permit
+# persons  to whom  the Software  is  furnished to  do so,  subject to  the
+# following conditions:
+#
+# The above copyright  notice and this permission notice  shall be included
+# in all copies or substantial portions of the Software.
+#
+# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
+# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
+# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
+# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+# USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+# scripts that are called at very beginning, before repo cloning
+init:
+- git config --global core.autocrlf input
+
+# version format
+version: libexpat-{build}
+
+# set clone depth, clone entire repository history if not defined
+clone_depth: 50
+
+# clone directory
+clone_folder: c:\projects\libexpat
+
+configuration: Debug
+
+# AppVeyor pre-installed software:
+# https://www.appveyor.com/docs/build-environment/#pre-installed-software
+#
+# CMake Visual Studio generators:
+# https://cmake.org/cmake/help/latest/manual/cmake-generators.7.html#visual-studio-generators
+environment:
+  matrix:
+    # Visual Studio 2017 Win32
+    - GENERATOR: Visual Studio 15 2017
+      PLATFORM: Win32
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
+
+    # Visual Studio 2017 Win32 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 15 2017
+      PLATFORM: Win32
+      CMAKE_ARGS: -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
+
+    # Visual Studio 2017 x64
+    - GENERATOR: Visual Studio 15 2017 Win64
+      PLATFORM: x64
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
+
+    # Visual Studio 2017 x64 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 15 2017 Win64
+      PLATFORM: x64
+      CMAKE_ARGS: -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2017
+
+    # Visual Studio 2019 Win32
+    - GENERATOR: Visual Studio 16 2019
+      PLATFORM: Win32
+      CMAKE_ARGS: -A Win32
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019
+
+    # Visual Studio 2019 Win32 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 16 2019
+      PLATFORM: Win32
+      CMAKE_ARGS: -A Win32 -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019
+
+    # Visual Studio 2019 x64
+    - GENERATOR: Visual Studio 16 2019
+      PLATFORM: x64
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019
+
+    # Visual Studio 2019 x64 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 16 2019
+      PLATFORM: x64
+      CMAKE_ARGS: -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2019
+
+    # Visual Studio 2022 Win32
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: Win32
+      CMAKE_ARGS: -A Win32
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
+    # Visual Studio 2022 Win32 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: Win32
+      CMAKE_ARGS: -A Win32 -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
+    # Visual Studio 2022 x64
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: x64
+      EXPAT_DLL: libexpatd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
+    # Visual Studio 2022 x64 XML_UNICODE_WCHAR_T
+    - GENERATOR: Visual Studio 17 2022
+      PLATFORM: x64
+      CMAKE_ARGS: -DEXPAT_CHAR_TYPE=wchar_t
+      EXPAT_DLL: libexpatwd.dll
+      APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2022
+
+before_build:
+  - echo Running cmake...
+  - cd c:\projects\libexpat
+  - cmake -G"%GENERATOR%" -DCMAKE_BUILD_TYPE=%CONFIGURATION% -DEXPAT_WARNINGS_AS_ERRORS=ON %CMAKE_ARGS% expat
+
+build:
+  parallel: true                  # enable MSBuild parallel builds
+  project: expat.sln              # path to Visual Studio solution or project
+
+test_script:
+  - cp %CONFIGURATION%\\%EXPAT_DLL% tests\\%CONFIGURATION%\\
+  - ctest --build-config %CONFIGURATION% --output-on-failure --parallel 2

expat/.gitignore

@@ -1,7 +1,6 @@
 /autom4te.cache/
 /cmake-build-debug/
-/CPackConfig.cmake
-/CPackSourceConfig.cmake
+m4/
 CMakeFiles/
 Testing/
 aclocal.m4
@@ -40,4 +39,3 @@ source__R*
 /stamp-h1
 /libexpat*.dll
 /changelog
-*~

expat/CMake.README

@@ -3,25 +3,25 @@
 The cmake based buildsystem for expat works on Windows (cygwin, mingw, Visual
 Studio) and should work on all other platform cmake supports.
 
-Assuming ~/expat-2.8.2 is the source directory of expat, add a subdirectory
+Assuming ~/expat-2.5.0 is the source directory of expat, add a subdirectory
 build and change into that directory:
-~/expat-2.8.2$ mkdir build && cd build
-~/expat-2.8.2/build$
+~/expat-2.5.0$ mkdir build && cd build
+~/expat-2.5.0/build$
 
 From that directory, call cmake first, then call make, make test and
 make install in the usual way:
-~/expat-2.8.2/build$ cmake ..
+~/expat-2.5.0/build$ cmake ..
 -- The C compiler identification is GNU
 -- The CXX compiler identification is GNU
 ....
 -- Configuring done
 -- Generating done
--- Build files have been written to: /home/patrick/expat-2.8.2/build
+-- Build files have been written to: /home/patrick/expat-2.5.0/build
 
 If you want to specify the install location for your files, append
 -DCMAKE_INSTALL_PREFIX=/your/install/path to the cmake call.
 
-~/expat-2.8.2/build$ make && make test && make install
+~/expat-2.5.0/build$ make && make test && make install
 Scanning dependencies of target expat
 [  5%] Building C object CMakeFiles/expat.dir/lib/xmlparse.c.o
 [ 11%] Building C object CMakeFiles/expat.dir/lib/xmlrole.c.o
@@ -36,7 +36,7 @@ Visual Studio Command Prompt or when using mingw, you must open a cmd.exe and
 make sure that gcc can be called. On Windows, you also might want to specify a
 special Generator for CMake:
 for Visual Studio builds do:
-cmake .. -G "Visual Studio 17 2022" && msbuild /m expat.sln
+cmake .. -G "Visual Studio 15 2017" && msbuild /m expat.sln
 for mingw builds do:
 cmake .. -G "MinGW Makefiles" -DCMAKE_INSTALL_PREFIX=D:\expat-install
     && gmake && gmake install

expat/CMakeLists.txt

@@ -7,12 +7,12 @@
 #
 # Copyright (c) 2010      Patrick Spendrin <ps_ml@gmx.de>
 # Copyright (c) 2012      Karl Waclawek <karl@waclawek.net>
-# Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2016      Sergei Nikulov <sergey.nikulov@gmail.com>
 # Copyright (c) 2016      Björn Lindahl <bjorn.lindahl@foi.se>
 # Copyright (c) 2016      Tobias Taschner <github@tc84.de>
 # Copyright (c) 2016      Ben Boeckel <ben.boeckel@kitware.com>
-# Copyright (c) 2017-2022 Rhodri James <rhodri@wildebeest.org.uk>
+# Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
 # Copyright (c) 2017      Rolf Eike Beer <eike@sf-mail.de>
 # Copyright (c) 2017      Stephen Groat <stephen@groat.us>
 # Copyright (c) 2017      Franek Korta <fkorta@gmail.com>
@@ -30,28 +30,20 @@
 # Copyright (c) 2020      Thomas Beutlich <tc@tbeu.de>
 # Copyright (c) 2021      Alex Richardson <Alexander.Richardson@cl.cam.ac.uk>
 # Copyright (c) 2022      Johnny Jazeix <jazeix@gmail.com>
-# Copyright (c) 2022      Mark Brand <markbrand@google.com>
 # Copyright (c) 2022      David Faure <david.faure@kdab.com>
-# Copyright (c) 2025      Alfonso Gregory <gfunni234@gmail.com>
-# Copyright (c) 2026      Rosen Penev <rosenp@gmail.com>
-# Copyright (c) 2026      Gordon Messmer <gordon.messmer@gmail.com>
-# Copyright (c) 2026      Nick Begg <nick@stunttruck.net>
 # Unlike most of Expat,
 # this file is copyrighted under the BSD-license for buildsystem files of KDE.
 
-cmake_minimum_required(VERSION 3.17.0)
+cmake_minimum_required(VERSION 3.1.3)
 
 project(expat
     VERSION
-        2.8.2
+        2.5.0
     LANGUAGES
         C
 )
-set(CMAKE_C_STANDARD 99)
-set(CMAKE_C_STANDARD_REQUIRED ON)
-set(CMAKE_C_EXTENSIONS OFF)  # i.e. -std=c99 rather than default -std=gnu99
 
-set(PACKAGE_BUGREPORT "https://github.com/libexpat/libexpat/issues")
+set(PACKAGE_BUGREPORT "expat-bugs@libexpat.org")
 set(PACKAGE_NAME "expat")
 set(PACKAGE_VERSION "${PROJECT_VERSION}")
 set(PACKAGE_STRING "${PACKAGE_NAME} ${PACKAGE_VERSION}")
@@ -122,8 +114,9 @@ macro(expat_shy_set var default cache type desc)
 
     if(DEFINED ${var})
         # NOTE: The idea is to (ideally) only add to the cache if
-        #       there is no cache entry, yet.
-        if(NOT DEFINED "CACHE{${var}}")
+        #       there is no cache entry, yet.  "if(DEFINED CACHE{var})"
+        #       requires CMake >=3.14.
+        if(CMAKE_VERSION VERSION_GREATER_EQUAL "3.14" AND NOT DEFINED "CACHE{${var}}")
             set("${var}" "${${var}}" CACHE "${type}" "${desc}")
         endif()
     else()
@@ -138,36 +131,23 @@ expat_shy_set(EXPAT_SHARED_LIBS ${_EXPAT_SHARED_LIBS_DEFAULT} CACHE BOOL "Build
 expat_shy_set(EXPAT_BUILD_DOCS ${_EXPAT_BUILD_DOCS_DEFAULT} CACHE BOOL "Build man page for xmlwf")
 expat_shy_set(EXPAT_BUILD_FUZZERS OFF CACHE BOOL "Build fuzzers for the expat library")
 expat_shy_set(EXPAT_BUILD_PKGCONFIG ${_EXPAT_BUILD_PKGCONFIG_DEFAULT} CACHE BOOL "Build pkg-config file")
-expat_shy_set(EXPAT_OSSFUZZ_BUILD OFF CACHE BOOL "Build fuzzers via OSS-Fuzz for the expat library")
-mark_as_advanced(EXPAT_OSSFUZZ_BUILD)
+expat_shy_set(EXPAT_OSSFUZZ_BUILD OFF CACHE BOOL "Build fuzzers via ossfuzz for the expat library")
+if(UNIX OR _EXPAT_HELP)
+    expat_shy_set(EXPAT_WITH_LIBBSD OFF CACHE BOOL "Utilize libbsd (for arc4random_buf)")
+endif()
 expat_shy_set(EXPAT_ENABLE_INSTALL ON CACHE BOOL "Install expat files in cmake install target")
-expat_shy_set(EXPAT_CONTEXT_BYTES 1024 CACHE STRING "Define to specify how much context to retain around the current parse point, 0 to disable")
+expat_shy_set(EXPAT_CONTEXT_BYTES 1024 CACHE STRING "Define to specify how much context to retain around the current parse point")
 mark_as_advanced(EXPAT_CONTEXT_BYTES)
-expat_shy_set(EXPAT_SYMBOL_VERSIONING OFF CACHE BOOL "Define to provide symbol versioning for dependency generation")
 expat_shy_set(EXPAT_DTD ON CACHE BOOL "Define to make parameter entity parsing functionality available")
 mark_as_advanced(EXPAT_DTD)
-expat_shy_set(EXPAT_GE ON CACHE BOOL "Define to make general entity parsing functionality available")
-mark_as_advanced(EXPAT_GE)
 expat_shy_set(EXPAT_NS ON CACHE BOOL "Define to make XML Namespaces functionality available")
 mark_as_advanced(EXPAT_NS)
 expat_shy_set(EXPAT_WARNINGS_AS_ERRORS OFF CACHE BOOL "Treat all compiler warnings as errors")
 if(UNIX OR _EXPAT_HELP)
-    expat_shy_set(EXPAT_DEV_URANDOM OFF CACHE BOOL "Define to include code reading entropy from `/dev/urandom'.")
-    mark_as_advanced(EXPAT_DEV_URANDOM)
-endif()
-if(UNIX OR WASI OR _EXPAT_HELP)
-    expat_shy_set(EXPAT_WITH_ARC4RANDOM "AUTO" CACHE STRING "Make use of arc4random function (ON|OFF|AUTO) [default=AUTO]")
-    mark_as_advanced(EXPAT_WITH_ARC4RANDOM)
-    expat_shy_set(EXPAT_WITH_ARC4RANDOM_BUF "AUTO" CACHE STRING "Make use of arc4random_buf function (ON|OFF|AUTO) [default=AUTO]")
-    mark_as_advanced(EXPAT_WITH_ARC4RANDOM_BUF)
-    expat_shy_set(EXPAT_WITH_GETENTROPY "AUTO" CACHE STRING "Make use of getentropy function (ON|OFF|AUTO) [default=AUTO]")
-    mark_as_advanced(EXPAT_WITH_GETENTROPY)
-endif()
-if(UNIX OR _EXPAT_HELP)
+    expat_shy_set(EXPAT_DEV_URANDOM ON CACHE BOOL "Define to include code reading entropy from `/dev/urandom'.")
     expat_shy_set(EXPAT_WITH_GETRANDOM "AUTO" CACHE STRING "Make use of getrandom function (ON|OFF|AUTO) [default=AUTO]")
-    mark_as_advanced(EXPAT_WITH_GETRANDOM)
     expat_shy_set(EXPAT_WITH_SYS_GETRANDOM "AUTO" CACHE STRING "Make use of syscall SYS_getrandom (ON|OFF|AUTO) [default=AUTO]")
-    mark_as_advanced(EXPAT_WITH_SYS_GETRANDOM)
+    mark_as_advanced(EXPAT_DEV_URANDOM)
 endif()
 expat_shy_set(EXPAT_CHAR_TYPE "char" CACHE STRING "Character type to use (char|ushort|wchar_t) [default=char]")
 expat_shy_set(EXPAT_ATTR_INFO OFF CACHE BOOL "Define to allow retrieving the byte offsets for attribute names and values")
@@ -184,21 +164,21 @@ if(NOT _EXPAT_HELP)
     mark_as_advanced(_EXPAT_M32)
 endif()
 
-if(EXPAT_BUILD_FUZZERS)
+if(EXPAT_BUILD_TESTS)
     # We have to call enable_language() before modifying any CMAKE_CXX_* variables
     enable_language(CXX)
-
-    set(CMAKE_CXX_STANDARD 17)  # for std::string_view for Abseil for libprotobuf-mutator
-    set(CMAKE_CXX_STANDARD_REQUIRED ON)
-    set(CMAKE_CXX_EXTENSIONS OFF)  # i.e. -std=c++11 rather than default -std=gnu++11
 endif()
 
 #
 # Environment checks
 #
-if(EXPAT_DTD AND NOT EXPAT_GE)
-    message(SEND_ERROR "Option EXPAT_DTD requires that EXPAT_GE is also enabled.")
-    message(SEND_ERROR "Please either enable option EXPAT_GE (recommended) or disable EXPAT_DTD also.")
+if(EXPAT_WITH_LIBBSD)
+    find_library(LIB_BSD NAMES bsd)
+    if(NOT LIB_BSD)
+        message(SEND_ERROR "EXPAT_WITH_LIBBSD option is enabled, but libbsd was not found")
+    else()
+        set(HAVE_LIBBSD TRUE)
+    endif()
 endif()
 
 if(MSVC)
@@ -206,9 +186,9 @@ if(MSVC)
     # - https://cmake.org/cmake/help/latest/variable/MSVC_VERSION.html
     # - https://sourceforge.net/p/predef/wiki/Compilers/
     # - https://en.wikipedia.org/wiki/Microsoft_Visual_Studio#History
-    set(_EXPAT_MSVC_REQUIRED_INT 1900)  # i.e. 14.0/2015(Update 2)/1900
-    set(_EXPAT_MSVC_SUPPORTED_INT 1930)
-    set(_EXPAT_MSVC_SUPPORTED_DISPLAY "Visual Studio 17.0/2022/${_EXPAT_MSVC_SUPPORTED_INT}")
+    set(_EXPAT_MSVC_REQUIRED_INT 1800)  # i.e. 12.0/2013/1800; see PR #426
+    set(_EXPAT_MSVC_SUPPORTED_INT 1910)
+    set(_EXPAT_MSVC_SUPPORTED_DISPLAY "Visual Studio 15.0/2017/${_EXPAT_MSVC_SUPPORTED_INT}")
 
     if(MSVC_VERSION VERSION_LESS ${_EXPAT_MSVC_SUPPORTED_INT})
         if(MSVC_VERSION VERSION_LESS ${_EXPAT_MSVC_REQUIRED_INT})
@@ -219,12 +199,6 @@ if(MSVC)
             message(WARNING "Please use ${_EXPAT_MSVC_SUPPORTED_DISPLAY} or later.  Thank you!")
         endif()
     endif()
-
-    # Stop MSVC from trying to decode the source files using
-    # the Windows system code page encoding that could e.g. be Windows-936
-    # on a Chinese Windows system rather than UTF-8.
-    # https://devblogs.microsoft.com/cppblog/new-options-for-managing-character-sets-in-the-microsoft-cc-compiler/
-    add_compile_options(/source-charset:utf-8)
 endif()
 
 macro(_expat_copy_bool_int source_ref dest_ref)
@@ -294,25 +268,18 @@ macro(evaluate_detection_results use_ref have_ref thing_lower thing_title)
 endmacro()
 
 if(NOT WIN32)
-    evaluate_detection_results(EXPAT_WITH_ARC4RANDOM HAVE_ARC4RANDOM "function arc4random" "Function arc4random")
-    evaluate_detection_results(EXPAT_WITH_ARC4RANDOM_BUF HAVE_ARC4RANDOM_BUF "function arc4random_buf" "Function arc4random_buf")
-    evaluate_detection_results(EXPAT_WITH_GETENTROPY HAVE_GETENTROPY "function getentropy" "Function getentropy")
     evaluate_detection_results(EXPAT_WITH_GETRANDOM HAVE_GETRANDOM "function getrandom" "Function getrandom")
     evaluate_detection_results(EXPAT_WITH_SYS_GETRANDOM HAVE_SYSCALL_GETRANDOM "syscall SYS_getrandom" "Syscall SYS_getrandom")
 endif()
 
 _expat_copy_bool_int(EXPAT_ATTR_INFO        XML_ATTR_INFO)
 _expat_copy_bool_int(EXPAT_DTD              XML_DTD)
-_expat_copy_bool_int(EXPAT_GE               XML_GE)
 _expat_copy_bool_int(EXPAT_LARGE_SIZE       XML_LARGE_SIZE)
 _expat_copy_bool_int(EXPAT_MIN_SIZE         XML_MIN_SIZE)
 _expat_copy_bool_int(EXPAT_NS               XML_NS)
 if(NOT WIN32)
     _expat_copy_bool_int(EXPAT_DEV_URANDOM  XML_DEV_URANDOM)
 endif()
-if(NOT EXPAT_CONTEXT_BYTES GREATER 0)  # in particular with -DEXPAT_CONTEXT_BYTES=OFF
-    set(EXPAT_CONTEXT_BYTES 0)
-endif()
 set(XML_CONTEXT_BYTES ${EXPAT_CONTEXT_BYTES})
 
 macro(expat_install)
@@ -326,11 +293,8 @@ expat_install(FILES "${CMAKE_CURRENT_BINARY_DIR}/expat_config.h" DESTINATION ${C
 
 
 set(EXTRA_COMPILE_FLAGS)
-if(FLAG_WSTRICT_ALIASING)
-    set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -Wstrict-aliasing=3")
-endif()
-if(FLAG_WIMPLICIT_FALLTHROUGH)
-    set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -Wimplicit-fallthrough")
+if(FLAG_NO_STRICT_ALIASING)
+    set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -fno-strict-aliasing")
 endif()
 if(FLAG_VISIBILITY)
   if(EXPAT_SHARED_LIBS)
@@ -338,7 +302,7 @@ if(FLAG_VISIBILITY)
   endif()
   set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -fvisibility=hidden")
 endif()
-if(MINGW AND ("${CMAKE_C_COMPILER_ID}" STREQUAL "GNU"))
+if(MINGW)
     # Without __USE_MINGW_ANSI_STDIO the compiler produces a false positive
     set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -Wno-pedantic-ms-format")
 endif()
@@ -347,26 +311,28 @@ if (EXPAT_WARNINGS_AS_ERRORS)
         add_definitions(/WX)
     else()
         set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -Werror")
-        if(MINGW)
-            # To avoid "error: unknown conversion type character ‘l’ in format [-Werror=format=]"
-            set(EXTRA_COMPILE_FLAGS "${EXTRA_COMPILE_FLAGS} -Wno-format")
-        endif()
     endif()
 endif()
 set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} ${EXTRA_COMPILE_FLAGS}")
 set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${EXTRA_COMPILE_FLAGS}")
 
 if (MSVC)
-    cmake_policy(GET CMP0091 _policy_cmp0091_behavior)
-    if (NOT _policy_cmp0091_behavior STREQUAL NEW)
-        message(SEND_ERROR "Policy CMP0091 behavior is '${_policy_cmp0091_behavior}' rather than 'NEW', mis-compilation detected.")
-    endif()
-
-    message(STATUS "-- Using static CRT ${EXPAT_MSVC_STATIC_CRT}")
     if (EXPAT_MSVC_STATIC_CRT)
-        set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")  # .. without suffix "DLL": static
-    else()
-        set(CMAKE_MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>DLL")  # i.e. CMake default behavior: shared
+        message("-- Using static CRT ${EXPAT_MSVC_STATIC_CRT}")
+        foreach(flag_var
+                CMAKE_CXX_FLAGS_${_EXPAT_BUILD_TYPE_UPPER}
+                CMAKE_CXX_FLAGS_DEBUG
+                CMAKE_CXX_FLAGS_RELEASE
+                CMAKE_CXX_FLAGS_MINSIZEREL
+                CMAKE_CXX_FLAGS_RELWITHDEBINFO
+                CMAKE_C_FLAGS_${_EXPAT_BUILD_TYPE_UPPER}
+                CMAKE_C_FLAGS_DEBUG
+                CMAKE_C_FLAGS_RELEASE
+                CMAKE_C_FLAGS_MINSIZEREL
+                CMAKE_C_FLAGS_RELWITHDEBINFO
+                )
+            string(REPLACE "/MD" "/MT" ${flag_var} "${${flag_var}}")
+        endforeach()
     endif()
 endif()
 
@@ -405,62 +371,8 @@ set(_EXPAT_C_SOURCES
 #   lib/xmltok_ns.c
 )
 
-if(HAVE_ARC4RANDOM)
-    set(_EXPAT_C_SOURCES
-        ${_EXPAT_C_SOURCES}
-        lib/random_arc4random.c
-        lib/random_arc4random.h
-    )
-endif()
-
-if(HAVE_ARC4RANDOM_BUF)
-    set(_EXPAT_C_SOURCES
-        ${_EXPAT_C_SOURCES}
-        lib/random_arc4random_buf.c
-        lib/random_arc4random_buf.h
-    )
-endif()
-
-if(EXPAT_DEV_URANDOM)
-    set(_EXPAT_C_SOURCES
-        ${_EXPAT_C_SOURCES}
-        lib/random_dev_urandom.c
-        lib/random_dev_urandom.h
-    )
-endif()
-
-if(HAVE_GETENTROPY)
-    set(_EXPAT_C_SOURCES
-        ${_EXPAT_C_SOURCES}
-        lib/random_getentropy.c
-        lib/random_getentropy.h
-    )
-endif()
-
-if(HAVE_GETRANDOM OR HAVE_SYSCALL_GETRANDOM)
-    set(_EXPAT_C_SOURCES
-        ${_EXPAT_C_SOURCES}
-        lib/random_getrandom.c
-        lib/random_getrandom.h
-    )
-endif()
-
-if(WIN32)
-    set(_EXPAT_C_SOURCES
-        ${_EXPAT_C_SOURCES}
-        lib/random_rand_s.c
-        lib/random_rand_s.h
-    )
-endif()
-
 if(EXPAT_SHARED_LIBS)
     set(_SHARED SHARED)
-    if(EXPAT_DTD OR EXPAT_GE)
-        set(_EXPAT_DTD_OR_GE TRUE)
-    else()
-        set(_EXPAT_DTD_OR_GE FALSE)
-    endif()
-
     if(WIN32)
         macro(_expat_def_file_toggle source_var target_var)
             if(${source_var})
@@ -470,7 +382,7 @@ if(EXPAT_SHARED_LIBS)
             endif()
         endmacro()
 
-        _expat_def_file_toggle(_EXPAT_DTD_OR_GE _EXPAT_COMMENT_DTD_OR_GE)
+        _expat_def_file_toggle(EXPAT_DTD _EXPAT_COMMENT_DTD)
         _expat_def_file_toggle(EXPAT_ATTR_INFO _EXPAT_COMMENT_ATTR_INFO)
 
         configure_file("${CMAKE_CURRENT_SOURCE_DIR}/lib/libexpat.def.cmake" "${CMAKE_CURRENT_BINARY_DIR}/lib/libexpat.def")
@@ -478,32 +390,19 @@ if(EXPAT_SHARED_LIBS)
 
         # Add DLL version
         string(REPLACE "." "," _EXPAT_DLL_VERSION ${PROJECT_VERSION}.0)
-        configure_file("${CMAKE_CURRENT_SOURCE_DIR}/win32/version.rc.cmake" "${CMAKE_CURRENT_BINARY_DIR}/win32/version.rc")
-        set(_EXPAT_EXTRA_SOURCES ${_EXPAT_EXTRA_SOURCES} "${CMAKE_CURRENT_BINARY_DIR}/win32/version.rc")
-    else()
-        macro(_expat_map_file_toggle source_var target_var)
-            if(${source_var})
-                set(${target_var} " ")  # i.e. not commented out, a single space
-            else()
-                set(${target_var} "#")  # i.e. commented out
-            endif()
-        endmacro()
-
-        _expat_map_file_toggle(_EXPAT_DTD_OR_GE _EXPAT_COMMENT_DTD_OR_GE)
-        _expat_map_file_toggle(EXPAT_ATTR_INFO _EXPAT_COMMENT_ATTR_INFO)
-
-        configure_file("${CMAKE_CURRENT_SOURCE_DIR}/lib/libexpat.map.in" "${CMAKE_CURRENT_BINARY_DIR}/lib/libexpat.map")
-        set(_EXPAT_EXTRA_SOURCES ${_EXPAT_EXTRA_SOURCES} "${CMAKE_CURRENT_BINARY_DIR}/lib/libexpat.map")
+        set(_EXPAT_EXTRA_SOURCES ${_EXPAT_EXTRA_SOURCES} win32/version.rc)
     endif()
 else()
     set(_SHARED STATIC)
 endif()
 
 add_library(expat ${_SHARED} ${_EXPAT_C_SOURCES} ${_EXPAT_EXTRA_SOURCES})
-add_library(expat::expat ALIAS expat)
 if(_EXPAT_LIBM_FOUND)
     target_link_libraries(expat m)
 endif()
+if(EXPAT_WITH_LIBBSD)
+    target_link_libraries(expat ${LIB_BSD})
+endif()
 
 #
 # Library filename postfix
@@ -538,21 +437,22 @@ foreach(build_type_upper
     set_property(TARGET expat PROPERTY ${build_type_upper}_POSTFIX ${EXPAT_${build_type_upper}_POSTFIX})
 endforeach()
 
-set(LIBCURRENT 13)  # sync
-set(LIBREVISION 2)  # with
-set(LIBAGE 12)      # configure.ac!
+set(LIBCURRENT 9)    # sync
+set(LIBREVISION 10)  # with
+set(LIBAGE 8)        # configure.ac!
 math(EXPR LIBCURRENT_MINUS_AGE "${LIBCURRENT} - ${LIBAGE}")
 
 if(NOT WIN32)
     set_property(TARGET expat PROPERTY VERSION ${LIBCURRENT_MINUS_AGE}.${LIBAGE}.${LIBREVISION})
     set_property(TARGET expat PROPERTY SOVERSION ${LIBCURRENT_MINUS_AGE})
     set_property(TARGET expat PROPERTY NO_SONAME ${NO_SONAME})
-    if(EXPAT_SYMBOL_VERSIONING)
-        set_property(TARGET expat PROPERTY LINK_FLAGS "-Wl,--version-script=${CMAKE_CURRENT_BINARY_DIR}/lib/libexpat.map")
-    endif()
 
     if(APPLE)
-        # NOTE: This intends to talk CMake into compatibility with GNU Libtool
+        if(NOT CMAKE_VERSION VERSION_GREATER_EQUAL 3.17)
+            message(FATAL_ERROR "Expat requires CMake >=3.17 on platform \"APPLE\".")
+        endif()
+
+        # NOTE: This intends to talk CMake into compatiblity with GNU Libtool
         math(EXPR _EXPAT_MACHO_COMPATIBILITY_VERSION "${LIBCURRENT} + 1")
         set(_EXPAT_MACHO_CURRENT_VERSION "${_EXPAT_MACHO_COMPATIBILITY_VERSION}.${LIBREVISION}")
         set_property(TARGET expat PROPERTY MACHO_COMPATIBILITY_VERSION ${_EXPAT_MACHO_COMPATIBILITY_VERSION})
@@ -642,10 +542,10 @@ endif()
 #
 if(EXPAT_BUILD_TOOLS)
     set(xmlwf_SRCS
+        xmlwf/xmlwf.c
+        xmlwf/xmlfile.c
         xmlwf/codepage.c
         xmlwf/readfilemap.c
-        xmlwf/xmlfile.c
-        xmlwf/xmlwf.c
     )
 
     add_executable(xmlwf ${xmlwf_SRCS})
@@ -658,7 +558,7 @@ if(EXPAT_BUILD_TOOLS)
 
     if(MINGW AND _EXPAT_UNICODE_WCHAR_T)
         # https://gcc.gnu.org/onlinedocs/gcc/x86-Windows-Options.html
-        target_link_options(xmlwf PRIVATE -municode)
+        set_target_properties(xmlwf PROPERTIES LINK_FLAGS -municode)
     endif()
 
     if(EXPAT_BUILD_DOCS)
@@ -694,6 +594,14 @@ if(EXPAT_BUILD_TESTS)
     ## these are unittests that can be run on any platform
     enable_testing()
 
+    set(test_SRCS
+        tests/chardata.c
+        tests/memcheck.c
+        tests/minicheck.c
+        tests/structdata.c
+        ${_EXPAT_C_SOURCES}
+    )
+
     if(NOT MSVC)
         if(MINGW)
             set(host whatever-mingw32)  # for nothing but run.sh
@@ -709,34 +617,22 @@ if(EXPAT_BUILD_TESTS)
         endif()
     endfunction()
 
-    add_executable(runtests
-        tests/acc_tests.c
-        tests/alloc_tests.c
-        tests/basic_tests.c
-        tests/chardata.c
-        tests/common.c
-        tests/dummy.c
-        tests/handlers.c
-        tests/memcheck.c
-        tests/minicheck.c
-        tests/misc_tests.c
-        tests/ns_tests.c
-        tests/nsalloc_tests.c
-        tests/runtests.c
-        tests/structdata.c
-        ${_EXPAT_C_SOURCES}
-    )
+    set(_EXPAT_TEST_TARGETS runtests runtestspp)
+    add_executable(runtests   tests/runtests.c     ${test_SRCS})
+    add_executable(runtestspp tests/runtestspp.cpp ${test_SRCS})
 
-    target_compile_definitions(runtests PRIVATE -DXML_TESTING)
-    set_property(TARGET runtests PROPERTY RUNTIME_OUTPUT_DIRECTORY tests)
-    expat_add_test(runtests $<TARGET_FILE:runtests>)
-    if(_EXPAT_LIBM_FOUND)
-        target_link_libraries(runtests m)
-    endif()
+    foreach(_target ${_EXPAT_TEST_TARGETS})
+        set_property(TARGET ${_target} PROPERTY RUNTIME_OUTPUT_DIRECTORY tests)
+        expat_add_test(${_target} $<TARGET_FILE:${_target}>)
 
-    add_executable(benchmark tests/benchmark/benchmark.c)
-    set_property(TARGET benchmark PROPERTY RUNTIME_OUTPUT_DIRECTORY tests/benchmark)
-    target_link_libraries(benchmark expat)
+        if(_EXPAT_LIBM_FOUND)
+            target_link_libraries(${_target} m)
+        endif()
+
+        if(EXPAT_WITH_LIBBSD)
+            target_link_libraries(${_target} ${LIB_BSD})
+        endif()
+    endforeach()
 endif()
 
 #
@@ -767,7 +663,7 @@ if(EXPAT_BUILD_FUZZERS)
         message(SEND_ERROR
             "OSS-Fuzz builds require the environment variable "
             "LIB_FUZZING_ENGINE to be set. If you are seeing this "
-            "warning, it points to a deeper problem in the OSS-Fuzz "
+            "warning, it points to a deeper problem in the ossfuzz "
             "build setup.")
     endif()
 
@@ -786,78 +682,24 @@ if(EXPAT_BUILD_FUZZERS)
             target_link_libraries(${target_name} fuzzpat)
             target_compile_definitions(${target_name}
                 PRIVATE ENCODING_FOR_FUZZING=${encoding_type})
+            if(NOT EXPAT_OSSFUZZ_BUILD)
+                target_compile_options(${target_name} PRIVATE -fsanitize=fuzzer-no-link)
+            endif()
+            # NOTE: Avoiding target_link_options here only because it needs CMake >=3.13
             if(EXPAT_OSSFUZZ_BUILD)
-                target_link_options(${target_name} PRIVATE $ENV{LIB_FUZZING_ENGINE})
+                set_target_properties(${target_name} PROPERTIES LINK_FLAGS $ENV{LIB_FUZZING_ENGINE})
                 set_target_properties(${target_name} PROPERTIES LINKER_LANGUAGE "CXX")
             else()
-                target_compile_options(${target_name} PRIVATE -fsanitize=fuzzer)
-                target_link_options(${target_name} PRIVATE -fsanitize=fuzzer)
+                set_target_properties(${target_name} PROPERTIES LINK_FLAGS -fsanitize=fuzzer)
             endif()
             set_property(
                 TARGET ${target_name} PROPERTY RUNTIME_OUTPUT_DIRECTORY fuzz)
         endforeach()
     endforeach()
-
-    find_package(Protobuf REQUIRED)
-
-    # Only include libprotobuf-mutator here so we don't build it in non-fuzz
-    # configurations.
-    include(ExternalProject)
-
-    set(ProtobufMutator_PREFIX libprotobuf-mutator)
-    set(ProtobufMutator_PATH ${CMAKE_CURRENT_BINARY_DIR}/${ProtobufMutator_PREFIX}/src/${ProtobufMutator_PREFIX})
-    set(ProtobufMutator_BUILD_PATH ${ProtobufMutator_PATH}-build)
-    set(ProtobufMutator_INCLUDE_DIR ${ProtobufMutator_PATH})
-    set(ProtobufMutator_LIBRARIES ${ProtobufMutator_BUILD_PATH}/src/libfuzzer/libprotobuf-mutator-libfuzzer.a ${ProtobufMutator_BUILD_PATH}/src/libprotobuf-mutator.a)
-
-    ExternalProject_Add(
-        ${ProtobufMutator_PREFIX}
-        PREFIX ${ProtobufMutator_PREFIX}
-        GIT_REPOSITORY https://github.com/google/libprotobuf-mutator.git
-        GIT_TAG 57928f41ae52bb27666aa15b310130d086dac245  # v1.4-16-g57928f4
-        CMAKE_ARGS -DCMAKE_BUILD_TYPE=${CMAKE_BUILD_TYPE}
-        CMAKE_CACHE_ARGS
-            -DCMAKE_C_COMPILER:FILEPATH=${CMAKE_C_COMPILER}
-            -DCMAKE_CXX_COMPILER:FILEPATH=${CMAKE_CXX_COMPILER}
-            -DLIB_PROTO_MUTATOR_EXAMPLES:BOOL=OFF
-            -DLIB_PROTO_MUTATOR_TESTING:BOOL=OFF
-        BUILD_BYPRODUCTS ${ProtobufMutator_LIBRARIES}
-        UPDATE_COMMAND true
-        INSTALL_COMMAND true)
-
-    # Check for availability of protobuf compiler to avoid hard-to-understand
-    # errors from make(1) down the line as seen with CMake 3.25.1 on Debian
-    if(NOT Protobuf_PROTOC_EXECUTABLE)
-        message(SEND_ERROR
-            "The protobuf compiler (protoc) could not be found. "
-            "Is it installed and working properly?")
-    endif()
-
-    protobuf_generate_cpp(XML_LPM_FUZZER_PROTO_SRCS
-                          XML_LPM_FUZZER_PROTO_HDRS
-                          fuzz/xml_lpm_fuzzer.proto)
-
-    add_executable(xml_lpm_fuzzer
-                   fuzz/xml_lpm_fuzzer.cpp
-                   ${XML_LPM_FUZZER_PROTO_SRCS})
-    target_include_directories(xml_lpm_fuzzer PUBLIC ${ProtobufMutator_INCLUDE_DIR})
-    target_link_libraries(xml_lpm_fuzzer
-                          fuzzpat
-                          ${ProtobufMutator_LIBRARIES}
-                          ${Protobuf_LIBRARIES})
-    add_dependencies(xml_lpm_fuzzer ${ProtobufMutator_PREFIX})
-
-    if(EXPAT_OSSFUZZ_BUILD)
-        target_link_options(xml_lpm_fuzzer PRIVATE $ENV{LIB_FUZZING_ENGINE})
-    else()
-        target_compile_options(xml_lpm_fuzzer PRIVATE -fsanitize=fuzzer)
-        target_link_options(xml_lpm_fuzzer PRIVATE -fsanitize=fuzzer)
-    endif()
-    set_property(TARGET xml_lpm_fuzzer PROPERTY RUNTIME_OUTPUT_DIRECTORY fuzz)
 else()
     if(EXPAT_OSSFUZZ_BUILD)
         message(SEND_ERROR
-                "Attempting to perform an OSS-Fuzz build without turning on the fuzzer build. "
+                "Attempting to perform an ossfuzz build without turning on the fuzzer build. "
                 "This is likely in error - consider adding "
                 "-DEXPAT_BUILD_FUZZERS=ON to your cmake execution.")
     endif()
@@ -867,11 +709,7 @@ endif()
 # C/C++ config affecting multiple targets
 #
 if(WIN32)
-    set(_EXPAT_STATIC_TARGETS "")  # intended as "empty list"
-
-    if(EXPAT_BUILD_TESTS)
-        list(APPEND _EXPAT_STATIC_TARGETS runtests)
-    endif()
+    set(_EXPAT_STATIC_TARGETS ${_EXPAT_TEST_TARGETS})
     if(NOT EXPAT_SHARED_LIBS)
         list(APPEND _EXPAT_STATIC_TARGETS expat)
     endif()
@@ -1014,12 +852,16 @@ elseif(EXPAT_CHAR_TYPE STREQUAL "wchar_t")
 else()
     set(_EXPAT_CHAR_TYPE_SUMMARY "ERROR")
 endif()
-get_property(_EXPAT_GENERATOR_IS_MULTI_CONFIG GLOBAL PROPERTY GENERATOR_IS_MULTI_CONFIG)
+# NOTE: We're not accessing global property GENERATOR_IS_MULTI_CONFIG
+#       because that would require CMake >=3.9
+if(CMAKE_CONFIGURATION_TYPES)
+    set(_EXPAT_GENERATOR_IS_MULTI_CONFIG TRUE)
+else()
+    set(_EXPAT_GENERATOR_IS_MULTI_CONFIG FALSE)
+endif()
 
 message(STATUS "===========================================================================")
 message(STATUS "")
-message(STATUS "CMake version in use ......... ${CMAKE_VERSION}")
-message(STATUS "")
 message(STATUS "Configuration")
 message(STATUS "  Generator .................. ${CMAKE_GENERATOR}")
 if(_EXPAT_GENERATOR_IS_MULTI_CONFIG)
@@ -1050,7 +892,6 @@ message(STATUS "    // Advanced options, changes not advised")
 message(STATUS "    Attributes info .......... ${EXPAT_ATTR_INFO}")
 message(STATUS "    Context bytes ............ ${EXPAT_CONTEXT_BYTES}")
 message(STATUS "    DTD support .............. ${EXPAT_DTD}")
-message(STATUS "    General entities ......... ${EXPAT_GE}")
 message(STATUS "    Large size ............... ${EXPAT_LARGE_SIZE}")
 message(STATUS "    Minimum size ............. ${EXPAT_MIN_SIZE}")
 message(STATUS "    Namespace support ........ ${EXPAT_NS}")
@@ -1059,12 +900,10 @@ message(STATUS "  Entropy sources")
 if(WIN32)
     message(STATUS "    rand_s ................... ON")
 else()
-    message(STATUS "    arc4random ............... ${HAVE_ARC4RANDOM}")
-    message(STATUS "    arc4random_buf ........... ${HAVE_ARC4RANDOM_BUF}")
-    message(STATUS "    getentropy ............... ${HAVE_GETENTROPY}")
     message(STATUS "    getrandom ................ ${HAVE_GETRANDOM}")
     message(STATUS "    syscall SYS_getrandom .... ${HAVE_SYSCALL_GETRANDOM}")
-    message(STATUS "    /dev/urandom ............. ${EXPAT_DEV_URANDOM}")
+    message(STATUS "    libbsd ................... ${EXPAT_WITH_LIBBSD}")
+    message(STATUS "    /dev/random .............. ${EXPAT_DEV_URANDOM}")
 endif()
 message(STATUS "")
 if(CMAKE_GENERATOR STREQUAL "Unix Makefiles")

expat/COPYING

@@ -1,5 +1,5 @@
 Copyright (c) 1998-2000 Thai Open Source Software Center Ltd and Clark Cooper
-Copyright (c) 2001-2025 Expat maintainers
+Copyright (c) 2001-2022 Expat maintainers
 
 Permission is hereby granted, free of charge, to any person obtaining
 a copy of this software and associated documentation files (the

expat/Changes

@@ -1,834 +1,15 @@
-                           __  __            _
-                        ___\ \/ /_ __   __ _| |_
-                       / _ \\  /| '_ \ / _` | __|
-                      |  __//  \| |_) | (_| | |_
-                       \___/_/\_\ .__/ \__,_|\__|
-                                |_| XML parser
-
-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-!! <blink>Expat is UNDERSTAFFED and WITHOUT FUNDING.</blink>                 !!
-!!                 ~~~~~~~~~~~~                                              !!
-!! The following topics need *additional skilled C developers* to progress   !!
-!! in a timely manner or at all (loosely ordered by descending priority):    !!
-!!                            _______________________                        !!
-!! - teaming up on fixing the UNFIXED SECURITY ISSUES listed at:             !!
-!!                            """""""""""""""""""""""                        !!
-!!   https://github.com/libexpat/libexpat/issues/1160                        !!
-!!                                                                           !!
-!! - teaming up on researching and fixing future security reports and        !!
-!!   ClusterFuzz findings with few-days-max response times in communication  !!
-!!   in order to (1) have a sound fix ready before the end of a 90 days      !!
-!!   grace period and (2) in a sustainable manner,                           !!
-!!                                                                           !!
-!! - implementing and auto-testing XML 1.0r5 support                         !!
-!!   (needs discussion before pull requests),                                !!
-!!                                                                           !!
-!! For details, please reach out via e-mail to sebastian@pipping.org so we   !!
-!! can schedule a voice call on the topic, in English or German.             !!
-!!                                                                           !!
-!! THANK YOU!                        Sebastian Pipping -- Berlin, 2026-03-17 !!
-!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
-
-Release 2.8.2 Thu June 25 2026
-        Security fixes:
-           #1246  CVE-2026-50219 -- Disallow calls to functions
-                    `XML_GetBuffer`, `XML_Parse`, `XML_ParseBuffer`,
-                    `XML_ParserFree`, `XML_ParserReset` to guard e.g.
-                    Expat bindings from memory corruption;
-                    this CPython issue is related:
-                    https://github.com/python/cpython/issues/146169
-           #1267  CVE-2026-56131 -- Protect XML_ResumeParser from being called
-                                    from a handler, plugging a hole in the fix
-                                    to CVE-2026-50219
-           #1272  CVE-2026-56132 -- Fix out-of-bound scaffolding index store
-                                    in `doProlog`
-     #1229 #1232  CVE-2026-56403 -- Integer overflow in `storeAtts`
-           #1249  CVE-2026-56404 -- Integer overflow in `addBinding`
-           #1251  CVE-2026-56405 -- Integer overflow in `getAttributeId`
-           #1255  CVE-2026-56406 -- Integer overflow in `XML_ParseBuffer`
-           #1262  CVE-2026-56407 -- Integer overflow in `textLen` handling
-            #565  CVE-2026-56408 -- Integer overflow in `copyString`
-                    (commit 16e2efd867ea8567ffa012210b52ef5918e20817)
-           #1259  CVE-2026-56409 -- xmlwf: Integer overflow in output path join
-           #1252  CVE-2026-56410 -- xmlwf: Integer overflow in
-                    `resolveSystemId`
-           #1263  CVE-2026-56411 -- xmlwf: Integer overflow in notation list
-                    allocation
-           #1278  CVE-2026-56412 -- Guard XML_TOK_DATA_CHARS handler calls in
-                    `doCdataSection`, plugging a hole in the fix to
-                    CVE-2026-50219
-
-        Bug fixes:
-           #1260  xmlwf: Escape names and base URI in meta output
-           #1266  xmlwf: Pick a safe quote for notation system and public IDs
+NOTE: We are looking for help with a few things:
+      https://github.com/libexpat/libexpat/labels/help%20wanted
+      If you can help, please get in touch.  Thanks!
 
+Release 2.5.1 xxx xxxxxxx xx xxxx
         Other changes:
-           #1257  CMake|Autotools: Stop using /dev/urandom by default
-     #1244 #1254  CMake: Fix guard for Unix sources of entropy
-     #1183 #1270  CMake|Windows: Add missing export for symbol
-                                 `XML_SetHashSalt16Bytes`
-           #1236  CMake: Mark option EXPAT_OSSFUZZ_BUILD as advanced
-           #1283  Limit output indentation for EXPAT_ENTITY_DEBUG=1 and
-                    allow unlimited indentation via EXPAT_ENTITY_DEBUG=2
-            #565  Replace some loops by use of `memcpy`, `strlen`, `wcslen`
-           #1220  lib: Use a size_t for group sizes
-           #1221  lib: Fix too-conservative integer overflow check when
-                       appending raw name
-           #1222  lib: Simplify attribute allocation/management logic
-           #1224  Update fallthrough annotations to satisfy Clang and GCC
-           #1226  lib: Remove unnecessary void * casts in random code
-           #1228  lib: Reduce scope of locals in storeAtts
-           #1230  lib: Count attributes with size_t variables
-           #1238  Minor get-buffer improvements
-     #1239 #1240  lib|tests: Include header expat_config.h first
-           #1241  lib: Shrink size of XML_GetBuffer
-           #1242  lib: Remove a legacy comment
-           #1243  lib: XML_ParserReset: Extract repeated linked-list move logic
-           #1243  lib: Unify entity free lists
-           #1247  lib: Fix use of '0' as boolean literal
-           #1248  lib: Make XML_Index overflow check more intuitive
-           #1256  lib: Use size_t for counting string/URI lengths
-           #1258  lib: XML_GetInputContext: Remove use of 0 for NULL
-           #1261  Comment typo fixes
-           #1275  Teach Memory Sanitizer semantics of randomization functions
-     #1276 #1281  Version info bumped from 13:1:12 (libexpat*.so.1.12.1)
-                    to 13:2:12 (libexpat*.so.1.12.2); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-           #1231  perl-integration.yml: Bump to XML::Parser 2.59
-           #1237  emscripten.yml: Bump from Ubuntu 22.04 to 24.04
-     #1183 #1271  windows-build.yml: Cover completeness of file
-                                     libexpat.def.cmake
-           #1274  linux.yml: Make llvm-symbolizer available in CI
-
-        Special thanks to:
-            Alessandro Gario
-            Asher Darden
-            Christoph Reiter
-            Haris Hussain
-            Matthew Fernandez
-            Kartik Kenchi
-            Nick Begg
-            Sajin S
-            Yousef Shanableh
-                 and
-            Anthropic
-            Astra Security
-            Trail of Bits
-
-Release 2.8.1 Sun May 10 2026
-        Security fixes:
-           #1216  CVE-2026-45186 -- Fix quadratic runtime from attribute name
-                    collision checks that allowed denial of service attacks
-                    through moderately sized crafted XML input (CWE-407).
-                    Please note that a layer of compression around XML can
-                    significantly reduce the minimum attack payload size.
-
-        Other changes:
-     #1209 #1213  Drop more casts related to `void *` that C99 does not need
-           #1213  xmlwf: Streamline use of `mmap`
-     #1214 #1217  Version info bumped from 13:0:12 (libexpat*.so.1.12.0)
-                    to 13:1:12 (libexpat*.so.1.12.1); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-           #1210  CI: Cover compilation with Visual Studio 18 2026 on Windows
-           #1215  CI: Cover compilation for ARM64 on Windows
-           #1212  CI: Bump WASI SDK from 32 to 33
-
-        Special thanks to:
-            Berkay Eren Ürün
-            Matthew Fernandez
-            Nick Wellnhofer
-            Tania Somanna
-
-Release 2.8.0 Fri April 24 2026
-        Security fixes:
-       #47 #1183  CVE-2026-41080 -- The existing hash flooding protection
-                    (based on SipHash) only used 4 to 8 bytes of entropy for
-                    a salt, when 16 bytes of salt are supported by the
-                    implementation of SipHash used by Expat. Now full 16 bytes
-                    of entropy are used to improve protection against hash
-                    flooding attacks.
-                      Existing API function XML_SetHashSalt is now deprecated
-                    because of its limitations, and its use should be
-                    considered a vulnerability. Please either use the new API
-                    function XML_SetHashSalt16Bytes (with known-high-quality
-                    entropy input only!) instead, or leave the derivation of
-                    a 16-bytes hash salt from high quality entropy to Expat's
-                    internal machinery (by *not* calling either of the two
-                    XML_SetHashSalt* functions).
-
-        Bug fixes:
-           #1188  Avoid propagating /dev/urandom file descriptor to child
-                    processes
-           #1193  Fix interpretation of `errno` after randomization calls
-           #1195  Avoid assuming uint8_t is a character type
-
-        Other changes:
-     #1180 #1199  Add support for `getentropy(3)` as a source of entropy;
-                    this helps with protecting against hash flooding attacks,
-                    in particular with WASI SDK (where none of the other
-                    entropy sources supported by libexpat are available).
-           #1200  Autotools: Add `--without-arc4random` and
-                    `--without-arc4random-buf`
-           #1200  Autotools: Make `./configure` output report on available
-                    high quality entropy sources
-           #1173  Autotools|macOS: Sync CMake templates with CMake 4.3.0
-           #1201  Autotools|CMake: Improve checks for `arc4random` and
-                    `arc4random_buf` e.g. with modern glibc
-           #1201  CMake: Report on availability of functions `arc4random` and
-                    `arc4random_buf`
-           #1201  CMake: Mark entropy related build switches as advanced
-        #1189 ..
-     #1203 #1204  Extract new files from entropy extraction code
-           #1194  Stop duplicating C tests 1:1 as C++ ("runtests_cxx")
-           #1202  Fix a comment typo in expat_external.h
-           #1187  Fix grammar in compile error message
-           #1192  examples: Build warning-free with -Wwrite-strings
-           #1171  tests: Address harmless warning from Coverity
-     #1170 #1176  Sync file headers
-     #1190 #1206  Version info bumped from 12:3:11 (libexpat*.so.1.11.3)
-                    to 13:0:12 (libexpat*.so.1.12.0); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-  #1166 #1167 ..
-  #1172 #1175 ..
-  #1178 #1179 ..
-     #1185 #1205  CI: Make Perl XML::Parser integration tests run against
-                    both version 2.47 and the latest release 2.58
-           #1169  CI: Adapt to breaking changes regarding Inno Setup
-           #1173  CI: Adapt to breaking changes regarding CMake
-           #1174  CI: Include public corpus of fuzzer `xml_lpm_fuzzer` with
-                    regression testing
-     #1181 #1182  CI: Bump WASI SDK from 30 to 32
-
-        Special thanks to:
-            Jérôme Duval
-            Matthew Fernandez
-
-Release 2.7.5 Tue March 17 2026
-        Security fixes:
-           #1158  CVE-2026-32776 -- Fix NULL function pointer dereference for
-                    empty external parameter entities; it takes use of both
-                    functions XML_ExternalEntityParserCreate and
-                    XML_SetParamEntityParsing for an application to be
-                    vulnerable.
-     #1161 #1162  CVE-2026-32777 -- Protect from XML_TOK_INSTANCE_START
-                    infinite loop in function entityValueProcessor; it takes
-                    use of both functions XML_ExternalEntityParserCreate and
-                    XML_SetParamEntityParsing for an application to be
-                    vulnerable.
-           #1163  CVE-2026-32778 -- Fix NULL dereference in function setContext
-                    on retry after an earlier ouf-of-memory condition; it takes
-                    use of function XML_ParserCreateNS or XML_ParserCreate_MM
-                    for an application to be vulnerable.
-           #1160  Three more unfixed vulnerabilities left
-
-        Other changes:
-     #1146 #1147  Autotools: Fix condition for symbol versioning check, in
-                    particular when compiling with slibtool (not libtool)
-           #1156  Address Cppcheck >=2.20.0 warnings
-           #1153  tests: Make test_buffer_can_grow_to_max work for MinGW on
-                    Ubuntu 24.04
-     #1157 #1159  Version info bumped from 12:2:11 (libexpat*.so.1.11.2)
-                    to 12:3:11 (libexpat*.so.1.11.3); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-           #1148  CI: Fix FreeBSD and Solaris CI
-           #1149  CI: Bump to WASI SDK 30
-           #1153  CI: Adapt to breaking changes with Ubuntu 22.04
-           #1156  CI: Adapt to breaking changes in Cppcheck
-
-        Special thanks to:
-            Berkay Eren Ürün
-            Christian Ng
-            Fabio Scaccabarozzi
-            Francesco Bertolaccini
-            Mark Brand
-            Rhodri James
-                 and
-            AddressSanitizer
-            Buttercup
-            OSS-Fuzz / ClusterFuzz
-            Trail of Bits
-
-Release 2.7.4 Sat January 31 2026
-        Security fixes:
-           #1131  CVE-2026-24515 -- Function XML_ExternalEntityParserCreate
-                    failed to copy the encoding handler data passed to
-                    XML_SetUnknownEncodingHandler from the parent to the new
-                    subparser. This can cause a NULL dereference (CWE-476) from
-                    external entities that declare use of an unknown encoding.
-                    The expected impact is denial of service. It takes use of
-                    both functions XML_ExternalEntityParserCreate and
-                    XML_SetUnknownEncodingHandler for an application to be
-                    vulnerable.
-           #1075  CVE-2026-25210 -- Add missing check for integer overflow
-                    related to buffer size determination in function doContent
-
-        Bug fixes:
-           #1073  lib: Fix missing undoing of group size expansion in doProlog
-                    failure cases
-           #1107  xmlwf: Fix a memory leak
-           #1104  WASI: Fix format specifiers for 32bit WASI SDK
-
-        Other changes:
-           #1105  lib: Fix strict aliasing
-           #1106  lib: Leverage feature "flexible array member" of C99
-           #1051  lib: Swap (size_t)(-1) for C99 equivalent SIZE_MAX
-           #1109  lib|xmlwf: Return NULL instead of 0 for pointers
-           #1068  lib|Windows: Clean up use of macro _MSC_EXTENSIONS with MSVC
-           #1112  lib: Remove unused import
-           #1110  xmlwf: Warn about XXE in --help output (and man page)
-     #1102 #1103  WASI: Stop using getpid
-     #1113 #1130  Autotools: Drop file expat.m4 that provided obsolete Autoconf
-                    macro AM_WITH_EXPAT
-           #1123  Autotools: Limit -Wno-pedantic-ms-format to MinGW
-  #1129 #1134 ..
-           #1087  Autotools|macOS: Sync CMake templates with CMake 4.0
-     #1139 #1140  Autotools|CMake: Introduce off-by-default symbol versioning
-                    The related build system flags are:
-                    - For Autotools, configure with --enable-symbol-versioning
-                    - For CMake, configure with -DEXPAT_SYMBOL_VERSIONING=ON
-                    Please double-check for consequences before activating
-                    this inside distro packaging. Bug reports welcome!
-           #1117  Autotools|CMake: Remove libbsd support
-           #1105  Autotools|CMake: Stop using -fno-strict-aliasing, and use
-                    -Wstrict-aliasing=3 instead
-           #1124  Autotools|CMake: Prefer command gsed (GNU sed) over sed
-                    (e.g. for Solaris) inside fix-xmltest-log.sh
-           #1067  CMake: Detect and warn about unusable check_c_compiler_flag
-           #1137  CMake: Drop support for CMake <3.17
-           #1138  CMake|Windows: Fix libexpat.def.cmake version comments
-
-     #1086 #1110  docs: Add warning about external reference handlers and XXE
-           #1066  docs: Be explicit that parent parsers need to outlive
-                    subparsers
-        #1089 ..
-  #1090 #1091 ..
-  #1092 #1093 ..
-  #1094 #1098 ..
-     #1115 #1116  docs: Misc non-content improvements to doc/reference.html
-     #1132 #1133  Version info bumped from 12:1:11 (libexpat*.so.1.11.1)
-                    to 12:2:11 (libexpat*.so.1.11.2); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-     #1119 #1121  Document guidelines for contributing to Expat
-           #1120  Introduce a pull request template
-           #1074  CI: Stop using about-to-be-removed image "macos-13"
-     #1083 #1088  CI: Mitigate random Wine crashes
-           #1104  CI: Cover compilation with WASI SDK
-           #1116  CI: Enforce clean doc XML formatting
-        #1124 ..
-     #1135 #1136  CI: Cover Solaris 11.4
-           #1125  CI: Extend CI coverage of FreeBSD
-     #1139 #1140  CI: Cover symbol versioning
-           #1114  xmlwf: Reformat helpgen code (using Black 25.12.0)
-           #1071  .gitignore: Add files CPackConfig.cmake and
-                    CPackSourceConfig.cmake
-
-        Special thanks to:
-            Alfonso Gregory
-            Bénédikt Tran
-            Gordon Messmer
-            Hanno Böck
-            Jakub Kulík
-            Matthew Fernandez
-            Neil Pang
-            Rosen Penev
-                 and
-            Artiphishell Inc.
-
-Release 2.7.3 Wed September 24 2025
-        Security fixes:
-     #1046 #1048  Fix alignment of internal allocations for some non-amd64
-                    architectures (e.g. sparc32); fixes up on the fix to
-                    CVE-2025-59375 from #1034 (of Expat 2.7.2 and related
-                    backports)
-           #1059  Fix a class of false positives where input should have been
-                    rejected with error XML_ERROR_ASYNC_ENTITY; regression from
-                    CVE-2024-8176 fix pull request #973 (of Expat 2.7.0 and
-                    related backports). Please check the added unit tests for
-                    example documents.
-
-        Other changes:
-           #1043  Prove and regression-proof absence of integer overflow
-                    from function expat_realloc
-           #1062  Remove "harmless" cast that truncated a size_t to unsigned
-           #1049  Autotools: Remove "ln -s" discovery
-           #1054  docs: Be consistent with use of floating point around
-                    XML_SetAllocTrackerMaximumAmplification
-           #1056  docs: Make it explicit that XML_GetCurrentColumnNumber
-                    starts at 0
-           #1057  docs: Better integrate the effect of the activation
-                    thresholds
-           #1058  docs: Fix an in-comment typo in expat.h
-           #1045  docs: Fix a typo in README.md
-           #1041  docs: Improve change log of release 2.7.2
-           #1053  xmlwf: Resolve use of functions XML_GetErrorLineNumber
-                    and XML_GetErrorColumnNumber
-           #1032  Windows: Normalize .bat files to CRLF line endings
-     #1060 #1061  Version info bumped from 12:0:11 (libexpat*.so.1.11.0)
-                    to 12:1:11 (libexpat*.so.1.11.1); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-     #1047 #1050  CI: Cleanup UndefinedBehaviorSanitizer fatality
-           #1044  CI|Linux: Stop aborting at first job failure
-           #1052  CI|FreeBSD: Upgrade to FreeBSD 15.0
-           #1039  CI|FreeBSD: Do not install CMake meta-package
-
-        Special thanks to:
-            Bénédikt Tran
-            Berkay Eren Ürün
-            Daniel Engberg
-            Hanno Böck
-            Matthew Fernandez
-            Rolf Eike Beer
-            Sam James
-            Tim Bray
-                 and
-            Clang/GCC UndefinedBehaviorSanitizer
-            OSS-Fuzz / ClusterFuzz
-            Z3 Theorem Prover
-
-Release 2.7.2 Tue September 16 2025
-        Security fixes:
-     #1018 #1034  CVE-2025-59375 -- Disallow use of disproportional amounts of
-                    dynamic memory from within an Expat parser (e.g. previously
-                    a ~250 KiB sized document was able to cause allocation of
-                    ~800 MiB from the heap, i.e. an "amplification" of factor
-                    ~3,300); once a threshold (that defaults to 64 MiB) is
-                    reached, a maximum amplification factor (that defaults to
-                    100.0) is enforced, and violating documents are rejected
-                    with an out-of-memory error.
-                    There are two new API functions to fine-tune this new
-                    behavior:
-                      - XML_SetAllocTrackerActivationThreshold
-                      - XML_SetAllocTrackerMaximumAmplification .
-                    If you ever need to increase these defaults for non-attack
-                    XML payload, please file a bug report with libexpat.
-                      There is also a new environment variable
-                    EXPAT_MALLOC_DEBUG=(0|1|2) to control the verbosity
-                    of allocations debugging at runtime, disabled by default.
-                      Known impact is (reliable and easy) denial of service:
-                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
-                    (Base Score: 7.5, Temporal Score: 7.2)
-                    Please note that a layer of compression around XML can
-                    significantly reduce the minimum attack payload size.
-                      Distributors intending to backport (or cherry-pick) the
-                    fix need to copy 99% of the related pull request, not just
-                    the "lib: Implement tracking of dynamic memory allocations"
-                    commit, to not end up with a state that literally does both
-                    too much and too little at the same time. Appending ".diff"
-                    to the pull request URL could be of help.
-
-        Other changes:
-     #1008 #1017  Autotools|macOS: Sync CMake templates with CMake 3.31
-           #1007  CMake: Drop support for CMake <3.15
-           #1004  CMake: Fix off_t detection for -Werror
-           #1007  CMake|Windows: Fix -DEXPAT_MSVC_STATIC_CRT=ON
-           #1013  Windows: Drop support for Visual Studio <=16.0/2019
-           #1026  xmlwf: Mention supported environment variables in
-                    --help output
-           #1024  xmlwf: Fix (internal) help generator
-           #1034  docs: Promote the contract to call function
-                    XML_FreeContentModel when registering a custom
-                    element declaration handler (via a call to function
-                    XML_SetElementDeclHandler)
-           #1027  docs: Add missing <p>..</p> wrap
-            #994  docs: Drop AppVeyor badge
-           #1000  tests: Fix portable_strndup
-           #1036  Drop casts around malloc/free/realloc that C99 does not need
-           #1010  Replace empty for loops with while loops
-           #1011  Add const with internal XmlInitUnknownEncodingNS
-       #14 #1037  Drop an OpenVMS support leftover
-      #999 #1001  Address more clang-tidy warnings
-     #1030 #1038  Version info bumped from 11:2:10 (libexpat*.so.1.10.2)
-                    to 12:0:11 (libexpat*.so.1.11.0); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-           #1003  CI: Cover compilation on FreeBSD
-     #1009 #1035  CI: Upgrade Clang from 19 to 21
-           #1031  CI: Make calling Cppcheck without --suppress=objectIndex
-                    and --suppress=unknownMacro possible
-           #1013  CI|Windows: Get off of deprecated image "windows-2019"
-  #1008 #1017 ..
-     #1023 #1025  CI: Adapt to breaking changes in GitHub Actions
-
-        Special thanks to:
-            Alexander Bluhm
-            Neil Pang
-            Theo Buehler
-                 and
-            GNU Time
-            OSS-Fuzz / ClusterFuzz
-            Perl XML::Parser
-
-Release 2.7.1 Thu March 27 2025
-        Bug fixes:
-       #980 #989  Restore event pointer behavior from Expat 2.6.4
-                    (that the fix to CVE-2024-8176 changed in 2.7.0);
-                    affected API functions are:
-                    - XML_GetCurrentByteCount
-                    - XML_GetCurrentByteIndex
-                    - XML_GetCurrentColumnNumber
-                    - XML_GetCurrentLineNumber
-                    - XML_GetInputContext
-
-        Other changes:
-       #976 #977  Autotools: Integrate files "fuzz/xml_lpm_fuzzer.{cpp,proto}"
-                    with Automake that were missing from 2.7.0 release tarballs
-       #983 #984  Fix printf format specifiers for 32bit Emscripten
-            #992  docs: Promote OpenSSF Best Practices self-certification
-            #978  tests/benchmark: Resolve mistaken double close
-            #986  Address Frama-C warnings
-       #990 #993  Version info bumped from 11:1:10 (libexpat*.so.1.10.1)
-                    to 11:2:10 (libexpat*.so.1.10.2); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-            #982  CI: Start running Perl XML::Parser integration tests
-            #987  CI: Enforce Clang Static Analyzer clean code
-            #991  CI: Re-enable warning clang-analyzer-valist.Uninitialized
-                    for clang-tidy
-            #981  CI: Cover compilation with musl
-       #983 #984  CI: Cover compilation with 32bit Emscripten
-       #976 #977  CI: Protect against fuzzer files missing from future
-                    release archives
-
-        Special thanks to:
-            Berkay Eren Ürün
-            Matthew Fernandez
-                 and
-            Perl XML::Parser
-
-Release 2.7.0 Thu March 13 2025
-        Security fixes:
-       #893 #973  CVE-2024-8176 -- Fix crash from chaining a large number
-                    of entities caused by stack overflow by resolving use of
-                    recursion, for all three uses of entities:
-                    - general entities in character data ("<e>&g1;</e>")
-                    - general entities in attribute values ("<e k1='&g1;'/>")
-                    - parameter entities ("%p1;")
-                    Known impact is (reliable and easy) denial of service:
-                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:H/RL:O/RC:C
-                    (Base Score: 7.5, Temporal Score: 7.2)
-                    Please note that a layer of compression around XML can
-                    significantly reduce the minimum attack payload size.
-
-        Other changes:
-       #935 #937  Autotools: Make generated CMake files look for
-                    libexpat.@SO_MAJOR@.dylib on macOS
-            #925  Autotools: Sync CMake templates with CMake 3.29
-  #945 #962 #966  CMake: Drop support for CMake <3.13
-            #942  CMake: Small fuzzing related improvements
-            #921  docs: Add missing documentation of error code
-                    XML_ERROR_NOT_STARTED that was introduced with 2.6.4
-            #941  docs: Document need for C++11 compiler for use from C++
-            #959  tests/benchmark: Fix a (harmless) TOCTTOU
-            #944  Windows: Fix installer target location of file xmlwf.xml
-                    for CMake
-            #953  Windows: Address warning -Wunknown-warning-option
-                    about -Wno-pedantic-ms-format from LLVM MinGW
-            #971  Address Cppcheck warnings
-       #969 #970  Mass-migrate links from http:// to https://
-    #947 #958 ..
-       #974 #975  Document changes since the previous release
-       #974 #975  Version info bumped from 11:0:10 (libexpat*.so.1.10.0)
-                    to 11:1:10 (libexpat*.so.1.10.1); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-            #926  tests: Increase robustness
-    #927 #932 ..
-       #930 #933  tests: Increase test coverage
-    #617 #950 ..
-    #951 #952 ..
-    #954 #955 ..  Fuzzing: Add new fuzzer "xml_lpm_fuzzer" based on
-            #961    Google's libprotobuf-mutator ("LPM")
-            #957  Fuzzing|CI: Start producing fuzzing code coverage reports
-            #936  CI: Pass -q -q for LCOV >=2.1 in coverage.sh
-            #942  CI: Small fuzzing related improvements
-    #139 #203 ..
-       #791 #946  CI: Make GitHub Actions build using MSVC on Windows and
-                      produce 32bit and 64bit Windows binaries
-            #956  CI: Get off of about-to-be-removed Ubuntu 20.04
-       #960 #964  CI: Start uploading to Coverity Scan for static analysis
-            #972  CI: Stop loading DTD from the internet to address flaky CI
-            #971  CI: Adapt to breaking changes in Cppcheck
-
-        Special thanks to:
-            Alexander Gieringer
-            Berkay Eren Ürün
-            Hanno Böck
-            Jann Horn
-            Mark Brand
-            Sebastian Andrzej Siewior
-            Snild Dolkow
-            Thomas Pröll
-            Tomas Korbar
-            valord577
-                 and
-            Google Project Zero
-            Linutronix
-            Red Hat
-            Siemens
-
-Release 2.6.4 Wed November 6 2024
-        Security fixes:
-            #915  CVE-2024-50602 -- Fix crash within function XML_ResumeParser
-                    from a NULL pointer dereference by disallowing function
-                    XML_StopParser to (stop or) suspend an unstarted parser.
-                    A new error code XML_ERROR_NOT_STARTED was introduced to
-                    properly communicate this situation.  // CWE-476 CWE-754
-
-        Other changes:
-            #903  CMake: Add alias target "expat::expat"
-            #905  docs: Document use via CMake >=3.18 with FetchContent
-                    and SOURCE_SUBDIR and its consequences
-            #902  tests: Reduce use of global parser instance
-            #904  tests: Resolve duplicate handler
-       #317 #918  tests: Improve tests on doctype closing (ex CVE-2019-15903)
-            #914  Fix signedness of format strings
-            #915  For use from C++, expat.h started requiring C++11 due to
-                    use of C99 features
-       #919 #920  Version info bumped from 10:3:9 (libexpat*.so.1.9.3)
-                    to 11:0:10 (libexpat*.so.1.10.0); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-            #907  CI: Upgrade Clang from 18 to 19
-            #913  CI: Drop macos-12 and add macos-15
-            #910  CI: Adapt to breaking changes in GitHub Actions
-            #898  Add missing entries to .gitignore
-
-        Special thanks to:
-            Hanno Böck
-            José Eduardo Gutiérrez Conejo
-            José Ricardo Cardona Quesada
-
-Release 2.6.3 Wed September 4 2024
-        Security fixes:
-       #887 #890  CVE-2024-45490 -- Calling function XML_ParseBuffer with
-                    len < 0 without noticing and then calling XML_GetBuffer
-                    will have XML_ParseBuffer fail to recognize the problem
-                    and XML_GetBuffer corrupt memory.
-                    With the fix, XML_ParseBuffer now complains with error
-                    XML_ERROR_INVALID_ARGUMENT just like sibling XML_Parse
-                    has been doing since Expat 2.2.1, and now documented.
-                    Impact is denial of service to potentially artitrary code
-                    execution.
-       #888 #891  CVE-2024-45491 -- Internal function dtdCopy can have an
-                    integer overflow for nDefaultAtts on 32-bit platforms
-                    (where UINT_MAX equals SIZE_MAX).
-                    Impact is denial of service to potentially artitrary code
-                    execution.
-       #889 #892  CVE-2024-45492 -- Internal function nextScaffoldPart can
-                    have an integer overflow for m_groupSize on 32-bit
-                    platforms (where UINT_MAX equals SIZE_MAX).
-                    Impact is denial of service to potentially artitrary code
-                    execution.
-
-        Other changes:
-       #851 #879  Autotools: Sync CMake templates with CMake 3.28
-            #853  Autotools: Always provide path to find(1) for portability
-            #861  Autotools: Ensure that the m4 directory always exists.
-            #870  Autotools: Simplify handling of SIZEOF_VOID_P
-            #869  Autotools: Support non-GNU sed
-            #856  Autotools|CMake: Fix main() to main(void)
-            #865  Autotools|CMake: Fix compile tests for HAVE_SYSCALL_GETRANDOM
-            #863  Autotools|CMake: Stop requiring dos2unix
-       #854 #855  CMake: Fix check for symbols size_t and off_t
-            #864  docs|tests: Convert README to Markdown and update
-            #741  Windows: Drop support for Visual Studio <=15.0/2017
-            #886  Drop needless XML_DTD guards around is_param access
-            #885  Fix typo in a code comment
-       #894 #896  Version info bumped from 10:2:9 (libexpat*.so.1.9.2)
-                    to 10:3:9 (libexpat*.so.1.9.3); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-            #880  Readme: Promote the call for help
-            #868  CI: Fix various issues
-            #849  CI: Allow triggering GitHub Actions workflows manually
-    #851 #872 ..
-       #873 #879  CI: Adapt to breaking changes in GitHub Actions
-
-        Special thanks to:
-            Alexander Bluhm
-            Berkay Eren Ürün
-            Dag-Erling Smørgrav
-            Ferenc Géczi
-            TaiYou
-
-Release 2.6.2 Wed March 13 2024
-        Security fixes:
-       #839 #842  CVE-2024-28757 -- Prevent billion laughs attacks with
-                    isolated use of external parsers.  Please see the commit
-                    message of commit 1d50b80cf31de87750103656f6eb693746854aa8
-                    for details.
-
-        Bug fixes:
-       #839 #841  Reject direct parameter entity recursion
-                    and avoid the related undefined behavior
-
-        Other changes:
-            #847  Autotools: Fix build for DOCBOOK_TO_MAN containing spaces
-            #837  Add missing #821 and #824 to 2.6.1 change log
-       #838 #843  Version info bumped from 10:1:9 (libexpat*.so.1.9.1)
-                    to 10:2:9 (libexpat*.so.1.9.2); see https://verbump.de/
-                    for what these numbers do
-
-        Special thanks to:
-            Philippe Antoine
-            Tomas Korbar
-                 and
-            Clang UndefinedBehaviorSanitizer
-            OSS-Fuzz / ClusterFuzz
-
-Release 2.6.1 Thu February 29 2024
-        Bug fixes:
-            #817  Make tests independent of CPU speed, and thus more robust
-       #828 #836  Expose billion laughs API with XML_DTD defined and
-                    XML_GE undefined, regression from 2.6.0
-
-        Other changes:
-            #829  Hide test-only code behind new internal macro
-            #833  Autotools: Reject expat_config.h.in defining SIZEOF_VOID_P
-       #821 #824  Autotools: Fix "make clean" for case:
-                    ./configure --without-docbook && make clean all
-            #819  Address compiler warnings
-       #832 #834  Version info bumped from 10:0:9 (libexpat*.so.1.9.0)
-                    to 10:1:9 (libexpat*.so.1.9.1); see https://verbump.de/
-                    for what these numbers do
-
-        Infrastructure:
-            #818  CI: Adapt to breaking changes in clang-format
-
-        Special thanks to:
-            David Hall
-            Snild Dolkow
-
-Release 2.6.0 Tue February 6 2024
-        Security fixes:
-      #789 #814  CVE-2023-52425 -- Fix quadratic runtime issues with big tokens
-                   that can cause denial of service, in partial where
-                   dealing with compressed XML input.  Applications
-                   that parsed a document in one go -- a single call to
-                   functions XML_Parse or XML_ParseBuffer -- were not affected.
-                   The smaller the chunks/buffers you use for parsing
-                   previously, the bigger the problem prior to the fix.
-                   Backporters should be careful to no omit parts of
-                   pull request #789 and to include earlier pull request #771,
-                   in order to not break the fix.
-           #777  CVE-2023-52426 -- Fix billion laughs attacks for users
-                   compiling *without* XML_DTD defined (which is not common).
-                   Users with XML_DTD defined have been protected since
-                   Expat >=2.4.0 (and that was CVE-2013-0340 back then).
-
-        Bug fixes:
-            #753  Fix parse-size-dependent "invalid token" error for
-                    external entities that start with a byte order mark
-            #780  Fix NULL pointer dereference in setContext via
-                    XML_ExternalEntityParserCreate for compilation with
-                    XML_DTD undefined
-       #812 #813  Protect against closing entities out of order
-
-        Other changes:
-            #723  Improve support for arc4random/arc4random_buf
-       #771 #788  Improve buffer growth in XML_GetBuffer and XML_Parse
-       #761 #770  xmlwf: Support --help and --version
-       #759 #770  xmlwf: Support custom buffer size for XML_GetBuffer and read
-            #744  xmlwf: Improve language and URL clickability in help output
             #673  examples: Add new example "element_declarations.c"
-            #764  Be stricter about macro XML_CONTEXT_BYTES at build time
-            #765  Make inclusion to expat_config.h consistent
-       #726 #727  Autotools: configure.ac: Support --disable-maintainer-mode
-    #678 #705 ..
-  #706 #733 #792  Autotools: Sync CMake templates with CMake 3.26
-            #795  Autotools: Make installation of shipped man page doc/xmlwf.1
-                    independent of docbook2man availability
-            #815  Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
-                    section "Cflags.private" in order to fix compilation
-                    against static libexpat using pkg-config on Windows
-       #724 #751  Autotools|CMake: Require a C99 compiler
-                    (a de-facto requirement already since Expat 2.2.2 of 2017)
-            #793  Autotools|CMake: Fix PACKAGE_BUGREPORT variable
-       #750 #786  Autotools|CMake: Make test suite require a C++11 compiler
-            #749  CMake: Require CMake >=3.5.0
-            #672  CMake: Lowercase off_t and size_t to help a bug in Meson
-            #746  CMake: Sort xmlwf sources alphabetically
-            #785  CMake|Windows: Fix generation of DLL file version info
-            #790  CMake: Build tests/benchmark/benchmark.c as well for
-                    a build with -DEXPAT_BUILD_TESTS=ON
-       #745 #757  docs: Document the importance of isFinal + adjust tests
-                    accordingly
-            #736  docs: Improve use of "NULL" and "null"
-            #713  docs: Be specific about version of XML (XML 1.0r4)
-                    and version of C (C99); (XML 1.0r5 will need a sponsor.)
-            #762  docs: reference.html: Promote function XML_ParseBuffer more
-            #779  docs: reference.html: Add HTML anchors to XML_* macros
-            #760  docs: reference.html: Upgrade to OK.css 1.2.0
-       #763 #739  docs: Fix typos
-            #696  docs|CI: Use HTTPS URLs instead of HTTP at various places
-    #669 #670 ..
-    #692 #703 ..
-       #733 #772  Address compiler warnings
-       #798 #800  Address clang-tidy warnings
-       #775 #776  Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
-                    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
-                    for what these numbers do
+  #678 #706 #733  Autotools: Sync CMake templates with CMake 3.25
+            #565  Replace some loops by memcmp, memcpy, strlen, wcslen
 
         Infrastructure:
-       #700 #701  docs: Document security policy in file SECURITY.md
-            #766  docs: Improve parse buffer variables in-code documentation
-    #674 #738 ..
-    #740 #747 ..
-  #748 #781 #782  Refactor coverage and conformance tests
-       #714 #716  Refactor debug level variables to unsigned long
-            #671  Improve handling of empty environment variable value
-                    in function getDebugLevel (without visible user effect)
-    #755 #774 ..
-    #758 #783 ..
-       #784 #787  tests: Improve test coverage with regard to parse chunk size
-  #660 #797 #801  Fuzzing: Improve fuzzing coverage
-       #367 #799  Fuzzing|CI: Start running OSS-Fuzz fuzzing regression tests
        #698 #721  CI: Resolve some Travis CI leftovers
-            #669  CI: Be robust towards absence of Git tags
-       #693 #694  CI: Set permissions to "contents: read" for security
-            #709  CI: Pin all GitHub Actions to specific commits for security
-            #739  CI: Reject spelling errors using codespell
-            #798  CI: Enforce clang-tidy clean code
-    #773 #808 ..
-       #809 #810  CI: Upgrade Clang from 15 to 18
-            #796  CI: Start using Clang's Control Flow Integrity sanitizer
-  #675 #720 #722  CI: Adapt to breaking changes in GitHub Actions Ubuntu images
-            #689  CI: Adapt to breaking changes in Clang/LLVM Debian packaging
-            #763  CI: Adapt to breaking changes in codespell
-            #803  CI: Adapt to breaking changes in Cppcheck
-
-        Special thanks to:
-            Ivan Galkin
-            Joyce Brum
-            Philippe Antoine
-            Rhodri James
-            Snild Dolkow
-            spookyahell
-            Steven Garske
-                 and
-            Clang AddressSanitizer
-            Clang UndefinedBehaviorSanitizer
-            codespell
-            GCC Farm Project
-            OSS-Fuzz
-            Sony Mobile
 
 Release 2.5.0 Tue October 25 2022
         Security fixes:
@@ -839,7 +20,7 @@ Release 2.5.0 Tue October 25 2022
                     arbitrary code execution.
 
         Bug fixes:
-       #612 #645  Fix corruption from undefined entities
+       #612 #645  Fix curruption from undefined entities
        #613 #654  Fix case when parsing was suspended while processing nested
                     entities
   #616 #652 #653  Stop leaking opening tag bindings after a closing tag
@@ -1146,7 +327,7 @@ Release 2.4.2 Sun December 19 2021
                     see https://verbump.de/ for what these numbers do
 
         Special thanks to:
-            Donghee Na
+            Dong-hee Na
             Joergen Ibsen
             Kai Pastor
 
@@ -1908,7 +1089,7 @@ Release 2.1.0 Sat March 24 2012
         - Bug Fixes:
           #1742315: Harmful XML_ParserCreateNS suggestion.
           #1785430: Expat build fails on linux-amd64 with gcc version>=4.1 -O3.
-          #1983953, 2517952, 2517962, 2649838:
+          #1983953, 2517952, 2517962, 2649838: 
                 Build modifications using autoreconf instead of buildconf.sh.
           #2815947, #2884086: OBJEXT and EXEEXT support while building.
           #2517938: xmlwf should return non-zero exit status if not well-formed.
@@ -1934,7 +1115,7 @@ Release 2.1.0 Sat March 24 2012
                 See bug #2990652 and patch #3312568.
           Added run-benchmark target to Makefile.in - relies on testdata module
                 present in the same relative location as in the repository.
-
+          
 Release 2.0.1 Tue June 5 2007
         - Fixed bugs #1515266, #1515600: The character data handler's calling
           of XML_StopParser() was not handled properly; if the parser was

expat/ConfigureChecks.cmake

@@ -22,29 +22,16 @@ check_symbol_exists("getpagesize" "unistd.h" HAVE_GETPAGESIZE)
 check_symbol_exists("mmap" "sys/mman.h" HAVE_MMAP)
 check_symbol_exists("getrandom" "sys/random.h" HAVE_GETRANDOM)
 
-check_c_source_compiles("
-    #if ! defined(_DEFAULT_SOURCE)
-    # define _DEFAULT_SOURCE 1 /* for glibc */
-    #endif
-    #include <stdlib.h>
-    int main(void) {
-      char dummy[123];
-      arc4random_buf(dummy, 0U);
-      return 0;
-    }"
-    HAVE_ARC4RANDOM_BUF)
-
-check_c_source_compiles("
-    #if ! defined(_DEFAULT_SOURCE)
-    # define _DEFAULT_SOURCE 1 /* for glibc */
-    #endif
-    #include <stdlib.h>
-    int main(void) {
-        arc4random();
-        return 0;
-    }"
-    HAVE_ARC4RANDOM)
-
+if(EXPAT_WITH_LIBBSD)
+    set(CMAKE_REQUIRED_LIBRARIES "${LIB_BSD}")
+    set(_bsd "bsd/")
+else()
+    set(_bsd "")
+endif()
+check_symbol_exists("arc4random_buf" "${_bsd}stdlib.h" HAVE_ARC4RANDOM_BUF)
+if(NOT HAVE_ARC4RANDOM_BUF)
+    check_symbol_exists("arc4random" "${_bsd}stdlib.h" HAVE_ARC4RANDOM)
+endif()
 set(CMAKE_REQUIRED_LIBRARIES)
 
 #/* Define to 1 if you have the ANSI C header files. */
@@ -59,72 +46,24 @@ else(WORDS_BIGENDIAN)
 endif(WORDS_BIGENDIAN)
 
 if(HAVE_SYS_TYPES_H)
-    check_c_source_compiles("
-        #include <sys/types.h>
-        int main(void) {
-            const off_t offset = -123;
-            (void)offset;
-            return 0;
-        }"
-        HAVE_OFF_T)
-endif()
-
-if(NOT HAVE_OFF_T)
+    check_symbol_exists("off_t" "sys/types.h" off_t)
+    check_symbol_exists("size_t" "sys/types.h" size_t)
+else(HAVE_SYS_TYPES_H)
     set(off_t "long")
-endif()
+    set(size_t "unsigned")
+endif(HAVE_SYS_TYPES_H)
 
 check_c_source_compiles("
-        // NOTE: Please keep this block in sync with its two siblings in files
-        //       `configure.ac` and `lib/random_getentropy.c`!
-        #if defined(__APPLE__)
-        #  include <sys/random.h>
-        #else
-        #  if defined(__GLIBC__) && ! defined(_DEFAULT_SOURCE)
-        #    define _DEFAULT_SOURCE 1
-        #  endif
-        #  if ! defined(_GNU_SOURCE)
-        #    define _GNU_SOURCE 1 /* for musl */
-        #  endif
-        #  include <unistd.h>
-        #endif // ! defined(__APPLE__)
-
-        int main(void) {
-            return getentropy(NULL, 0U);
-        }
-    "
-    HAVE_GETENTROPY)
-
-check_c_source_compiles("
-        #define _GNU_SOURCE
         #include <stdlib.h>  /* for NULL */
         #include <unistd.h>  /* for syscall */
         #include <sys/syscall.h>  /* for SYS_getrandom */
-        int main(void) {
+        int main() {
             syscall(SYS_getrandom, NULL, 0, 0);
             return 0;
         }"
     HAVE_SYSCALL_GETRANDOM)
 
-# If the compiler produces non-English messages and does not
-# listen to CMake's request for English through environment variables
-# LC_ALL/LC_MESSAGES/LANG, then command `check_c_compiler_flag` can produce
-# false positives as seen with e.g. `cl` of MSVC 19.44.35217 configured
-# to report errors in Italian language.
-check_c_compiler_flag("-no-such-thing" _FLAG_DETECTION_UNUSABLE)
-
-if (_FLAG_DETECTION_UNUSABLE)
-    message(WARNING
-        "Your compiler breaks CMake's command `check_c_compiler_flag`."
-        " HINT: Is it configured to report errors in a language other"
-        " than English?"
-    )
-    set(FLAG_WSTRICT_ALIASING FALSE)
-    set(FLAG_WIMPLICIT_FALLTHROUGH FALSE)
-    set(FLAG_VISIBILITY FALSE)
-else()
-    check_c_compiler_flag("-Wstrict-aliasing=3" FLAG_WSTRICT_ALIASING)
-    check_c_compiler_flag("-Wimplicit-fallthrough" FLAG_WIMPLICIT_FALLTHROUGH)
-    check_c_compiler_flag("-fvisibility=hidden" FLAG_VISIBILITY)
-endif()
+check_c_compiler_flag("-fno-strict-aliasing" FLAG_NO_STRICT_ALIASING)
+check_c_compiler_flag("-fvisibility=hidden" FLAG_VISIBILITY)
 
 check_library_exists(m cos "" _EXPAT_LIBM_FOUND)

expat/Makefile.am

@@ -6,12 +6,9 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2021 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2018      KangLin <kl222@126.com>
 # Copyright (c) 2022      Johnny Jazeix <jazeix@gmail.com>
-# Copyright (c) 2023      Sony Corporation / Snild Dolkow <snild@sony.com>
-# Copyright (c) 2024      Alexander Bluhm <alexander.bluhm@gmx.net>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -58,8 +55,10 @@ pkgconfig_DATA = expat.pc
 pkgconfigdir = $(libdir)/pkgconfig
 
 
+dist_cmake_DATA = \
+    cmake/autotools/expat.cmake
+
 nodist_cmake_DATA = \
-    cmake/autotools/expat.cmake \
     cmake/autotools/expat-config-version.cmake \
     cmake/autotools/expat-noconfig.cmake \
     cmake/expat-config.cmake
@@ -68,9 +67,6 @@ cmakedir = $(libdir)/cmake/expat-@PACKAGE_VERSION@
 
 
 _EXTRA_DIST_CMAKE = \
-    cmake/autotools/expat__linux.cmake.in \
-    cmake/autotools/expat__macos.cmake.in \
-    cmake/autotools/expat__windows.cmake.in \
     cmake/autotools/expat-noconfig__linux.cmake.in \
     cmake/autotools/expat-noconfig__macos.cmake.in \
     cmake/autotools/expat-noconfig__windows.cmake.in \
@@ -88,16 +84,15 @@ _EXTRA_DIST_WINDOWS = \
     win32/expat.iss \
     win32/MANIFEST.txt \
     win32/README.txt \
-    win32/version.rc.cmake
+    win32/version.rc
 
 EXTRA_DIST = \
     $(_EXTRA_DIST_CMAKE) \
     $(_EXTRA_DIST_WINDOWS) \
     \
+    conftools/expat.m4 \
     conftools/get-version.sh \
     \
-    fuzz/xml_lpm_fuzzer.cpp \
-    fuzz/xml_lpm_fuzzer.proto \
     fuzz/xml_parsebuffer_fuzzer.c \
     fuzz/xml_parse_fuzzer.c \
     \
@@ -118,10 +113,10 @@ buildlib:
 	@echo 'ERROR: is no longer supported.  INSTEAD please:' >&2
 	@echo 'ERROR:' >&2
 	@echo 'ERROR:  * Mass-patch Makefile.am, e.g.' >&2
-	@echo 'ERROR:    # find . -name Makefile.am -exec sed \' >&2
+	@echo 'ERROR:    # find -name Makefile.am -exec sed \' >&2
 	@echo 'ERROR:          -e "s,libexpat\.la,libexpatw.la," \' >&2
 	@echo 'ERROR:          -e "s,libexpat_la,libexpatw_la," \' >&2
-	@echo 'ERROR:          -i.bak {} +' >&2
+	@echo 'ERROR:          -i {} +' >&2
 	@echo 'ERROR:' >&2
 	@echo 'ERROR:  * Run automake to re-generate Makefile.in files' >&2
 	@echo 'ERROR:' >&2
@@ -136,11 +131,6 @@ buildlib:
 run-benchmark:
 	$(MAKE) -C tests/benchmark
 	./run.sh tests/benchmark/benchmark@EXEEXT@ -n $(top_srcdir)/../testdata/largefiles/recset.xml 65535 3
-	./run.sh tests/benchmark/benchmark@EXEEXT@ -n $(top_srcdir)/../testdata/largefiles/aaaaaa_attr.xml 4096 3
-	./run.sh tests/benchmark/benchmark@EXEEXT@ -n $(top_srcdir)/../testdata/largefiles/aaaaaa_cdata.xml 4096 3
-	./run.sh tests/benchmark/benchmark@EXEEXT@ -n $(top_srcdir)/../testdata/largefiles/aaaaaa_comment.xml 4096 3
-	./run.sh tests/benchmark/benchmark@EXEEXT@ -n $(top_srcdir)/../testdata/largefiles/aaaaaa_tag.xml 4096 3
-	./run.sh tests/benchmark/benchmark@EXEEXT@ -n $(top_srcdir)/../testdata/largefiles/aaaaaa_text.xml 4096 3
 
 .PHONY: download-xmlts-zip
 download-xmlts-zip:

expat/README.md

@@ -1,17 +1,11 @@
 [![Run Linux CI tasks](https://github.com/libexpat/libexpat/actions/workflows/linux.yml/badge.svg)](https://github.com/libexpat/libexpat/actions/workflows/linux.yml)
+[![AppVeyor Build Status](https://ci.appveyor.com/api/projects/status/github/libexpat/libexpat?svg=true)](https://ci.appveyor.com/project/libexpat/libexpat)
 [![Packaging status](https://repology.org/badge/tiny-repos/expat.svg)](https://repology.org/metapackage/expat/versions)
 [![Downloads SourceForge](https://img.shields.io/sourceforge/dt/expat?label=Downloads%20SourceForge)](https://sourceforge.net/projects/expat/files/)
 [![Downloads GitHub](https://img.shields.io/github/downloads/libexpat/libexpat/total?label=Downloads%20GitHub)](https://github.com/libexpat/libexpat/releases)
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10205/badge)](https://www.bestpractices.dev/projects/10205)
-
-> [!CAUTION]
->
-> Expat is **understaffed** and without funding.
-> There is a [call for help with details](https://github.com/libexpat/libexpat/blob/master/expat/Changes)
-> at the top of the `Changes` file.
 
 
-# Expat, Release 2.8.2
+# Expat, Release 2.5.0
 
 This is Expat, a C99 library for parsing
 [XML 1.0 Fourth Edition](https://www.w3.org/TR/2006/REC-xml-20060816/), started by
@@ -22,12 +16,11 @@ are called when the parser discovers the associated structures in the
 document being parsed.  A start tag is an example of the kind of
 structures for which you may register handlers.
 
-Expat supports the following C99 compilers:
+Expat supports the following compilers:
 
-- GNU GCC >=4.5 (for use from C) or GNU GCC >=4.8.1 (for use from C++)
+- GNU GCC >=4.5
 - LLVM Clang >=3.5
-- Microsoft Visual Studio >=17.0/2022
-  (the oldest version supported by the [official GitHub Actions Windows images](https://github.com/actions/runner-images))
+- Microsoft Visual Studio >=15.0/2017 (rolling `${today} minus 5 years`)
 
 Windows users can use the
 [`expat-win32bin-*.*.*.{exe,zip}` download](https://github.com/libexpat/libexpat/releases),
@@ -44,16 +37,16 @@ This license is the same as the MIT/X Consortium license.
 
 ## Using libexpat in your CMake-Based Project
 
-There are three documented ways of using libexpat with CMake:
+There are two ways of using libexpat with CMake:
 
-### a) `find_package` with Module Mode
+### a) Module Mode
 
 This approach leverages CMake's own [module `FindEXPAT`](https://cmake.org/cmake/help/latest/module/FindEXPAT.html).
 
 Notice the *uppercase* `EXPAT` in the following example:
 
 ```cmake
-cmake_minimum_required(VERSION 3.10)
+cmake_minimum_required(VERSION 3.0)  # or 3.10, see below
 
 project(hello VERSION 1.0.0)
 
@@ -63,10 +56,15 @@ add_executable(hello
     hello.c
 )
 
+# a) for CMake >=3.10 (see CMake's FindEXPAT docs)
 target_link_libraries(hello PUBLIC EXPAT::EXPAT)
+
+# b) for CMake >=3.0
+target_include_directories(hello PRIVATE ${EXPAT_INCLUDE_DIRS})
+target_link_libraries(hello PUBLIC ${EXPAT_LIBRARIES})
 ```
 
-### b) `find_package` with Config Mode
+### b) Config Mode
 
 This approach requires files from…
 
@@ -81,7 +79,7 @@ or
 Notice the *lowercase* `expat` in the following example:
 
 ```cmake
-cmake_minimum_required(VERSION 3.10)
+cmake_minimum_required(VERSION 3.0)
 
 project(hello VERSION 1.0.0)
 
@@ -94,45 +92,6 @@ add_executable(hello
 target_link_libraries(hello PUBLIC expat::expat)
 ```
 
-### c) The `FetchContent` module
-
-This approach — as demonstrated below — requires CMake >=3.18 for both the
-[`FetchContent` module](https://cmake.org/cmake/help/latest/module/FetchContent.html)
-and its support for the `SOURCE_SUBDIR` option to be available.
-
-Please note that:
-- Use of the `FetchContent` module with *non-release* SHA1s or `master`
-  of libexpat is neither advised nor considered officially supported.
-- Pinning to a specific commit is great for robust CI.
-- Pinning to a specific commit needs updating every time there is a new
-  release of libexpat — either manually or through automation —,
-  to not miss out on libexpat security updates.
-
-For an example that pulls in libexpat via Git:
-
-```cmake
-cmake_minimum_required(VERSION 3.18)
-
-include(FetchContent)
-
-project(hello VERSION 1.0.0)
-
-FetchContent_Declare(
-    expat
-    GIT_REPOSITORY https://github.com/libexpat/libexpat/
-    GIT_TAG        000000000_GIT_COMMIT_SHA1_HERE_000000000  # i.e. Git tag R_X_Y_Z
-    SOURCE_SUBDIR  expat/
-)
-
-FetchContent_MakeAvailable(expat)
-
-add_executable(hello
-    hello.c
-)
-
-target_link_libraries(hello PUBLIC expat)
-```
-
 
 ## Building from a Git Clone
 
@@ -199,10 +158,10 @@ support this mode of compilation (yet):
 
 1. Mass-patch `Makefile.am` files to use `libexpatw.la` for a library name:
    <br/>
-   `find . -name Makefile.am -exec sed
+   `find -name Makefile.am -exec sed
        -e 's,libexpat\.la,libexpatw.la,'
        -e 's,libexpat_la,libexpatw_la,'
-       -i.bak {} +`
+       -i {} +`
 
 1. Run `automake` to re-write `Makefile.in` files:<br/>
    `automake`
@@ -234,6 +193,11 @@ overrides the in-makefile set `DESTDIR`, because variable-setting priority is
 Note: This only applies to the Expat library itself, building UTF-16 versions
 of xmlwf and the tests is currently not supported.
 
+When using Expat with a project using autoconf for configuration, you
+can use the probing macro in `conftools/expat.m4` to determine how to
+include Expat.  See the comments at the top of that file for more
+information.
+
 A reference manual is available in the file `doc/reference.html` in this
 distribution.
 
@@ -286,12 +250,21 @@ EXPAT_ENABLE_INSTALL:BOOL=ON
 // Use /MT flag (static CRT) when compiling in MSVC
 EXPAT_MSVC_STATIC_CRT:BOOL=OFF
 
+// Build fuzzers via ossfuzz for the expat library
+EXPAT_OSSFUZZ_BUILD:BOOL=OFF
+
 // Build a shared expat library
 EXPAT_SHARED_LIBS:BOOL=ON
 
-// Define to provide symbol versioning for dependency generation
-EXPAT_SYMBOL_VERSIONING:BOOL=OFF
-
 // Treat all compiler warnings as errors
 EXPAT_WARNINGS_AS_ERRORS:BOOL=OFF
+
+// Make use of getrandom function (ON|OFF|AUTO) [default=AUTO]
+EXPAT_WITH_GETRANDOM:STRING=AUTO
+
+// Utilize libbsd (for arc4random_buf)
+EXPAT_WITH_LIBBSD:BOOL=OFF
+
+// Make use of syscall SYS_getrandom (ON|OFF|AUTO) [default=AUTO]
+EXPAT_WITH_SYS_GETRANDOM:STRING=AUTO
 ```

expat/acinclude.m4

@@ -8,7 +8,5 @@ m4_include(conftools/ax-append-flag.m4)
 m4_include(conftools/ax-append-compile-flags.m4)
 m4_include(conftools/ax-append-link-flags.m4)
 m4_include(conftools/expatcfg-compiler-supports-visibility.m4)
-m4_include(conftools/ax-cxx-compile-stdcxx.m4)
-m4_include(conftools/ax-cxx-compile-stdcxx-11.m4)
 
 ### end of file

expat/apply-clang-format.sh

@@ -6,9 +6,8 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2019-2024 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2019-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2022      Rosen Penev <rosenp@gmail.com>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -30,32 +29,34 @@
 # OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 # USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-set -e -u -o pipefail
+set -e
+set -u
+set -o pipefail
 
-cd "$(dirname "$(type -P "$0")")"
+clang-format --version
 
-args=(
+clang_format_args=(
     -i
     -style=file
     -verbose
 )
 
-if [[ $# -gt 0 ]]; then
-    files=( "$@" )
-else
-    files=( $(git ls-files -- '*.[ch]' '*.cpp' '*.cxx' '*.h.cmake') )
+if [[ $# -ge 1 ]]; then
+    exec clang-format "${clang_format_args[@]}" "$@"
 fi
 
-set -x
+expand --tabs=2 --initial lib/siphash.h | sponge lib/siphash.h
 
-type -P clang-format
-
-clang-format --version
-
-clang-format "${args[@]}" -- "${files[@]}"
+find . \
+        -name '*.[ch]' \
+        -o -name '*.cpp' \
+        -o -name '*.cxx' \
+        -o -name '*.h.cmake' \
+    | sort \
+    | xargs clang-format "${clang_format_args[@]}"
 
 sed \
         -e 's, @$,@,' \
         -e 's,#\( \+\)cmakedefine,#cmakedefine,' \
-        -i.bak \
+        -i \
         expat_config.h.cmake

expat/apply-clang-tidy.sh

@@ -1,109 +0,0 @@
-#! /usr/bin/env bash
-#                          __  __            _
-#                       ___\ \/ /_ __   __ _| |_
-#                      / _ \\  /| '_ \ / _` | __|
-#                     |  __//  \| |_) | (_| | |_
-#                      \___/_/\_\ .__/ \__,_|\__|
-#                               |_| XML parser
-#
-# Copyright (c) 2024-2026 Sebastian Pipping <sebastian@pipping.org>
-# Licensed under the MIT license:
-#
-# Permission is  hereby granted,  free of charge,  to any  person obtaining
-# a  copy  of  this  software   and  associated  documentation  files  (the
-# "Software"),  to  deal in  the  Software  without restriction,  including
-# without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-# distribute, sublicense, and/or sell copies of the Software, and to permit
-# persons  to whom  the Software  is  furnished to  do so,  subject to  the
-# following conditions:
-#
-# The above copyright  notice and this permission notice  shall be included
-# in all copies or substantial portions of the Software.
-#
-# THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-# EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-# MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-# NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-# DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-# OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-# USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-set -e -u -o pipefail
-
-cd "$(dirname "$(type -P "$0")")"
-
-checks_to_enable=(
-    bugprone-narrowing-conversions
-    bugprone-suspicious-string-compare
-    misc-no-recursion
-    readability-avoid-const-params-in-decls
-    readability-named-parameter
-)
-checks_to_enable_flat="${checks_to_enable[*]}"  # i.e. flat string separated by spaces
-
-checks_to_disable=(
-    # Would need a closer look before any adjustments
-    clang-analyzer-optin.performance.Padding
-
-    # Used only in xmlwf, manually checked to be good enough for now
-    clang-analyzer-security.insecureAPI.strcpy
-)
-checks_to_disable_flat="${checks_to_disable[*]}"  # i.e. flat string separated by spaces
-
-checks="${checks_to_enable_flat// /,},-${checks_to_disable_flat// /,-}"
-
-args=(
-    --checks="${checks}"
-    --header-filter='.*'  # .. to display errors from all non-system headers
-    --warnings-as-errors=\*
-)
-
-flags=(
-    -std=c99
-
-    -Ilib/
-
-    -DENCODING_FOR_FUZZING=UTF-8
-    -DXML_ATTR_INFO
-    -DXML_CLANG_TIDY
-    -DXML_DTD
-    -DXML_GE
-    -DXML_NS
-    -DXML_TESTING
-)
-
-if [[ $# -gt 0 ]]; then
-    files=( "$@" )
-else
-    # For the list of excluded files please note:
-    # https://github.com/libexpat/libexpat/issues/119
-    files=( $(
-        git ls-files -- \*.c | grep -v \
-        -e '^lib/xcsinc\.c$' \
-        -e '^xmlwf/ct\.c$' \
-        -e '^xmlwf/xmlmime\.c$' \
-        -e '^xmlwf/win32filemap\.c$' \
-    ) )
-fi
-
-set -x
-
-type -P clang-tidy
-
-clang-tidy --version
-
-clang-tidy --checks="${checks}" --verify-config
-
-clang-tidy --checks="${checks}" --list-checks
-
-# These are the checks clang-tidy has *more* that so far we are missing out on,
-# for good and for bad
-clang-tidy --checks=\* --list-checks \
-    | grep -v -f <(clang-tidy --checks="${checks}" --list-checks | xargs -n1) \
-    | sed 's,\(\s*\)\([^-]\+\)-[^ ]\+,\1\2-*,' \
-    | sort -u \
-    | sed 's/^$/Disabled checks (simplified):/'
-
-pwd
-
-exec clang-tidy "${args[@]}" "${files[@]}" -- "${flags[@]}"

expat/buildconf.sh

@@ -8,7 +8,6 @@
 #
 # Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2018      Marco Maggi <marco.maggi-ipsu@poste.it>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -32,4 +31,25 @@
 
 set -e
 
-exec autoreconf --warnings=all --install --verbose "$@"
+# File expat_config.h.in (as generated by autoheader by autoreconf) contains
+# macro SIZEOF_VOID_P which is (1) not really needed by Expat as of today and
+# (2) a problem to "multilib" systems with one shared installed
+# /usr/include/expat_config.h for two Expats with different "void *" sizes
+# installed in e.g. /usr/lib32 and /usr/lib64.  Hence we patch macro
+# SIZEOF_VOID_P out of template expat_config.h.in so that configure will
+# not put SIZEOF_VOID_P in the eventual expat_config.h.
+patch_expat_config_h_in() {
+    local filename="$1"
+    local sizeof_void_p_line_number="$(grep -F -n SIZEOF_VOID_P "${filename}" | awk -F: '{print $1}')"
+    [[ ${sizeof_void_p_line_number} =~ ^[0-9]+$ ]]  # cheap assert
+    local first_line_to_delete=$(( sizeof_void_p_line_number - 1 ))
+    local last_line_to_delete=$(( sizeof_void_p_line_number + 1 ))
+    # Note: Avoiding "sed -i" only for macOS portability.
+    local tempfile="$(mktemp)"
+    sed "${first_line_to_delete},${last_line_to_delete}d" "${filename}" > "${tempfile}"
+    mv "${tempfile}" "${filename}"
+}
+
+autoreconf --warnings=all --install --verbose "$@"
+
+patch_expat_config_h_in expat_config.h.in

expat/cmake/autotools/expat-config-version.cmake.in

@@ -53,13 +53,13 @@ endif()
 
 
 # if the installed or the using project don't have CMAKE_SIZEOF_VOID_P set, ignore it:
-if("${CMAKE_SIZEOF_VOID_P}" STREQUAL "" OR "@SIZEOF_VOID_P@" STREQUAL "")
+if("${CMAKE_SIZEOF_VOID_P}" STREQUAL "" OR "@ac_cv_sizeof_void_p@" STREQUAL "")
   return()
 endif()
 
 # check that the installed version has the same 32/64bit-ness as the one which is currently searching:
-if(NOT CMAKE_SIZEOF_VOID_P STREQUAL "@SIZEOF_VOID_P@")
-  math(EXPR installedBits "@SIZEOF_VOID_P@ * 8")
+if(NOT CMAKE_SIZEOF_VOID_P STREQUAL "@ac_cv_sizeof_void_p@")
+  math(EXPR installedBits "@ac_cv_sizeof_void_p@ * 8")
   set(PACKAGE_VERSION "${PACKAGE_VERSION} (${installedBits}bit)")
   set(PACKAGE_VERSION_UNSUITABLE TRUE)
 endif()

expat/cmake/autotools/expat-noconfig__macos.cmake.in

@@ -8,12 +8,12 @@ set(CMAKE_IMPORT_FILE_VERSION 1)
 # Import target "expat::expat" for configuration "NoConfig"
 set_property(TARGET expat::expat APPEND PROPERTY IMPORTED_CONFIGURATIONS NOCONFIG)
 set_target_properties(expat::expat PROPERTIES
-  IMPORTED_LOCATION_NOCONFIG "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.@SO_MAJOR@.dylib"
+  IMPORTED_LOCATION_NOCONFIG "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.@SO_MAJOR@.@SO_MINOR@.@SO_PATCH@.dylib"
   IMPORTED_SONAME_NOCONFIG "@rpath/libexpat.@SO_MAJOR@.dylib"
   )
 
 list(APPEND _cmake_import_check_targets expat::expat )
-list(APPEND _cmake_import_check_files_for_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.@SO_MAJOR@.dylib" )
+list(APPEND _cmake_import_check_files_for_expat::expat "${_IMPORT_PREFIX}/@LIBDIR_BASENAME@/libexpat.@SO_MAJOR@.@SO_MINOR@.@SO_PATCH@.dylib" )
 
 # Commands beyond this point should not need to know the version.
 set(CMAKE_IMPORT_FILE_VERSION)

expat/cmake/autotools/expat.cmake

@@ -1,13 +1,13 @@
 # Generated by CMake
 
 if("${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}" LESS 2.8)
-   message(FATAL_ERROR "CMake >= 2.8.12 required")
+   message(FATAL_ERROR "CMake >= 2.8.0 required")
 endif()
-if(CMAKE_VERSION VERSION_LESS "2.8.12")
-   message(FATAL_ERROR "CMake >= 2.8.12 required")
+if(CMAKE_VERSION VERSION_LESS "2.8.3")
+   message(FATAL_ERROR "CMake >= 2.8.3 required")
 endif()
 cmake_policy(PUSH)
-cmake_policy(VERSION 2.8.12...4.1)
+cmake_policy(VERSION 2.8.3...3.25)
 #----------------------------------------------------------------
 # Generated CMake target import file.
 #----------------------------------------------------------------
@@ -63,6 +63,10 @@ set_target_properties(expat::expat PROPERTIES
   INTERFACE_LINK_LIBRARIES "m"
 )
 
+if(CMAKE_VERSION VERSION_LESS 2.8.12)
+  message(FATAL_ERROR "This file relies on consumers using CMake 2.8.12 or greater.")
+endif()
+
 # Load information for each installed configuration.
 file(GLOB _cmake_config_files "${CMAKE_CURRENT_LIST_DIR}/expat-*.cmake")
 foreach(_cmake_config_file IN LISTS _cmake_config_files)
@@ -76,12 +80,9 @@ set(_IMPORT_PREFIX)
 
 # Loop over all imported files and verify that they actually exist
 foreach(_cmake_target IN LISTS _cmake_import_check_targets)
-  if(CMAKE_VERSION VERSION_LESS "3.28"
-      OR NOT DEFINED _cmake_import_check_xcframework_for_${_cmake_target}
-      OR NOT IS_DIRECTORY "${_cmake_import_check_xcframework_for_${_cmake_target}}")
-    foreach(_cmake_file IN LISTS "_cmake_import_check_files_for_${_cmake_target}")
-      if(NOT EXISTS "${_cmake_file}")
-        message(FATAL_ERROR "The imported target \"${_cmake_target}\" references the file
+  foreach(_cmake_file IN LISTS "_cmake_import_check_files_for_${_cmake_target}")
+    if(NOT EXISTS "${_cmake_file}")
+      message(FATAL_ERROR "The imported target \"${_cmake_target}\" references the file
    \"${_cmake_file}\"
 but this file does not exist.  Possible reasons include:
 * The file was deleted, renamed, or moved to another location.
@@ -90,9 +91,8 @@ but this file does not exist.  Possible reasons include:
    \"${CMAKE_CURRENT_LIST_FILE}\"
 but not all the files it references.
 ")
-      endif()
-    endforeach()
-  endif()
+    endif()
+  endforeach()
   unset(_cmake_file)
   unset("_cmake_import_check_files_for_${_cmake_target}")
 endforeach()

expat/cmake/autotools/expat__linux.cmake.in

@@ -1,107 +0,0 @@
-# Generated by CMake
-
-if("${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}" LESS 2.8)
-   message(FATAL_ERROR "CMake >= 2.8.12 required")
-endif()
-if(CMAKE_VERSION VERSION_LESS "2.8.12")
-   message(FATAL_ERROR "CMake >= 2.8.12 required")
-endif()
-cmake_policy(PUSH)
-cmake_policy(VERSION 2.8.12...3.29)
-#----------------------------------------------------------------
-# Generated CMake target import file.
-#----------------------------------------------------------------
-
-# Commands may need to know the format version.
-set(CMAKE_IMPORT_FILE_VERSION 1)
-
-# Protect against multiple inclusion, which would fail when already imported targets are added once more.
-set(_cmake_targets_defined "")
-set(_cmake_targets_not_defined "")
-set(_cmake_expected_targets "")
-foreach(_cmake_expected_target IN ITEMS expat::expat)
-  list(APPEND _cmake_expected_targets "${_cmake_expected_target}")
-  if(TARGET "${_cmake_expected_target}")
-    list(APPEND _cmake_targets_defined "${_cmake_expected_target}")
-  else()
-    list(APPEND _cmake_targets_not_defined "${_cmake_expected_target}")
-  endif()
-endforeach()
-unset(_cmake_expected_target)
-if(_cmake_targets_defined STREQUAL _cmake_expected_targets)
-  unset(_cmake_targets_defined)
-  unset(_cmake_targets_not_defined)
-  unset(_cmake_expected_targets)
-  unset(CMAKE_IMPORT_FILE_VERSION)
-  cmake_policy(POP)
-  return()
-endif()
-if(NOT _cmake_targets_defined STREQUAL "")
-  string(REPLACE ";" ", " _cmake_targets_defined_text "${_cmake_targets_defined}")
-  string(REPLACE ";" ", " _cmake_targets_not_defined_text "${_cmake_targets_not_defined}")
-  message(FATAL_ERROR "Some (but not all) targets in this export set were already defined.\nTargets Defined: ${_cmake_targets_defined_text}\nTargets not yet defined: ${_cmake_targets_not_defined_text}\n")
-endif()
-unset(_cmake_targets_defined)
-unset(_cmake_targets_not_defined)
-unset(_cmake_expected_targets)
-
-
-# Compute the installation prefix relative to this file.
-get_filename_component(_IMPORT_PREFIX "${CMAKE_CURRENT_LIST_FILE}" PATH)
-get_filename_component(_IMPORT_PREFIX "${_IMPORT_PREFIX}" PATH)
-get_filename_component(_IMPORT_PREFIX "${_IMPORT_PREFIX}" PATH)
-get_filename_component(_IMPORT_PREFIX "${_IMPORT_PREFIX}" PATH)
-if(_IMPORT_PREFIX STREQUAL "/")
-  set(_IMPORT_PREFIX "")
-endif()
-
-# Create imported target expat::expat
-add_library(expat::expat SHARED IMPORTED)
-
-set_target_properties(expat::expat PROPERTIES
-  INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
-  INTERFACE_LINK_LIBRARIES "m"
-)
-
-# Load information for each installed configuration.
-file(GLOB _cmake_config_files "${CMAKE_CURRENT_LIST_DIR}/expat-*.cmake")
-foreach(_cmake_config_file IN LISTS _cmake_config_files)
-  include("${_cmake_config_file}")
-endforeach()
-unset(_cmake_config_file)
-unset(_cmake_config_files)
-
-# Cleanup temporary variables.
-set(_IMPORT_PREFIX)
-
-# Loop over all imported files and verify that they actually exist
-foreach(_cmake_target IN LISTS _cmake_import_check_targets)
-  if(CMAKE_VERSION VERSION_LESS "3.28"
-      OR NOT DEFINED _cmake_import_check_xcframework_for_${_cmake_target}
-      OR NOT IS_DIRECTORY "${_cmake_import_check_xcframework_for_${_cmake_target}}")
-    foreach(_cmake_file IN LISTS "_cmake_import_check_files_for_${_cmake_target}")
-      if(NOT EXISTS "${_cmake_file}")
-        message(FATAL_ERROR "The imported target \"${_cmake_target}\" references the file
-   \"${_cmake_file}\"
-but this file does not exist.  Possible reasons include:
-* The file was deleted, renamed, or moved to another location.
-* An install or uninstall procedure did not complete successfully.
-* The installation package was faulty and contained
-   \"${CMAKE_CURRENT_LIST_FILE}\"
-but not all the files it references.
-")
-      endif()
-    endforeach()
-  endif()
-  unset(_cmake_file)
-  unset("_cmake_import_check_files_for_${_cmake_target}")
-endforeach()
-unset(_cmake_target)
-unset(_cmake_import_check_targets)
-
-# This file does not depend on other imported targets which have
-# been exported from the same project but in a separate export set.
-
-# Commands beyond this point should not need to know the version.
-set(CMAKE_IMPORT_FILE_VERSION)
-cmake_policy(POP)

expat/cmake/autotools/expat__windows.cmake.in

@@ -1,107 +0,0 @@
-# Generated by CMake
-
-if("${CMAKE_MAJOR_VERSION}.${CMAKE_MINOR_VERSION}" LESS 2.8)
-   message(FATAL_ERROR "CMake >= 2.8.12 required")
-endif()
-if(CMAKE_VERSION VERSION_LESS "2.8.12")
-   message(FATAL_ERROR "CMake >= 2.8.12 required")
-endif()
-cmake_policy(PUSH)
-cmake_policy(VERSION 2.8.12...3.29)
-#----------------------------------------------------------------
-# Generated CMake target import file.
-#----------------------------------------------------------------
-
-# Commands may need to know the format version.
-set(CMAKE_IMPORT_FILE_VERSION 1)
-
-# Protect against multiple inclusion, which would fail when already imported targets are added once more.
-set(_cmake_targets_defined "")
-set(_cmake_targets_not_defined "")
-set(_cmake_expected_targets "")
-foreach(_cmake_expected_target IN ITEMS expat::expat)
-  list(APPEND _cmake_expected_targets "${_cmake_expected_target}")
-  if(TARGET "${_cmake_expected_target}")
-    list(APPEND _cmake_targets_defined "${_cmake_expected_target}")
-  else()
-    list(APPEND _cmake_targets_not_defined "${_cmake_expected_target}")
-  endif()
-endforeach()
-unset(_cmake_expected_target)
-if(_cmake_targets_defined STREQUAL _cmake_expected_targets)
-  unset(_cmake_targets_defined)
-  unset(_cmake_targets_not_defined)
-  unset(_cmake_expected_targets)
-  unset(CMAKE_IMPORT_FILE_VERSION)
-  cmake_policy(POP)
-  return()
-endif()
-if(NOT _cmake_targets_defined STREQUAL "")
-  string(REPLACE ";" ", " _cmake_targets_defined_text "${_cmake_targets_defined}")
-  string(REPLACE ";" ", " _cmake_targets_not_defined_text "${_cmake_targets_not_defined}")
-  message(FATAL_ERROR "Some (but not all) targets in this export set were already defined.\nTargets Defined: ${_cmake_targets_defined_text}\nTargets not yet defined: ${_cmake_targets_not_defined_text}\n")
-endif()
-unset(_cmake_targets_defined)
-unset(_cmake_targets_not_defined)
-unset(_cmake_expected_targets)
-
-
-# Compute the installation prefix relative to this file.
-get_filename_component(_IMPORT_PREFIX "${CMAKE_CURRENT_LIST_FILE}" PATH)
-get_filename_component(_IMPORT_PREFIX "${_IMPORT_PREFIX}" PATH)
-get_filename_component(_IMPORT_PREFIX "${_IMPORT_PREFIX}" PATH)
-get_filename_component(_IMPORT_PREFIX "${_IMPORT_PREFIX}" PATH)
-if(_IMPORT_PREFIX STREQUAL "/")
-  set(_IMPORT_PREFIX "")
-endif()
-
-# Create imported target expat::expat
-add_library(expat::expat SHARED IMPORTED)
-
-set_target_properties(expat::expat PROPERTIES
-  INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
-  INTERFACE_LINK_LIBRARIES "m"
-)
-
-# Load information for each installed configuration.
-file(GLOB _cmake_config_files "${CMAKE_CURRENT_LIST_DIR}/expat-*.cmake")
-foreach(_cmake_config_file IN LISTS _cmake_config_files)
-  include("${_cmake_config_file}")
-endforeach()
-unset(_cmake_config_file)
-unset(_cmake_config_files)
-
-# Cleanup temporary variables.
-set(_IMPORT_PREFIX)
-
-# Loop over all imported files and verify that they actually exist
-foreach(_cmake_target IN LISTS _cmake_import_check_targets)
-  if(CMAKE_VERSION VERSION_LESS "3.28"
-      OR NOT DEFINED _cmake_import_check_xcframework_for_${_cmake_target}
-      OR NOT IS_DIRECTORY "${_cmake_import_check_xcframework_for_${_cmake_target}}")
-    foreach(_cmake_file IN LISTS "_cmake_import_check_files_for_${_cmake_target}")
-      if(NOT EXISTS "${_cmake_file}")
-        message(FATAL_ERROR "The imported target \"${_cmake_target}\" references the file
-   \"${_cmake_file}\"
-but this file does not exist.  Possible reasons include:
-* The file was deleted, renamed, or moved to another location.
-* An install or uninstall procedure did not complete successfully.
-* The installation package was faulty and contained
-   \"${CMAKE_CURRENT_LIST_FILE}\"
-but not all the files it references.
-")
-      endif()
-    endforeach()
-  endif()
-  unset(_cmake_file)
-  unset("_cmake_import_check_files_for_${_cmake_target}")
-endforeach()
-unset(_cmake_target)
-unset(_cmake_import_check_targets)
-
-# This file does not depend on other imported targets which have
-# been exported from the same project but in a separate export set.
-
-# Commands beyond this point should not need to know the version.
-set(CMAKE_IMPORT_FILE_VERSION)
-cmake_policy(POP)

expat/configure.ac

@@ -11,7 +11,7 @@ dnl   Copyright (c) 2000      Clark Cooper <coopercc@users.sourceforge.net>
 dnl   Copyright (c) 2000-2005 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
 dnl   Copyright (c) 2001-2003 Greg Stein <gstein@users.sourceforge.net>
 dnl   Copyright (c) 2006-2012 Karl Waclawek <karl@waclawek.net>
-dnl   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+dnl   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
 dnl   Copyright (c) 2017      S. P. Zeidler <spz@netbsd.org>
 dnl   Copyright (c) 2017      Stephen Groat <stephen@groat.us>
 dnl   Copyright (c) 2017-2020 Joe Orton <jorton@redhat.com>
@@ -22,13 +22,6 @@ dnl   Copyright (c) 2018      KangLin <kl222@126.com>
 dnl   Copyright (c) 2019      Mohammed Khajapasha <mohammed.khajapasha@intel.com>
 dnl   Copyright (c) 2019      Kishore Kunche <kishore.kunche@intel.com>
 dnl   Copyright (c) 2020      Jeffrey Walton <noloader@gmail.com>
-dnl   Copyright (c) 2024      Ferenc Géczi <ferenc.gm@gmail.com>
-dnl   Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
-dnl   Copyright (c) 2025      Matthew Fernandez <matthew.fernandez@gmail.com>
-dnl   Copyright (c) 2025      Alfonso Gregory <gfunni234@gmail.com>
-dnl   Copyright (c) 2026      Rosen Penev <rosenp@gmail.com>
-dnl   Copyright (c) 2026      Gordon Messmer <gordon.messmer@gmail.com>
-dnl   Copyright (c) 2026      Fabio Scaccabarozzi <fsvm88@gmail.com>
 dnl   Licensed under the MIT license:
 dnl
 dnl   Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -67,7 +60,7 @@ m4_define([expat_version],
   m4_ifdef([__gnu__],
            [esyscmd(conftools/get-version.sh lib/expat.h)],
            [2.2.x]))
-AC_INIT([expat], expat_version, [https://github.com/libexpat/libexpat/issues])
+AC_INIT([expat], expat_version, [expat-bugs@libexpat.org])
 m4_undefine([expat_version])
 
 AC_CONFIG_SRCDIR([Makefile.in])
@@ -89,9 +82,9 @@ dnl
 dnl If the API changes incompatibly set LIBAGE back to 0
 dnl
 
-LIBCURRENT=13  # sync
-LIBREVISION=2  # with
-LIBAGE=12      # CMakeLists.txt!
+LIBCURRENT=9    # sync
+LIBREVISION=10  # with
+LIBAGE=8        # CMakeLists.txt!
 
 AC_CONFIG_HEADERS([expat_config.h])
 AH_TOP([#ifndef EXPAT_CONFIG_H
@@ -100,6 +93,7 @@ AH_BOTTOM([#endif // ndef EXPAT_CONFIG_H])
 
 AM_PROG_AR
 AC_PROG_INSTALL
+AC_PROG_LN_S
 AC_PROG_MAKE_SET
 
 LT_PREREQ([2.4])
@@ -121,12 +115,10 @@ AS_IF([test "$GCC" = yes],
    dnl GCC don't support it and it causes extra warnings that are only
    dnl distracting; avoid.
    AX_APPEND_COMPILE_FLAGS([-fexceptions], [AM_CFLAGS])
-   AX_APPEND_COMPILE_FLAGS([-Wstrict-aliasing=3 -Wmissing-prototypes -Wstrict-prototypes], [AM_CFLAGS])
+   AX_APPEND_COMPILE_FLAGS([-fno-strict-aliasing -Wmissing-prototypes -Wstrict-prototypes], [AM_CFLAGS])
    AX_APPEND_COMPILE_FLAGS([-pedantic -Wduplicated-cond -Wduplicated-branches -Wlogical-op], [AM_CFLAGS])
    AX_APPEND_COMPILE_FLAGS([-Wrestrict -Wnull-dereference -Wjump-misses-init -Wdouble-promotion], [AM_CFLAGS])
-   AX_APPEND_COMPILE_FLAGS([-Wshadow -Wformat=2 -Wmisleading-indentation], [AM_CFLAGS])
-   AS_CASE(["${host_os}"], [mingw*], [AX_APPEND_COMPILE_FLAGS([-Wno-pedantic-ms-format], [AM_CFLAGS])])
-  ])
+   AX_APPEND_COMPILE_FLAGS([-Wshadow -Wformat=2 -Wno-pedantic-ms-format -Wmisleading-indentation], [AM_CFLAGS])])
 
 AC_LANG_PUSH([C++])
 AC_PROG_CXX
@@ -137,23 +129,11 @@ AS_IF([test "$GCC" = yes],
    dnl GCC don't support it and it causes extra warnings that are only
    dnl distracting; avoid.
    AX_APPEND_COMPILE_FLAGS([-fexceptions], [AM_CXXFLAGS])
-   AX_APPEND_COMPILE_FLAGS([-Wstrict-aliasing=3], [AM_CXXFLAGS])])
+   AX_APPEND_COMPILE_FLAGS([-fno-strict-aliasing], [AM_CXXFLAGS])])
 AC_LANG_POP([C++])
 
 AS_IF([test "$GCC" = yes],
-  [AX_APPEND_LINK_FLAGS([-Wstrict-aliasing=3],[AM_LDFLAGS])])
-
-AC_ARG_ENABLE([symbol-versioning],
-  [AS_HELP_STRING([--enable-symbol-versioning],
-    [provide symbol versioning for dependency generation @<:@default=no@:>@])],
-  [enable_symbol_versioning=$enableval],
-  [enable_symbol_versioning=no])
-AS_IF([test "x$enable_symbol_versioning" != xno],
-  [VSCRIPT_LDFLAGS="-Wl,--version-script"
-   AC_SUBST([VSCRIPT_LDFLAGS])
-  ])
-AM_CONDITIONAL([HAVE_VSCRIPT],
-  [test "x$enable_symbol_versioning" != xno])
+  [AX_APPEND_LINK_FLAGS([-fno-strict-aliasing],[AM_LDFLAGS])])
 
 dnl patching ${archive_cmds} to affect generation of file "libtool" to fix linking with clang (issue #312)
 AS_CASE(["$LD"],[*clang*],
@@ -180,6 +160,7 @@ AC_C_BIGENDIAN([AC_DEFINE([WORDS_BIGENDIAN], 1)
 AC_DEFINE_UNQUOTED([BYTEORDER], $BYTEORDER, [1234 = LILENDIAN, 4321 = BIGENDIAN])
 
 AC_C_CONST
+AC_TYPE_SIZE_T
 
 AC_ARG_WITH([xmlwf],
   [AS_HELP_STRING([--without-xmlwf], [do not build xmlwf])],
@@ -199,8 +180,6 @@ AC_ARG_WITH([tests],
   [with_tests=yes])
 AM_CONDITIONAL([WITH_TESTS], [test x${with_tests} = xyes])
 
-AS_IF([test x${with_tests} = xyes],
-      [AX_CXX_COMPILE_STDCXX_11([noext], [mandatory])])
 
 AS_VAR_SET([EXPATCFG_ON_MINGW],[no])
 AS_CASE("${host_os}",
@@ -217,110 +196,48 @@ AM_CONDITIONAL([_INTERNAL_LARGE_SIZE], [echo -- "${CPPFLAGS}${CFLAGS}" | ${FGREP
 
 LT_LIB_M
 
-AC_ARG_WITH([arc4random],
-  [AS_HELP_STRING([--with-arc4random],
-                  [enforce the use of arc4random function in the system @<:@default=check@:>@])
-AS_HELP_STRING([--without-arc4random],
-               [skip auto detect of arc4random @<:@default=check@:>@])],
+AC_ARG_WITH([libbsd],
+  [AS_HELP_STRING([--with-libbsd], [utilize libbsd (for arc4random_buf)])],
   [],
-  [with_arc4random=check])
+  [with_libbsd=no])
+AS_IF([test "x${with_libbsd}" != xno],
+  [AC_CHECK_LIB([bsd],
+     [arc4random_buf],
+     [],
+     [AS_IF([test "x${with_libbsd}" = xyes],
+        [AC_MSG_ERROR([Enforced use of libbsd cannot be satisfied.])])])])
+AC_MSG_CHECKING([for arc4random_buf (BSD, libbsd or glibc 2.36+)])
+AC_LINK_IFELSE([AC_LANG_SOURCE([
+    #if defined(HAVE_LIBBSD)
+    # include <bsd/stdlib.h>
+    #else
+    # include <stdlib.h>  /* for arc4random_buf on BSD */
+    #endif
+    int main() {
+      char dummy[[123]];  // double brackets for m4
+      arc4random_buf(dummy, 0U);
+      return 0;
+    }
+  ])],
+  [AC_DEFINE([HAVE_ARC4RANDOM_BUF], [1], [Define to 1 if you have the `arc4random_buf' function.])
+   AC_MSG_RESULT([yes])],
+  [AC_MSG_RESULT([no])
 
-AC_ARG_WITH([arc4random-buf],
-  [AS_HELP_STRING([--with-arc4random-buf],
-                  [enforce the use of arc4random_buf function in the system @<:@default=check@:>@])
-AS_HELP_STRING([--without-arc4random-buf],
-               [skip auto detect of arc4random_buf @<:@default=check@:>@])],
-  [],
-  [with_arc4random_buf=check])
-
-have_arc4random=false
-have_arc4random_buf=false
-
-AS_IF([test "x${with_arc4random_buf}" != xno],
-  [AC_MSG_CHECKING([for arc4random_buf (BSD or glibc 2.36+)])
+   AC_MSG_CHECKING([for arc4random (BSD, macOS, libbsd or glibc 2.36+)])
    AC_LINK_IFELSE([AC_LANG_SOURCE([
-       #if ! defined(_DEFAULT_SOURCE)
-       # define _DEFAULT_SOURCE 1 /* for glibc */
+       #if defined(HAVE_LIBBSD)
+       # include <bsd/stdlib.h>
+       #else
+       # include <stdlib.h>
        #endif
-       #include <stdlib.h>
-       int main(void) {
-         char dummy[[123]];  // double brackets for m4
-         arc4random_buf(dummy, 0U);
-         return 0;
-       }
-     ])],
-     [AC_DEFINE([HAVE_ARC4RANDOM_BUF], [1], [Define to 1 if you have the `arc4random_buf' function.])
-      have_arc4random_buf=true
-      AC_MSG_RESULT([yes])],
-     [AC_MSG_RESULT([no])
-      AS_IF([test "x${with_arc4random_buf}" = xyes],
-        [AC_MSG_ERROR([enforced the use of arc4random_buf --with-arc4random-buf, but not detected])])])])
-
-AS_IF([test "x${with_arc4random}" != xno],
-  [AC_MSG_CHECKING([for arc4random (BSD, macOS, or glibc 2.36+)])
-   AC_LINK_IFELSE([AC_LANG_SOURCE([
-       #if ! defined(_DEFAULT_SOURCE)
-       # define _DEFAULT_SOURCE 1 /* for glibc */
-       #endif
-       #include <stdlib.h>
-       int main(void) {
+       int main() {
           arc4random();
           return 0;
        }
      ])],
      [AC_DEFINE([HAVE_ARC4RANDOM], [1], [Define to 1 if you have the `arc4random' function.])
-      have_arc4random=true
       AC_MSG_RESULT([yes])],
-     [AC_MSG_RESULT([no])
-      AS_IF([test "x${with_arc4random}" = xyes],
-        [AC_MSG_ERROR([enforced the use of arc4random --with-arc4random, but not detected])])])])
-
-AM_CONDITIONAL([WITH_ARC4RANDOM], [test x${have_arc4random} = xtrue])
-AM_CONDITIONAL([WITH_ARC4RANDOM_BUF], [test x${have_arc4random_buf} = xtrue])
-
-have_getentropy=false
-
-AC_ARG_WITH([getentropy],
-  [AS_HELP_STRING([--with-getentropy],
-                  [enforce the use of getentropy function in the system @<:@default=check@:>@])
-AS_HELP_STRING([--without-getentropy],
-               [skip auto detect of getentropy @<:@default=check@:>@])],
-  [],
-  [with_getentropy=check])
-
-AS_IF([test "x$with_getentropy" != xno],
-  [AC_MSG_CHECKING([for getentropy (BSD, macOS 10.12+, glibc 2.25+)])
-   AC_LINK_IFELSE([AC_LANG_SOURCE([
-       // NOTE: Please keep this block in sync with its two siblings in files
-       //       'ConfigureChecks.cmake' and 'lib/random_getentropy.c'!
-       #if defined(__APPLE__)
-       #  include <sys/random.h>
-       #else
-       #  if defined(__GLIBC__) && ! defined(_DEFAULT_SOURCE)
-       #    define _DEFAULT_SOURCE 1
-       #  endif
-       #  if ! defined(_GNU_SOURCE)
-       #    define _GNU_SOURCE 1 /* for musl */
-       #  endif
-       #  include <unistd.h>
-       #endif // ! defined(__APPLE__)
-
-       int main(void) {
-         return getentropy(NULL, 0U);
-       }
-     ])],
-     [AC_DEFINE([HAVE_GETENTROPY], [1], [Define to 1 if you have the `getentropy' function.])
-      have_getentropy=true
-      AC_MSG_RESULT([yes])],
-     [AC_MSG_RESULT([no])
-      AS_IF([test "x$with_getentropy" = xyes],
-        [AC_MSG_ERROR([enforced the use of getentropy --with-getentropy, but not detected])])])])
-
-AM_CONDITIONAL([WITH_GETENTROPY], [test x${have_getentropy} = xtrue])
-
-have_either_getrandom=false
-have_getrandom_function=false
-have_getrandom_syscall=false
+     [AC_MSG_RESULT([no])])])
 
 AC_ARG_WITH([getrandom],
   [AS_HELP_STRING([--with-getrandom],
@@ -335,13 +252,11 @@ AS_IF([test "x$with_getrandom" != xno],
    AC_LINK_IFELSE([AC_LANG_SOURCE([
        #include <stdlib.h>  /* for NULL */
        #include <sys/random.h>
-       int main(void) {
+       int main() {
          return getrandom(NULL, 0U, 0U);
        }
      ])],
      [AC_DEFINE([HAVE_GETRANDOM], [1], [Define to 1 if you have the `getrandom' function.])
-      have_either_getrandom=true
-      have_getrandom_function=true
       AC_MSG_RESULT([yes])],
      [AC_MSG_RESULT([no])
       AS_IF([test "x$with_getrandom" = xyes],
@@ -358,25 +273,20 @@ AS_HELP_STRING([--without-sys-getrandom],
 AS_IF([test "x$with_sys_getrandom" != xno],
   [AC_MSG_CHECKING([for syscall SYS_getrandom (Linux 3.17+)])
    AC_LINK_IFELSE([AC_LANG_SOURCE([
-       #define _GNU_SOURCE
        #include <stdlib.h>  /* for NULL */
        #include <unistd.h>  /* for syscall */
        #include <sys/syscall.h>  /* for SYS_getrandom */
-       int main(void) {
+       int main() {
          syscall(SYS_getrandom, NULL, 0, 0);
          return 0;
      }
    ])],
      [AC_DEFINE([HAVE_SYSCALL_GETRANDOM], [1], [Define to 1 if you have `syscall' and `SYS_getrandom'.])
-      have_either_getrandom=true
-      have_getrandom_syscall=true
       AC_MSG_RESULT([yes])],
      [AC_MSG_RESULT([no])
       AS_IF([test "x$with_sys_getrandom" = xyes],
         [AC_MSG_ERROR([enforced the use of syscall SYS_getrandom --with-sys-getrandom, but not detected])])])])
 
-AM_CONDITIONAL([WITH_EITHER_GETRANDOM], [test x${have_either_getrandom} = xtrue])
-
 dnl Only needed for xmlwf:
 AC_CHECK_HEADERS(fcntl.h unistd.h)
 AC_TYPE_OFF_T
@@ -391,27 +301,10 @@ AC_SUBST(FILEMAP)
 dnl Some basic configuration:
 AC_DEFINE([XML_NS], 1,
           [Define to make XML Namespaces functionality available.])
-AC_DEFINE([XML_GE], 1,
-          [Define as 1/0 to enable/disable support for general entities.])
 AC_DEFINE([XML_DTD], 1,
           [Define to make parameter entity parsing functionality available.])
-
-
-have_dev_urandom=false
-
-AC_ARG_WITH([dev-urandom],
-  [AS_HELP_STRING([--with-dev-urandom],
-                  [enforce the use of /dev/urandom in the system @<:@default=no@:>@])
-AS_HELP_STRING([--without-dev-urandom],
-               [enforce not using /dev/urandom in the system @<:@default=no@:>@])],
-  [with_dev_urandom=${withval}],
-  [])
-
-AS_IF([test "x${with_dev_urandom}" = "xyes"],
-  [have_dev_urandom=true
-   AC_DEFINE([XML_DEV_URANDOM], 1,
-             [Define to include code reading entropy from `/dev/urandom'.])])
-
+AC_DEFINE([XML_DEV_URANDOM], 1,
+          [Define to include code reading entropy from `/dev/urandom'.])
 
 AC_ARG_ENABLE([xml-attr-info],
   [AS_HELP_STRING([--enable-xml-attr-info],
@@ -432,10 +325,9 @@ AS_HELP_STRING([--disable-xml-context],
 AS_IF([test "x${enable_xml_context}" != "xno"],
   [AS_IF([test "x${enable_xml_context}" = "xyes" \
             -o "x${enable_xml_context}" = "x"],
-     [AS_VAR_SET(enable_xml_context,1024)])],
-  [AS_VAR_SET(enable_xml_context,0)])
-AC_DEFINE_UNQUOTED([XML_CONTEXT_BYTES], [${enable_xml_context}],
-  [Define to specify how much context to retain around the current parse point, 0 to disable.])
+     [AS_VAR_SET(enable_xml_context,1024)])
+   AC_DEFINE_UNQUOTED([XML_CONTEXT_BYTES], [${enable_xml_context}],
+     [Define to specify how much context to retain around the current parse point.])])
 
 AC_ARG_WITH([docbook],
   [AS_HELP_STRING([--with-docbook],
@@ -459,37 +351,17 @@ AS_IF([test "x${DOCBOOK_TO_MAN}" != x -a "x$with_docbook" != xno],
   You can also configure using --without-docbook if you can do without a man
   page for xmlwf.])])])
 
-dnl This will make sure that a release tarball shipping a pre-rendered xmlwf man page will
-dnl get it installed, when no working flavor of docbook2man is available (or wanted).
-dnl This relies on file xmlwf.1 being at least as recent as its source file xmlwf.xml.
-AS_IF([test -f "${srcdir}"/doc/xmlwf.1],
-  [AM_CONDITIONAL(WITH_MANPAGE, [true])
-   AS_IF([test "x$with_docbook" = xno -o "x${DOCBOOK_TO_MAN}" = x],
-     [AM_CONDITIONAL(WITH_PREBUILT_MANPAGE, [true])
-      AM_CONDITIONAL(WITH_DISTRIBUTABLE_MANPAGE, [false])],
-     [AM_CONDITIONAL(WITH_PREBUILT_MANPAGE, [false])
-      AM_CONDITIONAL(WITH_DISTRIBUTABLE_MANPAGE, [true])])
-   ],
-  [AS_IF([test "x$with_docbook" != xno -a "x${DOCBOOK_TO_MAN}" != x],
-     [AM_CONDITIONAL(WITH_MANPAGE, [true])
-      AM_CONDITIONAL(WITH_DISTRIBUTABLE_MANPAGE, [true])],
-     [AM_CONDITIONAL(WITH_MANPAGE, [false])
-      AM_CONDITIONAL(WITH_DISTRIBUTABLE_MANPAGE, [false])])
-   AM_CONDITIONAL(WITH_PREBUILT_MANPAGE, [false])])
+AM_CONDITIONAL(WITH_DOCBOOK, [test "x${DOCBOOK_TO_MAN}" != x])
+
 
 dnl Configure CMake file templates
 dnl NOTE: The *_TRUE variables read here are Automake conditionals
 dnl       that are either set to "" when enabled or to "#" when disabled
 dnl       (because they are used to dynamically comment out certain things)
 AS_IF([test "x${enable_xml_attr_info}" = xyes],
-  [EXPAT_ATTR_INFO=ON
-   _EXPAT_COMMENT_ATTR_INFO=" "],
-  [EXPAT_ATTR_INFO=OFF
-   _EXPAT_COMMENT_ATTR_INFO="#"])
-AC_SUBST([_EXPAT_COMMENT_ATTR_INFO])
+  [EXPAT_ATTR_INFO=ON],
+  [EXPAT_ATTR_INFO=OFF])
 EXPAT_DTD=ON
-_EXPAT_COMMENT_DTD_OR_GE=" "
-AC_SUBST([_EXPAT_COMMENT_DTD_OR_GE])
 AS_IF([test "x${_INTERNAL_LARGE_SIZE_TRUE}" = x],
   [EXPAT_LARGE_SIZE=ON],
   [EXPAT_LARGE_SIZE=OFF])
@@ -511,6 +383,7 @@ LIBDIR_BASENAME="$(basename "${libdir}")"
 SO_MAJOR="$(expr "${LIBCURRENT}" - "${LIBAGE}")"
 SO_MINOR="${LIBAGE}"
 SO_PATCH="${LIBREVISION}"
+AC_CHECK_SIZEOF([void *])  # sets ac_cv_sizeof_void_p
 AC_SUBST([EXPAT_ATTR_INFO])
 AC_SUBST([EXPAT_DTD])
 AC_SUBST([EXPAT_LARGE_SIZE])
@@ -523,13 +396,8 @@ AC_SUBST([LIBDIR_BASENAME])
 AC_SUBST([SO_MAJOR])
 AC_SUBST([SO_MINOR])
 AC_SUBST([SO_PATCH])
+AC_SUBST([ac_cv_sizeof_void_p])
 
-dnl The canonical way of doing this is AC_CHECK_SIZEOF(void *), but
-dnl that adds SIZEOF_VOID_P to expat_config.h.in, making it difficult
-dnl to have 32-bit and 64-bit versions of libexpat installed on the
-dnl same system with a single, shared copy of the header.
-AC_COMPUTE_INT(SIZEOF_VOID_P, [sizeof(void *)])
-AC_SUBST([SIZEOF_VOID_P])
 
 dnl write the Automake flags we set
 AC_SUBST([AM_CPPFLAGS])
@@ -546,28 +414,17 @@ AC_MSG_RESULT([${CMAKE_SHARED_LIBRARY_PREFIX}])
 AC_SUBST([CMAKE_SHARED_LIBRARY_PREFIX])
 
 AS_CASE("${host_os}",
-  [darwin*], [
-    CMAKE_SOURCE=cmake/autotools/expat__macos.cmake.in
-    CMAKE_NOCONFIG_SOURCE=cmake/autotools/expat-noconfig__macos.cmake.in
-  ],
-  [mingw*|cygwin*], [
-    CMAKE_SOURCE=cmake/autotools/expat__windows.cmake.in
-    CMAKE_NOCONFIG_SOURCE=cmake/autotools/expat-noconfig__windows.cmake.in
-  ],
-  [
-    CMAKE_SOURCE=cmake/autotools/expat__linux.cmake.in
-    CMAKE_NOCONFIG_SOURCE=cmake/autotools/expat-noconfig__linux.cmake.in
-  ])
+  [darwin*], [CMAKE_NOCONFIG_SOURCE=cmake/autotools/expat-noconfig__macos.cmake.in],
+  [mingw*|cygwin*], [CMAKE_NOCONFIG_SOURCE=cmake/autotools/expat-noconfig__windows.cmake.in],
+  [CMAKE_NOCONFIG_SOURCE=cmake/autotools/expat-noconfig__linux.cmake.in])
 AC_CONFIG_FILES([Makefile]
   [expat.pc]
   [cmake/expat-config.cmake]
-  [cmake/autotools/expat.cmake:${CMAKE_SOURCE}]
   [cmake/autotools/expat-config-version.cmake]
   [cmake/autotools/expat-noconfig.cmake:${CMAKE_NOCONFIG_SOURCE}]
   [doc/Makefile]
   [examples/Makefile]
   [lib/Makefile]
-  [lib/libexpat.map]
   [tests/Makefile]
   [tests/benchmark/Makefile]
   [xmlwf/Makefile])
@@ -587,17 +444,4 @@ User flags (override Automake flags on conflict):
      CPPFLAGS: ${CPPFLAGS}
        CFLAGS: ${CFLAGS}
      CXXFLAGS: ${CXXFLAGS}
-      LDFLAGS: ${LDFLAGS}
-
-Entropy sources:
-             arc4random: ${have_arc4random}
-         arc4random_buf: ${have_arc4random_buf}
-             getentropy: ${have_getentropy}
-              getrandom: ${have_getrandom_function}
-  syscall SYS_getrandom: ${have_getrandom_syscall}
-           /dev/urandom: ${have_dev_urandom}
-
-Continue with e.g.:
-  make -j2
-  make check
-  sudo make install])
+      LDFLAGS: ${LDFLAGS}])

expat/conftools/ax-cxx-compile-stdcxx-11.m4

@@ -1,39 +0,0 @@
-# =============================================================================
-#  https://www.gnu.org/software/autoconf-archive/ax_cxx_compile_stdcxx_11.html
-# =============================================================================
-#
-# SYNOPSIS
-#
-#   AX_CXX_COMPILE_STDCXX_11([ext|noext], [mandatory|optional])
-#
-# DESCRIPTION
-#
-#   Check for baseline language coverage in the compiler for the C++11
-#   standard; if necessary, add switches to CXX and CXXCPP to enable
-#   support.
-#
-#   This macro is a convenience alias for calling the AX_CXX_COMPILE_STDCXX
-#   macro with the version set to C++11.  The two optional arguments are
-#   forwarded literally as the second and third argument respectively.
-#   Please see the documentation for the AX_CXX_COMPILE_STDCXX macro for
-#   more information.  If you want to use this macro, you also need to
-#   download the ax_cxx_compile_stdcxx.m4 file.
-#
-# LICENSE
-#
-#   Copyright (c) 2008 Benjamin Kosnik <bkoz@redhat.com>
-#   Copyright (c) 2012 Zack Weinberg <zackw@panix.com>
-#   Copyright (c) 2013 Roy Stogner <roystgnr@ices.utexas.edu>
-#   Copyright (c) 2014, 2015 Google Inc.; contributed by Alexey Sokolov <sokolov@google.com>
-#   Copyright (c) 2015 Paul Norman <penorman@mac.com>
-#   Copyright (c) 2015 Moritz Klammler <moritz@klammler.eu>
-#
-#   Copying and distribution of this file, with or without modification, are
-#   permitted in any medium without royalty provided the copyright notice
-#   and this notice are preserved. This file is offered as-is, without any
-#   warranty.
-
-#serial 18
-
-AX_REQUIRE_DEFINED([AX_CXX_COMPILE_STDCXX])
-AC_DEFUN([AX_CXX_COMPILE_STDCXX_11], [AX_CXX_COMPILE_STDCXX([11], [$1], [$2])])

expat/conftools/expat.m4

@@ -0,0 +1,43 @@
+dnl Check if --with-expat[=PREFIX] is specified and
+dnl Expat >= 1.95.0 is installed in the system.
+dnl If yes, substitute EXPAT_CFLAGS, EXPAT_LIBS with regard to
+dnl the specified PREFIX and set with_expat to PREFIX, or 'yes' if PREFIX
+dnl has not been specified. Also HAVE_LIBEXPAT, HAVE_EXPAT_H are defined.
+dnl If --with-expat has not been specified, set with_expat to 'no'.
+dnl In addition, an Automake conditional EXPAT_INSTALLED is set accordingly.
+dnl This is necessary to adapt a whole lot of packages that have expat
+dnl bundled as a static library.
+AC_DEFUN([AM_WITH_EXPAT],
+[ AC_ARG_WITH(expat,
+	      [  --with-expat=PREFIX     Use system Expat library],
+	      , with_expat=no)
+
+  AM_CONDITIONAL(EXPAT_INSTALLED, test $with_expat != no)
+
+  EXPAT_CFLAGS=
+  EXPAT_LIBS=
+  if test $with_expat != no; then
+	if test $with_expat != yes; then
+		EXPAT_CFLAGS="-I$with_expat/include"
+		EXPAT_LIBS="-L$with_expat/lib"
+	fi
+	AC_CHECK_LIB(expat, XML_ParserCreate,
+		     [ EXPAT_LIBS="$EXPAT_LIBS -lexpat"
+		       expat_found=yes ],
+		     [ expat_found=no ],
+		     "$EXPAT_LIBS")
+	if test $expat_found = no; then
+		AC_MSG_ERROR([Could not find the Expat library])
+	fi
+	expat_save_CFLAGS="$CFLAGS"
+	CFLAGS="$CFLAGS $EXPAT_CFLAGS"
+	AC_CHECK_HEADERS(expat.h, , expat_found=no)
+	if test $expat_found = no; then
+		AC_MSG_ERROR([Could not find expat.h])
+	fi
+	CFLAGS="$expat_save_CFLAGS"
+  fi
+
+  AC_SUBST(EXPAT_CFLAGS)
+  AC_SUBST(EXPAT_LIBS)
+])

expat/coverage.sh

@@ -6,10 +6,9 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2025 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2018      Marco Maggi <marco.maggi-ipsu@poste.it>
 # Copyright (c) 2019      Mohammed Khajapasha <mohammed.khajapasha@intel.com>
-# Copyright (c) 2026      Rosen Penev <rosenp@gmail.com>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -40,6 +39,11 @@ _get_source_dir() {
 
 
 _get_build_dir() {
+    local libbsd_part=
+    if ${with_libbsd}; then
+        libbsd_part=__libbsd
+    fi
+
     local mingw_part=
     if ${with_mingw}; then
         mingw_part=__windows
@@ -64,17 +68,7 @@ _get_build_dir() {
         m32_part=__m32
     fi
 
-    local ge_part=
-    if ${with_ge}; then
-        ge_part=__ge
-    fi
-
-    local dtd_part=
-    if ${with_dtd}; then
-        dtd_part=__dtd
-    fi
-
-    echo "build__${version}__xml_context_${xml_context}${mingw_part}${char_part}${ge_part}${dtd_part}${xml_attr_part}${m32_part}"
+    echo "build__${version}__xml_context_${xml_context}${libbsd_part}${mingw_part}${char_part}${xml_attr_part}${m32_part}"
 }
 
 
@@ -98,10 +92,9 @@ _call_cmake() {
         cmake_args+=( -DEXPAT_CONTEXT_BYTES=${xml_context} )
     fi
 
+    ${with_libbsd} && cmake_args+=( -DEXPAT_WITH_LIBBSD=ON )
     ${with_mingw} && cmake_args+=( -DCMAKE_TOOLCHAIN_FILE="${abs_source_dir}"/cmake/mingw-toolchain.cmake )
     ${with_m32} && cmake_args+=( -D_EXPAT_M32=ON )
-    ${with_ge} || cmake_args+=( -DEXPAT_GE=OFF )
-    ${with_dtd} || cmake_args+=( -DEXPAT_DTD=OFF )
 
     (
         set -x
@@ -166,7 +159,7 @@ _run() {
     ${with_unsigned_char} && BASE_FLAGS="${BASE_FLAGS} -funsigned-char"
 
     local CFLAGS="-std=c99 ${BASE_FLAGS}"
-    local CXXFLAGS="-std=c++11 ${BASE_FLAGS}"
+    local CXXFLAGS="-std=c++98 ${BASE_FLAGS}"
 
     (
         set -e
@@ -190,18 +183,8 @@ _run() {
             done
         fi
 
-        # NOTE: This is meant to mitigate Wine crashing randomly in CI
-        if ${with_mingw} && [[ ${CI} = true ]]; then
-            local retry='retry --times 5 --'
-        else
-            local retry=
-        fi
-
         set -x
-        make CTEST_OUTPUT_ON_FAILURE=1 test
-        if ${with_dtd}; then
-            ${retry} make run-xmltest
-        fi
+        make CTEST_OUTPUT_ON_FAILURE=1 test run-xmltest
 
         lcov -c -d "${capture_dir}" -o "${coverage_info}-test" &>> run.log
         lcov \
@@ -231,7 +214,7 @@ _merge_coverage_info() {
 
     mkdir -p "${coverage_dir}"
     (
-        local lcov_merge_args=( -q -q )
+        local lcov_merge_args=( -q )
         for build_dir in "${build_dirs[@]}"; do
             lcov_merge_args+=( -a "${build_dir}/${coverage_info}" )
         done
@@ -254,7 +237,7 @@ _clean_coverage_info() {
         ; do
         (
             set -x
-            lcov -q -q -o "${coverage_dir}/${coverage_info}" -r "${coverage_dir}/${coverage_info}" "${pattern}"
+            lcov -q -o "${coverage_dir}/${coverage_info}" -r "${coverage_dir}/${coverage_info}" "${pattern}"
         ) |& tee "${coverage_dir}/clean.log"
     done
 }
@@ -273,7 +256,7 @@ _show_summary() {
     local coverage_dir="$1"
     (
         set -x
-        lcov -q -q -l "${coverage_dir}/${coverage_info}"
+        lcov -q -l "${coverage_dir}/${coverage_info}"
     ) | grep -v '^\['
 }
 
@@ -306,9 +289,8 @@ _main() {
 
     # All combinations:
     with_unsigned_char=false
+    with_libbsd=false
     with_m32=false
-    with_dtd=true
-    with_ge=true
     for with_mingw in true false ; do
         for unicode_enabled in true false ; do
             if ${unicode_enabled} && ! ${with_mingw} ; then
@@ -324,10 +306,9 @@ _main() {
     done
 
     # Single cases:
+    with_libbsd=true _build_case
     with_unsigned_char=true _build_case
     with_m32=true _build_case
-    with_dtd=false with_ge=true _build_case
-    with_dtd=false with_ge=false _build_case
 
     echo
     echo 'Merging coverage files...'

expat/doc/Makefile.am

@@ -6,10 +6,9 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2024 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2017      Stephen Groat <stephen@groat.us>
 # Copyright (c) 2017      Joe Orton <jorton@redhat.com>
-# Copyright (c) 2024      Tomas Korbar <tkorbar@redhat.com>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -33,24 +32,26 @@
 
 .PHONY: dist-hook  # not inside conditional to avoid automake warning
 
-if WITH_MANPAGE
+if WITH_DOCBOOK
 dist_man_MANS = xmlwf.1
 
 xmlwf.1: xmlwf.xml
 	-rm -f $@
-	test "x$(DOCBOOK_TO_MAN)" != x && $(DOCBOOK_TO_MAN) $<
+	$(DOCBOOK_TO_MAN) $<
 	test -f $@ || mv XMLWF.1 $@
-endif
-
-if !WITH_DISTRIBUTABLE_MANPAGE
+else
 dist-hook:
 	@echo 'ERROR: Configure with --with-docbook for "make dist".' 1>&2
 	@false
 endif
 
-if !WITH_PREBUILT_MANPAGE
-CLEANFILES = xmlwf.1
-endif
+# https://www.gnu.org/software/automake/manual/automake.html#What-Gets-Cleaned
+.PHONY: clean-local
+clean-local: clean-local-check
+
+.PHONY: clean-local-check
+clean-local-check:
+	$(RM) xmlwf.1
 
 EXTRA_DIST = \
     ok.min.css \

expat/doc/ok.min.css

@@ -1,2 +1,2 @@
-/*! OK.css v1.2.0 | MIT License | github.com/andrewh0/okcss */@import url("https://rsms.me/inter/inter.css");
-/*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15}body{margin:0}main{display:block}h1{font-size:2em;margin:.67em 0}hr{box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}img{border-style:none}button,input,optgroup,select,textarea{font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em .75em .625em}legend{box-sizing:border-box;color:inherit;display:table;max-width:100%;padding:0;white-space:normal}progress{vertical-align:baseline}textarea{overflow:auto}[type=checkbox],[type=radio]{box-sizing:border-box;padding:0}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}details{display:block}summary{display:list-item}[hidden],template{display:none}:root{--ok-sans:"Inter",system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen,Ubuntu,Cantarell,"Open Sans","Helvetica Neue","Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--ok-mono:SFMono-Regular,Menlo,Monaco,Consolas,"Ubuntu Mono","Liberation Mono","Courier New",Courier,monospace;--ok-fw-0:400;--ok-fw-1:600;--ok-fw-2:700;--ok-fw-3:700;--ok-fs-0:2.5rem;--ok-fs-1:2rem;--ok-fs-2:1.5rem;--ok-fs-3:1.25rem;--ok-fs-4:1rem;--ok-fs-5:0.75rem;--ok-br:0.25rem;--ok-s-0:0;--ok-s-1:0.25rem;--ok-s-2:0.5rem;--ok-s-3:1rem;--ok-s-4:1.5rem;--ok-s-5:2rem;--ok-s-6:2.5rem;--ok-lh-body:1.5;--ok-lh-heading:1.25;--ok-t-hl:#ffcf30;--ok-accent-0:#3e67fa;--ok-accent-1:#4788ff;--ok-tc-accent:#3173de;--ok-tc-code:#c23a30;--ok-tc-0:#000;--ok-tc-1:#747474;--ok-tc-2:#848484;--ok-bg-0:#fff;--ok-bg-1:#f0f0f0;--ok-bg-2:#ccc;--ok-b-0:1px solid #cbcbcb;--ok-b-1:1px solid #848484;--ok-down-0:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23747474'/%3E%3C/svg%3E");--ok-down-1:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23848484'/%3E%3C/svg%3E")}@media (prefers-color-scheme:dark){:root{--ok-tc-accent:#5c9aff;--ok-tc-code:#ed5853;--ok-tc-0:#fff;--ok-tc-1:#ababab;--ok-tc-2:#929292;--ok-bg-0:#000;--ok-bg-1:#212121;--ok-bg-2:#3e3e3e;--ok-b-0:1px solid #747474;--ok-b-1:1px solid #929292;--ok-down-0:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23ababab'/%3E%3C/svg%3E");--ok-down-1:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23929292'/%3E%3C/svg%3E")}}*,:after,:before{box-sizing:border-box}*{margin:0;padding:0}html{font-family:var(--ok-sans);line-sizing:normal;line-height:var(--ok-lh-body);font-weight:var(--ok-fw-0);color:var(--ok-tc-0);background-color:var(--ok-bg-0);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;-webkit-text-size-adjust:100%;-moz-text-size-adjust:100%;-ms-text-size-adjust:100%;text-size-adjust:100%;text-rendering:optimizeLegibility;scroll-behavior:smooth}@supports (font-variation-settings:normal){html{font-family:Inter var,var(--ok-sans)}}button,input,optgroup,select,textarea{font-family:inherit;line-height:var(--ok-lh-body)}[role=button],button{cursor:pointer}audio,canvas,embed,iframe,img,input,object,select,svg,textarea,video{display:block}img,video{max-width:100%;height:auto}body{padding:var(--ok-s-3);max-width:80ch;margin:auto}article{padding-bottom:var(--ok-s-6)}h1{font-size:var(--ok-fs-0);margin:0}h2{font-size:var(--ok-fs-1)}h3{font-size:var(--ok-fs-2)}h4{font-size:var(--ok-fs-3)}h5{font-size:var(--ok-fs-4)}h6{font-size:var(--ok-fs-5);text-transform:uppercase;font-weight:var(--ok-fw-1)}h1,h2,h3,h4,h5,h6{line-height:var(--ok-lh-heading);fontLine truncated
+/*! OK.css v1.0.3 | MIT License | github.com/andrewh0/okcss */@import url("https://rsms.me/inter/inter.css");
+/*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15}body{margin:0}main{display:block}h1{font-size:2em;margin:.67em 0}hr{box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent}abbr[title]{border-bottom:none;text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}img{border-style:none}button,input,optgroup,select,textarea{font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em .75em .625em}legend{box-sizing:border-box;color:inherit;display:table;max-width:100%;padding:0;white-space:normal}progress{vertical-align:baseline}textarea{overflow:auto}[type=checkbox],[type=radio]{box-sizing:border-box;padding:0}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}details{display:block}summary{display:list-item}[hidden],template{display:none}:root{--ok-sans:"Inter",system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Oxygen,Ubuntu,Cantarell,"Open Sans","Helvetica Neue","Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--ok-mono:SFMono-Regular,Menlo,Monaco,Consolas,"Ubuntu Mono","Liberation Mono","Courier New",Courier,monospace;--ok-fw-0:400;--ok-fw-1:600;--ok-fw-2:700;--ok-fw-3:700;--ok-fs-0:2.5rem;--ok-fs-1:2rem;--ok-fs-2:1.5rem;--ok-fs-3:1.25rem;--ok-fs-4:1rem;--ok-fs-5:0.75rem;--ok-br:0.25rem;--ok-s-0:0;--ok-s-1:0.25rem;--ok-s-2:0.5rem;--ok-s-3:1rem;--ok-s-4:1.5rem;--ok-s-5:2rem;--ok-s-6:2.5rem;--ok-lh-body:1.5;--ok-lh-heading:1.25;--ok-t-hl:#ffcf30;--ok-accent-0:#3e67fa;--ok-accent-1:#4788ff;--ok-tc-accent:#3173de;--ok-tc-code:#c23a30;--ok-tc-0:#000;--ok-tc-1:#747474;--ok-tc-2:#848484;--ok-bg-0:#fff;--ok-bg-1:#f0f0f0;--ok-bg-2:#ccc;--ok-b-0:1px solid #cbcbcb;--ok-b-1:1px solid #848484;--ok-down-0:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23747474'/%3E%3C/svg%3E");--ok-down-1:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23848484'/%3E%3C/svg%3E")}@media (prefers-color-scheme:dark){:root{--ok-tc-accent:#5c9aff;--ok-tc-code:#ed5853;--ok-tc-0:#fff;--ok-tc-1:#ababab;--ok-tc-2:#929292;--ok-bg-0:#000;--ok-bg-1:#212121;--ok-bg-2:#3e3e3e;--ok-b-0:1px solid #747474;--ok-b-1:1px solid #929292;--ok-down-0:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23ababab'/%3E%3C/svg%3E");--ok-down-1:url("data:image/svg+xml;charset=utf-8,%3Csvg xmlns='http://www.w3.org/2000/svg' height='8' viewBox='0 0 12 8' width='24' fill='none'%3E%3Cpath d='M6 6l4-4h1v1-1L6 7 1 2h1l4 4z' fill='%23929292'/%3E%3C/svg%3E")}}*,:after,:before{box-sizing:border-box}*{margin:0;padding:0}html{font-family:var(--ok-sans);line-sizing:normal;line-height:var(--ok-lh-body);font-weight:var(--ok-fw-0);color:var(--ok-tc-0);background-color:var(--ok-bg-0);-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;-webkit-text-size-adjust:100%;-moz-text-size-adjust:100%;-ms-text-size-adjust:100%;text-size-adjust:100%;text-rendering:optimizeLegibility}@supports (font-variation-settings:normal){html{font-family:Inter var,var(--ok-sans)}}button,input,optgroup,select,textarea{font-family:inherit;line-height:var(--ok-lh-body)}[role=button],button{cursor:pointer}audio,canvas,embed,iframe,img,input,object,select,svg,textarea,video{display:block}img,video{max-width:100%;height:auto}body{padding:var(--ok-s-3);max-width:80ch;margin:auto}h1{font-size:var(--ok-fs-0);margin:0}h2{font-size:var(--ok-fs-1)}h3{font-size:var(--ok-fs-2)}h4{font-size:var(--ok-fs-3)}h5{font-size:var(--ok-fs-4)}h6{font-size:var(--ok-fs-5);text-transform:uppercase;font-weight:var(--ok-fw-1)}h1,h2,h3,h4,h5,h6{line-height:var(--ok-lh-heading);font-weight:var(--ok-fw-3)}p{font-size:var(--ok-fs-4)}small{fontLine truncated

expat/doc/xmlwf.xml

@@ -9,7 +9,7 @@
    Copyright (c) 2001      Scott Bronson <bronson@rinspin.com>
    Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2009      Karl Waclawek <karl@waclawek.net>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2016      Ardo van Rangelrooij <ardo@debian.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2020      Joe Orton <jorton@redhat.com>
@@ -21,7 +21,7 @@
           "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
   <!ENTITY dhfirstname "<firstname>Scott</firstname>">
   <!ENTITY dhsurname   "<surname>Bronson</surname>">
-  <!ENTITY dhdate      "<date>June 25, 2026</date>">
+  <!ENTITY dhdate      "<date>October 25, 2022</date>">
   <!-- Please adjust this^^ date whenever cutting a new release. -->
   <!ENTITY dhsection   "<manvolnum>1</manvolnum>">
   <!ENTITY dhemail     "<email>bronson@rinspin.com</email>">
@@ -29,8 +29,8 @@
   <!ENTITY dhucpackage "<refentrytitle>XMLWF</refentrytitle>">
   <!ENTITY dhpackage   "xmlwf">
 
+  <!ENTITY debian      "<productname>Debian GNU/Linux</productname>">
   <!ENTITY gnu         "<acronym>GNU</acronym>">
-  <!ENTITY debian      "<productname>Debian &gnu;/Linux</productname>">
 ]>
 
 <refentry>
@@ -66,17 +66,11 @@
     </cmdsynopsis>
     <cmdsynopsis>
       <command>&dhpackage;</command>
-      <group choice="plain">
-        <arg><option>-h</option></arg>
-        <arg><option>--help</option></arg>
-      </group>
+      <arg choice="plain"><option>-h</option></arg>
     </cmdsynopsis>
     <cmdsynopsis>
       <command>&dhpackage;</command>
-      <group choice="plain">
-        <arg><option>-v</option></arg>
-        <arg><option>--version</option></arg>
-      </group>
+      <arg choice="plain"><option>-v</option></arg>
     </cmdsynopsis>
   </refsynopsisdiv>
  
@@ -84,77 +78,73 @@
     <title>DESCRIPTION</title>
 
     <para>
-      <command>&dhpackage;</command> uses the Expat library to
-      determine if an XML document is well-formed.  It is
-      non-validating.
-    </para>
-    <para>
-      If you do not specify any files on the command-line, and you
-      have a recent version of <command>&dhpackage;</command>, the
-      input file will be read from standard input.
-    </para>
+	<command>&dhpackage;</command> uses the Expat library to
+	determine if an XML document is well-formed.  It is
+	non-validating.
+	</para>
+
+	<para>
+	If you do not specify any files on the command-line, and you
+	have a recent version of <command>&dhpackage;</command>, the
+	input file will be read from standard input.
+	</para>
 
   </refsect1>
 
   <refsect1>
     <title>WELL-FORMED DOCUMENTS</title>
-    <para>
-      A well-formed document must adhere to the
-      following rules:
-    </para>
-    <itemizedlist>
-      <listitem>
-        <para>
-          The file begins with an XML declaration.  For instance,
-          <literal>&lt;?xml version="1.0" standalone="yes"?&gt;</literal>.
-          <emphasis>NOTE</emphasis>:
-          <command>&dhpackage;</command> does not currently
-          check for a valid XML declaration.
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          Every start tag is either empty (&lt;tag/&gt;)
-          or has a corresponding end tag.
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          There is exactly one root element.  This element must contain
-          all other elements in the document.  Only comments, white
-          space, and processing instructions may come after the close
-          of the root element.
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          All elements nest properly.
-        </para>
-      </listitem>
-      <listitem>
-        <para>
-          All attribute values are enclosed in quotes (either single
-          or double).
-        </para>
-      </listitem>
+
+	<para>
+	  A well-formed document must adhere to the
+	  following rules:
+	</para>
+
+	<itemizedlist>
+      <listitem><para>
+	    The file begins with an XML declaration.  For instance,
+		<literal>&lt;?xml version="1.0" standalone="yes"?&gt;</literal>.
+		<emphasis>NOTE</emphasis>:
+		<command>&dhpackage;</command> does not currently
+		check for a valid XML declaration.
+      </para></listitem>
+      <listitem><para>
+		Every start tag is either empty (&lt;tag/&gt;)
+		or has a corresponding end tag.
+      </para></listitem>
+      <listitem><para>
+	    There is exactly one root element.  This element must contain
+		all other elements in the document.  Only comments, white
+		space, and processing instructions may come after the close
+		of the root element.
+      </para></listitem>
+      <listitem><para>
+		All elements nest properly.
+      </para></listitem>
+      <listitem><para>
+		All attribute values are enclosed in quotes (either single
+		or double).
+      </para></listitem>
     </itemizedlist>
-    <para>
-      If the document has a DTD, and it strictly complies with that
-      DTD, then the document is also considered <emphasis>valid</emphasis>.
-      <command>&dhpackage;</command> is a non-validating parser --
-      it does not check the DTD.  However, it does support
-      external entities (see the <option>-x</option> option).
-    </para>
+
+	<para>
+	  If the document has a DTD, and it strictly complies with that
+	  DTD, then the document is also considered <emphasis>valid</emphasis>.
+	  <command>&dhpackage;</command> is a non-validating parser --
+	  it does not check the DTD.  However, it does support
+	  external entities (see the <option>-x</option> option).
+	</para>
   </refsect1>
 
   <refsect1>
     <title>OPTIONS</title>
-    <para>
-      When an option includes an argument, you may specify the argument either
-      separately ("<option>-d</option> <replaceable>output</replaceable>") or concatenated with the
-      option ("<option>-d</option><replaceable>output</replaceable>").  <command>&dhpackage;</command>
-      supports both.
-    </para>
+
+<para>
+When an option includes an argument, you may specify the argument either
+separately ("<option>-d</option> <replaceable>output</replaceable>") or concatenated with the
+option ("<option>-d</option><replaceable>output</replaceable>").  <command>&dhpackage;</command>
+supports both.
+</para>
+
     <variablelist>
 
       <varlistentry>
@@ -162,31 +152,19 @@
         <listitem>
           <para>
             Sets the maximum tolerated amplification factor
-            for protection against amplification attacks
-            like the billion laughs attack
-            (default: 100.0
-            for the sum of direct and indirect output and also
-            for allocations of dynamic memory).
+            for protection against billion laughs attacks (default: 100.0).
             The amplification factor is calculated as ..
           </para>
           <literallayout>
-    amplification := (direct + indirect) / direct
+            amplification := (direct + indirect) / direct
           </literallayout>
           <para>
-            .. with regard to use of entities and ..
-          </para>
-          <literallayout>
-    amplification := allocated / direct
-          </literallayout>
-          <para>
-            .. with regard to dynamic memory while parsing.
+            .. while parsing, whereas
             &lt;direct&gt; is the number of bytes read
-              from the primary document in parsing,
+              from the primary document in parsing and
             &lt;indirect&gt; is the number of bytes
               added by expanding entities and reading of external DTD files,
-              combined, and
-            &lt;allocated&gt; is the total number of bytes of dynamic memory
-              allocated (and not freed) per hierarchy of parsers.
+              combined.
           </para>
           <para>
             <emphasis>NOTE</emphasis>:
@@ -201,10 +179,8 @@
         <listitem>
           <para>
             Sets the number of output bytes (including amplification)
-            needed to activate protection against amplification attacks
-            like billion laughs
-            (default: 8 MiB for the sum of direct and indirect output,
-            and 64 MiB for allocations of dynamic memory).
+            needed to activate protection against billion laughs attacks
+            (default: 8 MiB).
             This can be thought of as an &quot;activation threshold&quot;.
           </para>
           <para>
@@ -218,83 +194,60 @@
       <varlistentry>
         <term><option>-c</option></term>
         <listitem>
-          <para>
-            If the input file is well-formed and <command>&dhpackage;</command>
-            doesn't encounter any errors, the input file is simply copied to
-            the output directory unchanged.
-            This implies no namespaces (turns off <option>-n</option>) and
-            requires <option>-d</option> to specify an output directory.
-          </para>
+		<para>
+  If the input file is well-formed and <command>&dhpackage;</command>
+  doesn't encounter any errors, the input file is simply copied to
+  the output directory unchanged.
+  This implies no namespaces (turns off <option>-n</option>) and
+  requires <option>-d</option> to specify an output directory.
+  		</para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-d</option> <replaceable>output-dir</replaceable></term>
         <listitem>
-          <para>
-            Specifies a directory to contain transformed
-            representations of the input files.
-            By default, <option>-d</option> outputs a canonical representation
-            (described below).
-            You can select different output formats using <option>-c</option>,
-            <option>-m</option> and <option>-N</option>.
-          </para>
-          <para>
-            The output filenames will
-            be exactly the same as the input filenames or "STDIN" if the input is
-            coming from standard input.  Therefore, you must be careful that the
-            output file does not go into the same directory as the input
-            file.  Otherwise, <command>&dhpackage;</command> will delete the
-            input file before it generates the output file (just like running
-            <literal>cat &lt; file &gt; file</literal> in most shells).
-          </para>
-          <para> 
-            Two structurally equivalent XML documents have a byte-for-byte
-            identical canonical XML representation.
-            Note that ignorable white space is considered significant and
-            is treated equivalently to data.
-            More on canonical XML can be found at
-            http://www.jclark.com/xml/canonxml.html .
-          </para>
+		<para>
+  Specifies a directory to contain transformed
+  representations of the input files.
+  By default, <option>-d</option> outputs a canonical representation
+  (described below).
+  You can select different output formats using <option>-c</option>,
+  <option>-m</option> and <option>-N</option>.
+	  </para>
+	  <para>
+  The output filenames will
+  be exactly the same as the input filenames or "STDIN" if the input is
+  coming from standard input.  Therefore, you must be careful that the
+  output file does not go into the same directory as the input
+  file.  Otherwise, <command>&dhpackage;</command> will delete the
+  input file before it generates the output file (just like running
+  <literal>cat &lt; file &gt; file</literal> in most shells).
+	  </para>
+	  <para> 
+  Two structurally equivalent XML documents have a byte-for-byte
+  identical canonical XML representation.
+  Note that ignorable white space is considered significant and
+  is treated equivalently to data.
+  More on canonical XML can be found at
+  http://www.jclark.com/xml/canonxml.html .
+	  </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-e</option> <replaceable>encoding</replaceable></term>
         <listitem>
-          <para>
-            Specifies the character encoding for the document, overriding
-            any document encoding declaration.  <command>&dhpackage;</command>
-            supports four built-in encodings:
-            <literal>US-ASCII</literal>,
-            <literal>UTF-8</literal>,
-            <literal>UTF-16</literal>, and
-            <literal>ISO-8859-1</literal>.
-            Also see the <option>-w</option> option.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>-g</option> <replaceable>bytes</replaceable></term>
-        <listitem>
-          <para>
-            Sets the buffer size to request per call pair to
-            <function>XML_GetBuffer</function> and <function>read</function>
-            (default: 8 KiB).
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>-h</option></term>
-        <term><option>--help</option></term>
-        <listitem>
-          <para>
-            Prints short usage information on command <command>&dhpackage;</command>,
-            and then exits.
-            Similar to this man page but more concise.
-          </para>
+		<para>
+   Specifies the character encoding for the document, overriding
+   any document encoding declaration.  <command>&dhpackage;</command>
+   supports four built-in encodings:
+   	<literal>US-ASCII</literal>,
+	<literal>UTF-8</literal>,
+	<literal>UTF-16</literal>, and
+	<literal>ISO-8859-1</literal>.
+   Also see the <option>-w</option> option.
+	   </para>
         </listitem>
       </varlistentry>
 
@@ -316,21 +269,21 @@
       <varlistentry>
         <term><option>-m</option></term>
         <listitem>
-          <para>
-            Outputs some strange sort of XML file that completely
-            describes the input file, including character positions.
-            Requires <option>-d</option> to specify an output file.
-          </para>
+		<para>
+  Outputs some strange sort of XML file that completely
+  describes the input file, including character positions.
+  Requires <option>-d</option> to specify an output file.
+	   </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-n</option></term>
         <listitem>
-          <para>
-            Turns on namespace processing.  (describe namespaces)
-            <option>-c</option> disables namespaces.
-          </para>
+		<para>
+  Turns on namespace processing.  (describe namespaces)
+  <option>-c</option> disables namespaces.
+	   </para>
         </listitem>
       </varlistentry>
 
@@ -338,9 +291,9 @@
         <term><option>-N</option></term>
         <listitem>
           <para>
-            Adds a doctype and notation declarations to canonical XML output.
-            This matches the example output used by the formal XML test cases.
-            Requires <option>-d</option> to specify an output file.
+  Adds a doctype and notation declarations to canonical XML output.
+  This matches the example output used by the formal XML test cases.
+  Requires <option>-d</option> to specify an output file.
           </para>
         </listitem>
       </varlistentry>
@@ -348,176 +301,167 @@
       <varlistentry>
         <term><option>-p</option></term>
         <listitem>
-          <para>
-            Tells <command>&dhpackage;</command> to process external DTDs and parameter
-            entities.
-          </para>
-          <para>
-            Normally <command>&dhpackage;</command> never parses parameter
-            entities.  <option>-p</option> tells it to always parse them.
-            <option>-p</option> implies <option>-x</option>.
-          </para>
-        </listitem>
-      </varlistentry>
-
-      <varlistentry>
-        <term><option>-q</option></term>
-        <listitem>
-          <para>
-            Disable reparse deferral, and allow quadratic parse runtime
-            on large tokens (default: reparse deferral enabled).
-          </para>
+		<para>
+    Tells <command>&dhpackage;</command> to process external DTDs and parameter
+    entities.
+	 </para>
+	 <para>
+   Normally <command>&dhpackage;</command> never parses parameter
+   entities.  <option>-p</option> tells it to always parse them.
+   <option>-p</option> implies <option>-x</option>.
+	   </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-r</option></term>
         <listitem>
-          <para>
-            Normally <command>&dhpackage;</command> memory-maps the XML file
-            before parsing; this can result in faster parsing on many
-            platforms.
-            <option>-r</option> turns off memory-mapping and uses normal file
-            IO calls instead.
-            Of course, memory-mapping is automatically turned off
-            when reading from standard input.
-          </para>
-          <para>
-            Use of memory-mapping can cause some platforms to report
-            substantially higher memory usage for
-            <command>&dhpackage;</command>, but this appears to be a matter of
-            the operating system reporting memory in a strange way; there is
-            not a leak in <command>&dhpackage;</command>.
-          </para>
+		<para>
+   Normally <command>&dhpackage;</command> memory-maps the XML file
+   before parsing; this can result in faster parsing on many
+   platforms.
+   <option>-r</option> turns off memory-mapping and uses normal file
+   IO calls instead.
+   Of course, memory-mapping is automatically turned off
+   when reading from standard input.
+	   </para>
+		<para>
+   Use of memory-mapping can cause some platforms to report
+   substantially higher memory usage for
+   <command>&dhpackage;</command>, but this appears to be a matter of
+   the operating system reporting memory in a strange way; there is
+   not a leak in <command>&dhpackage;</command>.
+           </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-s</option></term>
         <listitem>
-          <para>
-            Prints an error if the document is not standalone.
-            A document is standalone if it has no external subset and no
-            references to parameter entities.
-          </para>
+		<para>
+  Prints an error if the document is not standalone. 
+  A document is standalone if it has no external subset and no
+  references to parameter entities.
+	   </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-t</option></term>
         <listitem>
-          <para>
-            Turns on timings.  This tells Expat to parse the entire file,
-            but not perform any processing.
-            This gives a fairly accurate idea of the raw speed of Expat itself
-            without client overhead.
-            <option>-t</option> turns off most of the output options
-            (<option>-d</option>, <option>-m</option>, <option>-c</option>, ...).
-          </para>
+		<para>
+  Turns on timings.  This tells Expat to parse the entire file,
+  but not perform any processing.
+  This gives a fairly accurate idea of the raw speed of Expat itself
+  without client overhead.
+  <option>-t</option> turns off most of the output options
+  (<option>-d</option>, <option>-m</option>, <option>-c</option>, ...).
+	   </para>
         </listitem>
       </varlistentry>
       
       <varlistentry>
         <term><option>-v</option></term>
-        <term><option>--version</option></term>
         <listitem>
-          <para>
-            Prints the version of the Expat library being used, including some
-            information on the compile-time configuration of the library, and
-            then exits.
-          </para>
+		<para>
+  Prints the version of the Expat library being used, including some
+  information on the compile-time configuration of the library, and
+  then exits.
+	   </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-w</option></term>
         <listitem>
-          <para>
-            Enables support for Windows code pages.
-            Normally, <command>&dhpackage;</command> will throw an error if it
-            runs across an encoding that it is not equipped to handle itself.  With
-            <option>-w</option>, <command>&dhpackage;</command> will try to use a Windows code
-            page.  See also <option>-e</option>.
-          </para>
+		<para>
+  Enables support for Windows code pages.
+  Normally, <command>&dhpackage;</command> will throw an error if it
+  runs across an encoding that it is not equipped to handle itself.  With
+  <option>-w</option>, <command>&dhpackage;</command> will try to use a Windows code
+  page.  See also <option>-e</option>.
+	   </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>-x</option></term>
         <listitem>
-          <para>
-            Turns on parsing external entities.
-            (CAREFUL! This makes xmlwf vulnerable to external entity attacks (XXE).)
-          </para>
-          <para>
-            Non-validating parsers are not required to resolve external
-            entities, or even expand entities at all.
-            Expat always expands internal entities (?),
-            but external entity parsing must be enabled explicitly.
-          </para>
-          <para>
-            External entities are simply entities that obtain their
-            data from outside the XML file currently being parsed.
-          </para>
-          <para>
-            This is an example of an internal entity:
-            <literallayout>
+		<para>
+  Turns on parsing external entities.
+  </para>
+<para>
+  Non-validating parsers are not required to resolve external
+  entities, or even expand entities at all.
+  Expat always expands internal entities (?),
+  but external entity parsing must be enabled explicitly.
+  </para>
+  <para>
+  External entities are simply entities that obtain their
+  data from outside the XML file currently being parsed.
+  </para>
+  <para>
+  This is an example of an internal entity:
+<literallayout>
 &lt;!ENTITY vers '1.0.2'&gt;
-            </literallayout>
-          </para>
-          <para>
-            And here are some examples of external entities:
+</literallayout>
+  </para>
+  <para>
+  And here are some examples of external entities:
 
-            <literallayout>
+<literallayout>
 &lt;!ENTITY header SYSTEM "header-&amp;vers;.xml"&gt;  (parsed)
 &lt;!ENTITY logo SYSTEM "logo.png" PNG&gt;         (unparsed)
-            </literallayout>
-          </para>
+</literallayout>
+
+	   </para>
         </listitem>
       </varlistentry>
 
       <varlistentry>
         <term><option>--</option></term>
         <listitem>
-          <para>
-            (Two hyphens.)
-            Terminates the list of options.  This is only needed if a filename
-            starts with a hyphen.  For example:
-          </para>
-          <literallayout>
+		<para>
+    (Two hyphens.)
+    Terminates the list of options.  This is only needed if a filename
+    starts with a hyphen.  For example:
+	   </para>
+<literallayout>
 &dhpackage; -- -myfile.xml
-          </literallayout>
-          <para>
-            will run <command>&dhpackage;</command> on the file
-            <filename>-myfile.xml</filename>.
-          </para>
+</literallayout>
+		<para>
+    will run <command>&dhpackage;</command> on the file
+    <filename>-myfile.xml</filename>.
+	   </para>
         </listitem>
       </varlistentry>
     </variablelist>
+
+	<para>
+    Older versions of <command>&dhpackage;</command> do not support
+    reading from standard input.
+	</para>
+  </refsect1>
+
+  <refsect1>
+  <title>OUTPUT</title>
     <para>
-      Older versions of <command>&dhpackage;</command> do not support
-      reading from standard input.
+	<command>&dhpackage;</command> outputs nothing for files which are problem-free.
+        If any input file is not well-formed, or if the output for any
+	input file cannot be opened, <command>&dhpackage;</command> prints a single
+	line describing	the problem to standard output.
+    </para>
+    <para>
+        If the <option>-k</option> option is not provided, <command>&dhpackage;</command>
+	halts upon encountering a well-formedness or output-file error. 
+	If <option>-k</option> is provided, <command>&dhpackage;</command> continues
+	processing the remaining input files, describing problems found with any of them.
     </para>
   </refsect1>
 
   <refsect1>
-    <title>OUTPUT</title>
-    <para><command>&dhpackage;</command> outputs nothing for files which are problem-free.
-      If any input file is not well-formed, or if the output for any
-      input file cannot be opened, <command>&dhpackage;</command> prints a single
-      line describing	the problem to standard output.
-    </para>
-    <para>
-      If the <option>-k</option> option is not provided, <command>&dhpackage;</command>
-      halts upon encountering a well-formedness or output-file error.
-      If <option>-k</option> is provided, <command>&dhpackage;</command> continues
-      processing the remaining input files, describing problems found with any of them.
-    </para>
-  </refsect1>
-
-  <refsect1>
-    <title>EXIT STATUS</title>
-    <para>For options <option>-v</option>|<option>--version</option> or <option>-h</option>|<option>--help</option>, <command>&dhpackage;</command> always exits with status code 0.  For other cases, the following exit status codes are returned:
+  <title>EXIT STATUS</title>
+    <para>For option <option>-v</option> or <option>-h</option>, <command>&dhpackage;</command> always exits with status code 0.  For other cases, the following exit status codes are returned:
     <variablelist>
       <varlistentry>
         <term><option>0</option></term>
@@ -545,37 +489,39 @@
         </listitem>
       </varlistentry>
     </variablelist>
-  </para>
+	</para>
   </refsect1>
 
   
   <refsect1>
     <title>BUGS</title>
-    <para>
-      The errors should go to standard error, not standard output.
-    </para>
-    <para>
-      There should be a way to get <option>-d</option> to send its
-      output to standard output rather than forcing the user to send
-      it to a file.
-    </para>
-    <para>
-      I have no idea why anyone would want to use the
-      <option>-d</option>, <option>-c</option>, and
-      <option>-m</option> options.  If someone could explain it to
-      me, I'd like to add this information to this manpage.
-    </para>
+	<para>
+	The errors should go to standard error, not standard output.
+	</para>
+	<para>
+	There should be a way to get <option>-d</option> to send its
+	output to standard output rather than forcing the user to send
+	it to a file.
+	</para>
+	<para>
+	I have no idea why anyone would want to use the
+	<option>-d</option>, <option>-c</option>, and
+	<option>-m</option> options.  If someone could explain it to
+	me, I'd like to add this information to this manpage.
+	</para>
   </refsect1>
 
   <refsect1>
     <title>SEE ALSO</title>
-    <para>
-      <literallayout>
+	<para>
+
+<literallayout>
 The Expat home page:                            https://libexpat.github.io/
 The W3 XML 1.0 specification (fourth edition):  https://www.w3.org/TR/2006/REC-xml-20060816/
 Billion laughs attack:                          https://en.wikipedia.org/wiki/Billion_laughs_attack
-      </literallayout>
-    </para>
+</literallayout>
+
+	</para>
   </refsect1>
 
   <refsect1>
@@ -585,8 +531,8 @@ Billion laughs attack:                          https://en.wikipedia.org/wiki/Bi
       in December 2001 for
       the &debian; system (but may be used by others).  Permission is
       granted to copy, distribute and/or modify this document under
-      the terms of the &gnu; Free Documentation
+      the terms of the <acronym>GNU</acronym> Free Documentation
       License, Version 1.1.
-  </para>
+	</para>
   </refsect1>
 </refentry>

expat/examples/.gitignore

@@ -1,6 +1,4 @@
 Makefile
-element_declarations
-element_declarations.plg
 elements
 elements.plg
 outline

expat/examples/element_declarations.c

@@ -12,11 +12,9 @@
    Copyright (c) 2001-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2004-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2005-2007 Steven Solie <steven@solie.ca>
-   Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2019      Zhongyuan Zhou <zhouzhongyuan@huawei.com>
-   Copyright (c) 2024      Hanno Böck <hanno@gentoo.org>
-   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -83,7 +81,7 @@ stackPopFree(Stack *stackTop) {
   return newStackTop;
 }
 
-static const char *
+static char *
 contentTypeName(enum XML_Content_Type contentType) {
   switch (contentType) {
   case XML_CTYPE_EMPTY:
@@ -103,7 +101,7 @@ contentTypeName(enum XML_Content_Type contentType) {
   }
 }
 
-static const char *
+static char *
 contentQuantName(enum XML_Content_Quant contentQuant) {
   switch (contentQuant) {
   case XML_CQUANT_NONE:
@@ -129,22 +127,23 @@ dumpContentModelElement(const XML_Content *model, unsigned level,
   }
 
   // Node
-  printf("[%u] type=%s(%u), quant=%s(%u)", (unsigned)(model - root),
-         contentTypeName(model->type), (unsigned int)model->type,
-         contentQuantName(model->quant), (unsigned int)model->quant);
+  printf("[%u] type=%s(%d), quant=%s(%d)", (unsigned)(model - root),
+         contentTypeName(model->type), model->type,
+         contentQuantName(model->quant), model->quant);
   if (model->name) {
     printf(", name=\"%" XML_FMT_STR "\"", model->name);
   } else {
     printf(", name=NULL");
   }
-  printf(", numchildren=%u", model->numchildren);
+  printf(", numchildren=%d", model->numchildren);
   printf("\n");
 }
 
 static bool
 dumpContentModel(const XML_Char *name, const XML_Content *root) {
   printf("Element \"%" XML_FMT_STR "\":\n", name);
-  Stack *stackTop = stackPushMalloc(NULL, root, 1);
+  Stack *stackTop = NULL;
+  stackTop = stackPushMalloc(stackTop, root, 1);
   if (! stackTop) {
     return false;
   }
@@ -158,17 +157,11 @@ dumpContentModel(const XML_Char *name, const XML_Content *root) {
     stackTop = stackPopFree(stackTop);
 
     for (size_t u = model->numchildren; u >= 1; u--) {
-      Stack *const newStackTop
+      stackTop
           = stackPushMalloc(stackTop, model->children + (u - 1), level + 1);
-      if (! newStackTop) {
-        // We ran out of memory, so let's free all memory allocated
-        // earlier in this function, to be leak-clean:
-        while (stackTop != NULL) {
-          stackTop = stackPopFree(stackTop);
-        }
+      if (! stackTop) {
         return false;
       }
-      stackTop = newStackTop;
     }
   }
 

expat/expat.pc.cmake

@@ -10,4 +10,3 @@ URL: https://libexpat.github.io/
 Libs: -L${libdir} -l$<TARGET_PROPERTY:expat,pkgconfig_$<LOWER_CASE:$<CONFIG>>_output_name>
 Libs.private: $<TARGET_PROPERTY:expat,pkgconfig_libm>
 Cflags: -I${includedir}
-Cflags.private: -DXML_STATIC

expat/expat.pc.in

@@ -10,4 +10,3 @@ URL: https://libexpat.github.io/
 Libs: -L${libdir} -l@PACKAGE_NAME@
 Libs.private: @LIBM@
 Cflags: -I${includedir}
-Cflags.private: -DXML_STATIC

expat/expat_config.h.cmake

@@ -1,7 +1,7 @@
 /* expat_config.h.cmake.  Based upon generated expat_config.h.in.  */
 
 #ifndef EXPAT_CONFIG_H
-#  define EXPAT_CONFIG_H 1
+#define EXPAT_CONFIG_H 1
 
 /* 1234 = LIL_ENDIAN, 4321 = BIGENDIAN */
 #cmakedefine BYTEORDER @BYTEORDER@
@@ -24,12 +24,12 @@
 /* Define to 1 if you have the `getrandom' function. */
 #cmakedefine HAVE_GETRANDOM
 
-/* Define to 1 if you have the `getentropy' function. */
-#cmakedefine HAVE_GETENTROPY
-
 /* Define to 1 if you have the <inttypes.h> header file. */
 #cmakedefine HAVE_INTTYPES_H
 
+/* Define to 1 if you have the `bsd' library (-lbsd). */
+#cmakedefine HAVE_LIBBSD
+
 /* Define to 1 if you have the <memory.h> header file. */
 #cmakedefine HAVE_MEMORY_H
 
@@ -61,7 +61,7 @@
 #cmakedefine HAVE_UNISTD_H
 
 /* Name of package */
-#  define PACKAGE "@PACKAGE_NAME@"
+#define PACKAGE "@PACKAGE_NAME@"
 
 /* Define to the address where bug reports for this package should be sent. */
 #cmakedefine PACKAGE_BUGREPORT "@PACKAGE_BUGREPORT@"
@@ -76,15 +76,13 @@
 #cmakedefine PACKAGE_TARNAME "@PACKAGE_TARNAME@"
 
 /* Define to the home page for this package. */
-#  define PACKAGE_URL ""
+#define PACKAGE_URL ""
 
 /* Define to the version of this package. */
 #cmakedefine PACKAGE_VERSION "@PACKAGE_VERSION@"
 
 /* Define to 1 if you have the ANSI C header files. */
-#  ifndef STDC_HEADERS
 #cmakedefine STDC_HEADERS
-#  endif
 
 /* whether byteorder is bigendian */
 #cmakedefine WORDS_BIGENDIAN
@@ -94,29 +92,29 @@
 #cmakedefine XML_ATTR_INFO
 
 /* Define to specify how much context to retain around the current parse
-   point, 0 to disable. */
-#  define XML_CONTEXT_BYTES @XML_CONTEXT_BYTES@
+   point. */
+#cmakedefine XML_CONTEXT_BYTES @XML_CONTEXT_BYTES@
 
-#  if ! defined(_WIN32)
+#if ! defined(_WIN32)
 /* Define to include code reading entropy from `/dev/urandom'. */
 #cmakedefine XML_DEV_URANDOM
-#  endif
+#endif
 
 /* Define to make parameter entity parsing functionality available. */
 #cmakedefine XML_DTD
 
-/* Define as 1/0 to enable/disable support for general entities. */
-#  define XML_GE @XML_GE@
-
 /* Define to make XML Namespaces functionality available. */
 #cmakedefine XML_NS
 
 /* Define to __FUNCTION__ or "" if `__func__' does not conform to ANSI C. */
-#  ifdef _MSC_VER
-#    define __func__ __FUNCTION__
-#  endif
+#ifdef _MSC_VER
+#  define __func__ __FUNCTION__
+#endif
 
 /* Define to `long' if <sys/types.h> does not define. */
 #cmakedefine off_t @off_t@
 
+/* Define to `unsigned' if <sys/types.h> does not define. */
+#cmakedefine size_t @size_t@
+
 #endif // ndef EXPAT_CONFIG_H

expat/fix-xmltest-log.sh

@@ -6,8 +6,7 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2019-2026 Sebastian Pipping <sebastian@pipping.org>
-# Copyright (c) 2024      Dag-Erling Smørgrav <des@des.dev>
+# Copyright (c) 2019-2022 Sebastian Pipping <sebastian@pipping.org>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -31,13 +30,12 @@
 
 set -e
 
-sed="$(type -P gsed sed false | head -n 1)"  # e.g. for Solaris
 filename="${1:-tests/xmltest.log}"
 
-exec "${sed}" -i.bak \
-        -e '# convert DOS line endings to Unix without resorting to dos2unix' \
-        -e $'s/\r//' \
-        \
+dos2unix "${filename}"
+
+tempfile="$(mktemp)"
+sed \
         -e 's/^wine: Call .* msvcrt\.dll\._wperror, aborting$/ibm49i02.dtd: No such file or directory/' \
         \
         -e '/^wine: /d' \
@@ -48,4 +46,5 @@ exec "${sed}" -i.bak \
         -e '/^wine client error:/d' \
         -e '/^In ibm\/invalid\/P49\/: Unhandled exception: unimplemented .\+/d' \
         \
-        "${filename}"
+        "${filename}" > "${tempfile}"
+mv "${tempfile}" "${filename}"

expat/fuzz/xml_lpm_fuzzer.cpp

@@ -1,466 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2022 Mark Brand <markbrand@google.com>
-   Copyright (c) 2025 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#if defined(NDEBUG)
-#  undef NDEBUG // because checks below rely on assert(...)
-#endif
-
-#include <assert.h>
-#include <stdint.h>
-#include <vector>
-
-#include "expat.h"
-#include "xml_lpm_fuzzer.pb.h"
-#include "src/libfuzzer/libfuzzer_macro.h"
-
-static const char *g_encoding = nullptr;
-static const char *g_external_entity = nullptr;
-static size_t g_external_entity_size = 0;
-
-void
-SetEncoding(const xml_lpm_fuzzer::Encoding &e) {
-  switch (e) {
-  case xml_lpm_fuzzer::Encoding::UTF8:
-    g_encoding = "UTF-8";
-    break;
-
-  case xml_lpm_fuzzer::Encoding::UTF16:
-    g_encoding = "UTF-16";
-    break;
-
-  case xml_lpm_fuzzer::Encoding::ISO88591:
-    g_encoding = "ISO-8859-1";
-    break;
-
-  case xml_lpm_fuzzer::Encoding::ASCII:
-    g_encoding = "US-ASCII";
-    break;
-
-  case xml_lpm_fuzzer::Encoding::NONE:
-    g_encoding = NULL;
-    break;
-
-  default:
-    g_encoding = "UNKNOWN";
-    break;
-  }
-}
-
-static int g_allocation_count = 0;
-static std::vector<int> g_fail_allocations = {};
-
-void *
-MallocHook(size_t size) {
-  g_allocation_count += 1;
-  for (auto index : g_fail_allocations) {
-    if (index == g_allocation_count) {
-      return NULL;
-    }
-  }
-  return malloc(size);
-}
-
-void *
-ReallocHook(void *ptr, size_t size) {
-  g_allocation_count += 1;
-  for (auto index : g_fail_allocations) {
-    if (index == g_allocation_count) {
-      return NULL;
-    }
-  }
-  return realloc(ptr, size);
-}
-
-void
-FreeHook(void *ptr) {
-  free(ptr);
-}
-
-XML_Memory_Handling_Suite memory_handling_suite
-    = {MallocHook, ReallocHook, FreeHook};
-
-void InitializeParser(XML_Parser parser);
-
-// We want a parse function that supports resumption, so that we can cover the
-// suspend/resume code.
-enum XML_Status
-Parse(XML_Parser parser, const char *input, int input_len, int is_final) {
-  enum XML_Status status = XML_Parse(parser, input, input_len, is_final);
-  while (status == XML_STATUS_SUSPENDED) {
-    status = XML_ResumeParser(parser);
-  }
-  return status;
-}
-
-// When the fuzzer is compiled with instrumentation such as ASan, then the
-// accesses in TouchString will fault if they access invalid memory (ie. detect
-// either a use-after-free or buffer-overflow). By calling TouchString in each
-// of the callbacks, we can check that the arguments meet the API specifications
-// in terms of length/null-termination. no_optimize is used to ensure that the
-// compiler has to emit actual memory reads, instead of removing them.
-static volatile size_t no_optimize = 0;
-static void
-TouchString(const XML_Char *ptr, int len = -1) {
-  if (! ptr) {
-    return;
-  }
-
-  if (len == -1) {
-    for (XML_Char value = *ptr++; value; value = *ptr++) {
-      no_optimize += value;
-    }
-  } else {
-    for (int i = 0; i < len; ++i) {
-      no_optimize += ptr[i];
-    }
-  }
-}
-
-static void
-TouchNodeAndRecurse(XML_Content *content) {
-  switch (content->type) {
-  case XML_CTYPE_EMPTY:
-  case XML_CTYPE_ANY:
-    assert(content->quant == XML_CQUANT_NONE);
-    assert(content->name == NULL);
-    assert(content->numchildren == 0);
-    assert(content->children == NULL);
-    break;
-
-  case XML_CTYPE_MIXED:
-    assert(content->quant == XML_CQUANT_NONE
-           || content->quant == XML_CQUANT_REP);
-    assert(content->name == NULL);
-    for (unsigned int i = 0; i < content->numchildren; ++i) {
-      assert(content->children[i].type == XML_CTYPE_NAME);
-      assert(content->children[i].quant == XML_CQUANT_NONE);
-      assert(content->children[i].numchildren == 0);
-      assert(content->children[i].children == NULL);
-      TouchString(content->children[i].name);
-    }
-    break;
-
-  case XML_CTYPE_NAME:
-    assert((content->quant == XML_CQUANT_NONE)
-           || (content->quant == XML_CQUANT_OPT)
-           || (content->quant == XML_CQUANT_REP)
-           || (content->quant == XML_CQUANT_PLUS));
-    assert(content->numchildren == 0);
-    assert(content->children == NULL);
-    TouchString(content->name);
-    break;
-
-  case XML_CTYPE_CHOICE:
-  case XML_CTYPE_SEQ:
-    assert((content->quant == XML_CQUANT_NONE)
-           || (content->quant == XML_CQUANT_OPT)
-           || (content->quant == XML_CQUANT_REP)
-           || (content->quant == XML_CQUANT_PLUS));
-    assert(content->name == NULL);
-    for (unsigned int i = 0; i < content->numchildren; ++i) {
-      TouchNodeAndRecurse(&content->children[i]);
-    }
-    break;
-
-  default:
-    assert(false);
-  }
-}
-
-static void XMLCALL
-ElementDeclHandler(void *userData, const XML_Char *name, XML_Content *model) {
-  TouchString(name);
-  TouchNodeAndRecurse(model);
-  XML_FreeContentModel((XML_Parser)userData, model);
-}
-
-static void XMLCALL
-AttlistDeclHandler(void *userData, const XML_Char *elname,
-                   const XML_Char *attname, const XML_Char *atttype,
-                   const XML_Char *dflt, int isrequired) {
-  (void)userData;
-  TouchString(elname);
-  TouchString(attname);
-  TouchString(atttype);
-  TouchString(dflt);
-  (void)isrequired;
-}
-
-static void XMLCALL
-XmlDeclHandler(void *userData, const XML_Char *version,
-               const XML_Char *encoding, int standalone) {
-  (void)userData;
-  TouchString(version);
-  TouchString(encoding);
-  (void)standalone;
-}
-
-static void XMLCALL
-StartElementHandler(void *userData, const XML_Char *name,
-                    const XML_Char **atts) {
-  (void)userData;
-  TouchString(name);
-  for (size_t i = 0; atts[i] != NULL; ++i) {
-    TouchString(atts[i]);
-  }
-}
-
-static void XMLCALL
-EndElementHandler(void *userData, const XML_Char *name) {
-  (void)userData;
-  TouchString(name);
-}
-
-static void XMLCALL
-CharacterDataHandler(void *userData, const XML_Char *s, int len) {
-  (void)userData;
-  TouchString(s, len);
-}
-
-static void XMLCALL
-ProcessingInstructionHandler(void *userData, const XML_Char *target,
-                             const XML_Char *data) {
-  (void)userData;
-  TouchString(target);
-  TouchString(data);
-}
-
-static void XMLCALL
-CommentHandler(void *userData, const XML_Char *data) {
-  TouchString(data);
-  // Use the comment handler to trigger parser suspend, so that we can get
-  // coverage of that code.
-  XML_StopParser((XML_Parser)userData, XML_TRUE);
-}
-
-static void XMLCALL
-StartCdataSectionHandler(void *userData) {
-  (void)userData;
-}
-
-static void XMLCALL
-EndCdataSectionHandler(void *userData) {
-  (void)userData;
-}
-
-static void XMLCALL
-DefaultHandler(void *userData, const XML_Char *s, int len) {
-  (void)userData;
-  TouchString(s, len);
-}
-
-static void XMLCALL
-StartDoctypeDeclHandler(void *userData, const XML_Char *doctypeName,
-                        const XML_Char *sysid, const XML_Char *pubid,
-                        int has_internal_subset) {
-  (void)userData;
-  TouchString(doctypeName);
-  TouchString(sysid);
-  TouchString(pubid);
-  (void)has_internal_subset;
-}
-
-static void XMLCALL
-EndDoctypeDeclHandler(void *userData) {
-  (void)userData;
-}
-
-static void XMLCALL
-EntityDeclHandler(void *userData, const XML_Char *entityName,
-                  int is_parameter_entity, const XML_Char *value,
-                  int value_length, const XML_Char *base,
-                  const XML_Char *systemId, const XML_Char *publicId,
-                  const XML_Char *notationName) {
-  (void)userData;
-  TouchString(entityName);
-  (void)is_parameter_entity;
-  TouchString(value, value_length);
-  TouchString(base);
-  TouchString(systemId);
-  TouchString(publicId);
-  TouchString(notationName);
-}
-
-static void XMLCALL
-NotationDeclHandler(void *userData, const XML_Char *notationName,
-                    const XML_Char *base, const XML_Char *systemId,
-                    const XML_Char *publicId) {
-  (void)userData;
-  TouchString(notationName);
-  TouchString(base);
-  TouchString(systemId);
-  TouchString(publicId);
-}
-
-static void XMLCALL
-StartNamespaceDeclHandler(void *userData, const XML_Char *prefix,
-                          const XML_Char *uri) {
-  (void)userData;
-  TouchString(prefix);
-  TouchString(uri);
-}
-
-static void XMLCALL
-EndNamespaceDeclHandler(void *userData, const XML_Char *prefix) {
-  (void)userData;
-  TouchString(prefix);
-}
-
-static int XMLCALL
-NotStandaloneHandler(void *userData) {
-  (void)userData;
-  return XML_STATUS_OK;
-}
-
-static int XMLCALL
-ExternalEntityRefHandler(XML_Parser parser, const XML_Char *context,
-                         const XML_Char *base, const XML_Char *systemId,
-                         const XML_Char *publicId) {
-  int rc = XML_STATUS_ERROR;
-  TouchString(context);
-  TouchString(base);
-  TouchString(systemId);
-  TouchString(publicId);
-
-  if (g_external_entity) {
-    XML_Parser ext_parser
-        = XML_ExternalEntityParserCreate(parser, context, g_encoding);
-    if (ext_parser != NULL) {
-      rc = Parse(ext_parser, g_external_entity, g_external_entity_size, 1);
-      XML_ParserFree(ext_parser);
-    }
-  }
-
-  return rc;
-}
-
-static void XMLCALL
-SkippedEntityHandler(void *userData, const XML_Char *entityName,
-                     int is_parameter_entity) {
-  (void)userData;
-  TouchString(entityName);
-  (void)is_parameter_entity;
-}
-
-static int XMLCALL
-UnknownEncodingHandler(void *encodingHandlerData, const XML_Char *name,
-                       XML_Encoding *info) {
-  (void)encodingHandlerData;
-  TouchString(name);
-  (void)info;
-  return XML_STATUS_ERROR;
-}
-
-void
-InitializeParser(XML_Parser parser) {
-  XML_SetUserData(parser, (void *)parser);
-  XML_SetHashSalt(parser, 0x41414141);
-  XML_SetParamEntityParsing(parser, XML_PARAM_ENTITY_PARSING_ALWAYS);
-
-  XML_SetElementDeclHandler(parser, ElementDeclHandler);
-  XML_SetAttlistDeclHandler(parser, AttlistDeclHandler);
-  XML_SetXmlDeclHandler(parser, XmlDeclHandler);
-  XML_SetElementHandler(parser, StartElementHandler, EndElementHandler);
-  XML_SetCharacterDataHandler(parser, CharacterDataHandler);
-  XML_SetProcessingInstructionHandler(parser, ProcessingInstructionHandler);
-  XML_SetCommentHandler(parser, CommentHandler);
-  XML_SetCdataSectionHandler(parser, StartCdataSectionHandler,
-                             EndCdataSectionHandler);
-  // XML_SetDefaultHandler disables entity expansion
-  XML_SetDefaultHandlerExpand(parser, DefaultHandler);
-  XML_SetDoctypeDeclHandler(parser, StartDoctypeDeclHandler,
-                            EndDoctypeDeclHandler);
-  // Note: This is mutually exclusive with XML_SetUnparsedEntityDeclHandler,
-  //       and there isn't any significant code change between the two.
-  XML_SetEntityDeclHandler(parser, EntityDeclHandler);
-  XML_SetNotationDeclHandler(parser, NotationDeclHandler);
-  XML_SetNamespaceDeclHandler(parser, StartNamespaceDeclHandler,
-                              EndNamespaceDeclHandler);
-  XML_SetNotStandaloneHandler(parser, NotStandaloneHandler);
-  XML_SetExternalEntityRefHandler(parser, ExternalEntityRefHandler);
-  XML_SetSkippedEntityHandler(parser, SkippedEntityHandler);
-  XML_SetUnknownEncodingHandler(parser, UnknownEncodingHandler, (void *)parser);
-}
-
-DEFINE_TEXT_PROTO_FUZZER(const xml_lpm_fuzzer::Testcase &testcase) {
-  g_external_entity = nullptr;
-
-  if (! testcase.actions_size()) {
-    return;
-  }
-
-  g_allocation_count = 0;
-  g_fail_allocations.clear();
-  for (int i = 0; i < testcase.fail_allocations_size(); ++i) {
-    g_fail_allocations.push_back(testcase.fail_allocations(i));
-  }
-
-  SetEncoding(testcase.encoding());
-  XML_Parser parser
-      = XML_ParserCreate_MM(g_encoding, &memory_handling_suite, "|");
-  InitializeParser(parser);
-
-  for (int i = 0; i < testcase.actions_size(); ++i) {
-    const auto &action = testcase.actions(i);
-    switch (action.action_case()) {
-    case xml_lpm_fuzzer::Action::kChunk:
-      if (XML_STATUS_ERROR
-          == Parse(parser, action.chunk().data(), action.chunk().size(), 0)) {
-        // Force a reset after parse error.
-        XML_ParserReset(parser, g_encoding);
-        InitializeParser(parser);
-      }
-      break;
-
-    case xml_lpm_fuzzer::Action::kLastChunk:
-      Parse(parser, action.last_chunk().data(), action.last_chunk().size(), 1);
-      XML_ParserReset(parser, g_encoding);
-      InitializeParser(parser);
-      break;
-
-    case xml_lpm_fuzzer::Action::kReset:
-      XML_ParserReset(parser, g_encoding);
-      InitializeParser(parser);
-      break;
-
-    case xml_lpm_fuzzer::Action::kExternalEntity:
-      g_external_entity = action.external_entity().data();
-      g_external_entity_size = action.external_entity().size();
-      break;
-
-    default:
-      break;
-    }
-  }
-
-  XML_ParserFree(parser);
-}

expat/fuzz/xml_lpm_fuzzer.proto

@@ -1,58 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2022 Mark Brand <markbrand@google.com>
-   Copyright (c) 2025 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-syntax = "proto2";
-package xml_lpm_fuzzer;
-
-enum Encoding {
-  UTF8 = 0;
-  UTF16 = 1;
-  ISO88591 = 2;
-  ASCII = 3;
-  UNKNOWN = 4;
-  NONE = 5;
-}
-
-message Action {
-  oneof action {
-    string chunk = 1;
-    string last_chunk = 2;
-    bool reset = 3;
-    string external_entity = 4;
-  }
-}
-
-message Testcase {
-  required Encoding encoding = 1;
-  repeated Action actions = 2;
-  repeated int32 fail_allocations = 3;
-}

expat/fuzz/xml_parse_fuzzer.c

@@ -5,7 +5,7 @@
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *      https://www.apache.org/licenses/LICENSE-2.0
+ *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -15,7 +15,6 @@
  */
 
 #include <assert.h>
-#include <limits.h> // for INT_MAX
 #include <stdint.h>
 
 #include "expat.h"
@@ -48,62 +47,18 @@ end(void *userData, const XML_Char *name) {
   (void)name;
 }
 
-static void XMLCALL
-may_stop_character_handler(void *userData, const XML_Char *s, int len) {
-  XML_Parser parser = (XML_Parser)userData;
-  if (len > 1 && s[0] == 's') {
-    XML_StopParser(parser, s[1] == 'r' ? XML_FALSE : XML_TRUE);
-  }
-}
+int
+LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
+  XML_Parser p = XML_ParserCreate(xstr(ENCODING_FOR_FUZZING));
+  assert(p);
 
-static void
-ParseOneInput(XML_Parser p, const uint8_t *data, size_t size) {
   // Set the hash salt using siphash to generate a deterministic hash.
   struct sipkey *key = sip_keyof(hash_key);
   XML_SetHashSalt(p, (unsigned long)siphash24(data, size, key));
-  (void)sip24_valid;
 
-  XML_SetUserData(p, p);
   XML_SetElementHandler(p, start, end);
-  XML_SetCharacterDataHandler(p, may_stop_character_handler);
-  assert(size <= INT_MAX);
-  XML_Parse(p, (const XML_Char *)data, (int)size, 0);
-  if (XML_Parse(p, (const XML_Char *)data, (int)size, 1) == XML_STATUS_ERROR) {
-    XML_ErrorString(XML_GetErrorCode(p));
-  }
-  XML_GetCurrentLineNumber(p);
-  if (size % 2) {
-    XML_ParserReset(p, NULL);
-  }
-}
-
-int
-LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
-  XML_Parser parentParser = XML_ParserCreate(xstr(ENCODING_FOR_FUZZING));
-  assert(parentParser);
-  ParseOneInput(parentParser, data, size);
-  // not freed yet, but used later and freed then
-
-  XML_Parser namespaceParser = XML_ParserCreateNS(NULL, '!');
-  assert(namespaceParser);
-  ParseOneInput(namespaceParser, data, size);
-  XML_ParserFree(namespaceParser);
-
-  XML_Parser externalEntityParser
-      = XML_ExternalEntityParserCreate(parentParser, "e1", NULL);
-  if (externalEntityParser != NULL) {
-    ParseOneInput(externalEntityParser, data, size);
-    XML_ParserFree(externalEntityParser);
-  }
-
-  XML_Parser externalDtdParser
-      = XML_ExternalEntityParserCreate(parentParser, NULL, NULL);
-  if (externalDtdParser != NULL) {
-    ParseOneInput(externalDtdParser, data, size);
-    XML_ParserFree(externalDtdParser);
-  }
-
-  // finally frees this parser which served as parent
-  XML_ParserFree(parentParser);
+  XML_Parse(p, (const XML_Char *)data, size, 0);
+  XML_Parse(p, (const XML_Char *)data, size, 1);
+  XML_ParserFree(p);
   return 0;
 }

expat/fuzz/xml_parsebuffer_fuzzer.c

@@ -5,7 +5,7 @@
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
- *      https://www.apache.org/licenses/LICENSE-2.0
+ *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
@@ -15,7 +15,6 @@
  */
 
 #include <assert.h>
-#include <limits.h> // for INT_MAX
 #include <stdint.h>
 #include <string.h>
 
@@ -49,73 +48,24 @@ end(void *userData, const XML_Char *name) {
   (void)name;
 }
 
-static void XMLCALL
-may_stop_character_handler(void *userData, const XML_Char *s, int len) {
-  XML_Parser parser = (XML_Parser)userData;
-  if (len > 1 && s[0] == 's') {
-    XML_StopParser(parser, s[1] == 'r' ? XML_FALSE : XML_TRUE);
-  }
-}
-
-static void
-ParseOneInput(XML_Parser p, const uint8_t *data, size_t size) {
-  // Set the hash salt using siphash to generate a deterministic hash.
-  struct sipkey *key = sip_keyof(hash_key);
-  XML_SetHashSalt(p, (unsigned long)siphash24(data, size, key));
-  (void)sip24_valid;
-
-  XML_SetUserData(p, p);
-  XML_SetElementHandler(p, start, end);
-  XML_SetCharacterDataHandler(p, may_stop_character_handler);
-  assert(size <= INT_MAX);
-  void *buf = XML_GetBuffer(p, (int)size);
-  assert(buf);
-  memcpy(buf, data, size);
-  XML_ParseBuffer(p, (int)size, 0);
-  buf = XML_GetBuffer(p, (int)size);
-  if (buf == NULL) {
-    return;
-  }
-  memcpy(buf, data, size);
-  if (XML_ParseBuffer(p, (int)size, 1) == XML_STATUS_ERROR) {
-    XML_ErrorString(XML_GetErrorCode(p));
-  }
-  XML_GetCurrentLineNumber(p);
-  if (size % 2) {
-    XML_ParserReset(p, NULL);
-  }
-}
-
 int
 LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   if (size == 0)
     return 0;
 
-  XML_Parser parentParser = XML_ParserCreate(xstr(ENCODING_FOR_FUZZING));
-  assert(parentParser);
-  ParseOneInput(parentParser, data, size);
-  // not freed yet, but used later and freed then
+  XML_Parser p = XML_ParserCreate(xstr(ENCODING_FOR_FUZZING));
+  assert(p);
+  XML_SetElementHandler(p, start, end);
 
-  XML_Parser namespaceParser = XML_ParserCreateNS(NULL, '!');
-  assert(namespaceParser);
-  ParseOneInput(namespaceParser, data, size);
-  XML_ParserFree(namespaceParser);
+  // Set the hash salt using siphash to generate a deterministic hash.
+  struct sipkey *key = sip_keyof(hash_key);
+  XML_SetHashSalt(p, (unsigned long)siphash24(data, size, key));
 
-  XML_Parser externalEntityParser
-      = XML_ExternalEntityParserCreate(parentParser, "e1", NULL);
-  if (externalEntityParser != NULL) {
-    ParseOneInput(externalEntityParser, data, size);
-    XML_ParserFree(externalEntityParser);
-  }
+  void *buf = XML_GetBuffer(p, size);
+  assert(buf);
 
-  XML_Parser externalDtdParser
-      = XML_ExternalEntityParserCreate(parentParser, NULL, NULL);
-  if (externalDtdParser != NULL) {
-    ParseOneInput(externalDtdParser, data, size);
-    XML_ParserFree(externalDtdParser);
-  }
-
-  // finally frees this parser which served as parent
-  XML_ParserFree(parentParser);
+  memcpy(buf, data, size);
+  XML_ParseBuffer(p, size, size == 0);
+  XML_ParserFree(p);
   return 0;
 }

expat/gennmtab/gennmtab.c

@@ -9,7 +9,7 @@
    Copyright (c) 1997-2000 Thai Open Source Software Center Ltd
    Copyright (c) 2000      Clark Cooper <coopercc@users.sourceforge.net>
    Copyright (c) 2002      Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
-   Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2017 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -442,7 +442,7 @@ printTabs(char *tab) {
 }
 
 int
-main(void) {
+main() {
   char tab[2 * 65536];
   memset(tab, 0, 65536);
   setTab(tab, nmstrt, sizeof(nmstrt) / sizeof(nmstrt[0]));

expat/lib/Makefile.am

@@ -6,12 +6,9 @@
 #                      \___/_/\_\ .__/ \__,_|\__|
 #                               |_| XML parser
 #
-# Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
+# Copyright (c) 2017-2022 Sebastian Pipping <sebastian@pipping.org>
 # Copyright (c) 2017      Tomasz Kłoczko <kloczek@fedoraproject.org>
 # Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
-# Copyright (c) 2026      Gordon Messmer <gordon.messmer@gmail.com>
-# Copyright (c) 2026      Nick Begg <nick@stunttruck.net>
-# Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
 # Licensed under the MIT license:
 #
 # Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -39,65 +36,25 @@ include_HEADERS = \
     expat_external.h
 
 lib_LTLIBRARIES = libexpat.la
-if WITH_TESTS
-noinst_LTLIBRARIES = libtestpat.la
-endif
+noinst_LTLIBRARIES = libexpatinternal.la
 
 libexpat_la_LDFLAGS = \
     @AM_LDFLAGS@ \
     @LIBM@ \
     -no-undefined \
     -version-info @LIBCURRENT@:@LIBREVISION@:@LIBAGE@
-if HAVE_VSCRIPT
-libexpat_la_LDFLAGS += $(VSCRIPT_LDFLAGS),@builddir@/libexpat.map
-endif
 
-libexpat_la_SOURCES = \
+libexpat_la_SOURCES =
+
+# This layer of indirection allows
+# the test suite to access internal symbols
+# despite compiling with -fvisibility=hidden
+libexpatinternal_la_SOURCES = \
     xmlparse.c \
     xmltok.c \
     xmlrole.c
 
-if WITH_ARC4RANDOM
-    libexpat_la_SOURCES += \
-        random_arc4random.c \
-        random_arc4random.h
-endif
-
-if WITH_ARC4RANDOM_BUF
-    libexpat_la_SOURCES += \
-        random_arc4random_buf.c \
-        random_arc4random_buf.h
-endif
-
-if ! MINGW
-    libexpat_la_SOURCES += \
-        random_dev_urandom.c \
-        random_dev_urandom.h
-endif
-
-if WITH_GETENTROPY
-    libexpat_la_SOURCES += \
-        random_getentropy.c \
-        random_getentropy.h
-endif
-
-if WITH_EITHER_GETRANDOM
-    libexpat_la_SOURCES += \
-        random_getrandom.c \
-        random_getrandom.h
-endif
-
-if MINGW
-    libexpat_la_SOURCES += \
-        random_rand_s.c \
-        random_rand_s.h
-endif
-
-if WITH_TESTS
-libtestpat_la_CPPFLAGS = -DXML_TESTING
-
-libtestpat_la_SOURCES = $(libexpat_la_SOURCES)
-endif
+libexpat_la_LIBADD = libexpatinternal.la
 
 doc_DATA = \
     ../AUTHORS \
@@ -114,12 +71,10 @@ EXTRA_DIST = \
     asciitab.h \
     expat_external.h \
     expat.h \
-    fallthrough.h \
     iasciitab.h \
     internal.h \
     latin1tab.h \
     libexpat.def.cmake \
-    memory_sanitizer.h \
     nametab.h \
     siphash.h \
     utf8tab.h \

expat/lib/expat.h

@@ -11,15 +11,11 @@
    Copyright (c) 2000-2005 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2001-2002 Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2002-2016 Karl Waclawek <karl@waclawek.net>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2016      Cristian Rodríguez <crrodriguez@opensuse.org>
    Copyright (c) 2016      Thomas Beutlich <tc@tbeu.de>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2022      Thijs Schreijer <thijs@thijsschreijer.nl>
-   Copyright (c) 2023      Hanno Böck <hanno@gentoo.org>
-   Copyright (c) 2023      Sony Corporation / Snild Dolkow <snild@sony.com>
-   Copyright (c) 2024      Taichi Haradaguchi <20001722@ymail.ne.jp>
-   Copyright (c) 2025      Matthew Fernandez <matthew.fernandez@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -43,22 +39,21 @@
 */
 
 #ifndef Expat_INCLUDED
-#  define Expat_INCLUDED 1
+#define Expat_INCLUDED 1
 
-#  include <stdint.h> // for uint8_t
-#  include <stdlib.h>
-#  include "expat_external.h"
+#include <stdlib.h>
+#include "expat_external.h"
 
-#  ifdef __cplusplus
+#ifdef __cplusplus
 extern "C" {
-#  endif
+#endif
 
 struct XML_ParserStruct;
 typedef struct XML_ParserStruct *XML_Parser;
 
 typedef unsigned char XML_Bool;
-#  define XML_TRUE ((XML_Bool)1)
-#  define XML_FALSE ((XML_Bool)0)
+#define XML_TRUE ((XML_Bool)1)
+#define XML_FALSE ((XML_Bool)0)
 
 /* The XML_Status enum gives the possible return values for several
    API functions.  The preprocessor #defines are included so this
@@ -75,11 +70,11 @@ typedef unsigned char XML_Bool;
 */
 enum XML_Status {
   XML_STATUS_ERROR = 0,
-#  define XML_STATUS_ERROR XML_STATUS_ERROR
+#define XML_STATUS_ERROR XML_STATUS_ERROR
   XML_STATUS_OK = 1,
-#  define XML_STATUS_OK XML_STATUS_OK
+#define XML_STATUS_OK XML_STATUS_OK
   XML_STATUS_SUSPENDED = 2
-#  define XML_STATUS_SUSPENDED XML_STATUS_SUSPENDED
+#define XML_STATUS_SUSPENDED XML_STATUS_SUSPENDED
 };
 
 enum XML_Error {
@@ -132,9 +127,7 @@ enum XML_Error {
   /* Added in 2.3.0. */
   XML_ERROR_NO_BUFFER,
   /* Added in 2.4.0. */
-  XML_ERROR_AMPLIFICATION_LIMIT_BREACH,
-  /* Added in 2.6.4. */
-  XML_ERROR_NOT_STARTED,
+  XML_ERROR_AMPLIFICATION_LIMIT_BREACH
 };
 
 enum XML_Content_Type {
@@ -276,9 +269,9 @@ XML_ParserCreate_MM(const XML_Char *encoding,
                     const XML_Memory_Handling_Suite *memsuite,
                     const XML_Char *namespaceSeparator);
 
-/* Prepare a parser object to be reused.  This is particularly
+/* Prepare a parser object to be re-used.  This is particularly
    valuable when memory allocation overhead is disproportionately high,
-   such as when a large number of small documents need to be parsed.
+   such as when a large number of small documnents need to be parsed.
    All handlers are cleared from the parser, except for the
    unknownEncodingHandler. The parser's external state is re-initialized
    except for the values of ns and ns_triplets.
@@ -682,7 +675,7 @@ XMLPARSEAPI(void)
 XML_SetUserData(XML_Parser parser, void *userData);
 
 /* Returns the last value set by XML_SetUserData or NULL. */
-#  define XML_GetUserData(parser) (*(void **)(parser))
+#define XML_GetUserData(parser) (*(void **)(parser))
 
 /* This is equivalent to supplying an encoding argument to
    XML_ParserCreate. On success XML_SetEncoding returns non-zero,
@@ -754,7 +747,7 @@ XML_GetSpecifiedAttributeCount(XML_Parser parser);
 XMLPARSEAPI(int)
 XML_GetIdAttributeIndex(XML_Parser parser);
 
-#  ifdef XML_ATTR_INFO
+#ifdef XML_ATTR_INFO
 /* Source file byte offsets for the start and end of attribute names and values.
    The value indices are exclusive of surrounding quotes; thus in a UTF-8 source
    file an attribute value of "blah" will yield:
@@ -775,7 +768,7 @@ typedef struct {
 */
 XMLPARSEAPI(const XML_AttrInfo *)
 XML_GetAttributeInfo(XML_Parser parser);
-#  endif
+#endif
 
 /* Parses some input. Returns XML_STATUS_ERROR if a fatal error is
    detected.  The last call to XML_Parse must have isFinal true; len
@@ -918,21 +911,10 @@ XML_SetParamEntityParsing(XML_Parser parser,
    function behavior. This must be called before parsing is started.
    Returns 1 if successful, 0 when called after parsing has started.
    Note: If parser == NULL, the function will do nothing and return 0.
-   DEPRECATED since Expat 2.8.0.
 */
 XMLPARSEAPI(int)
 XML_SetHashSalt(XML_Parser parser, unsigned long hash_salt);
 
-/* Sets the hash salt to use for internal hash calculations.
-   Helps in preventing DoS attacks based on predicting hash function behavior.
-   This must be called before parsing is started.
-   Returns XML_TRUE if successful, XML_FALSE when called after parsing has
-   started or when parser is NULL.
-   Added in Expat 2.8.0.
-*/
-XMLPARSEAPI(XML_Bool)
-XML_SetHashSalt16Bytes(XML_Parser parser, const uint8_t entropy[16]);
-
 /* If XML_Parse or XML_ParseBuffer have returned XML_STATUS_ERROR, then
    XML_GetErrorCode returns information about the error.
 */
@@ -969,7 +951,7 @@ XMLPARSEAPI(XML_Index) XML_GetCurrentByteIndex(XML_Parser parser);
 XMLPARSEAPI(int)
 XML_GetCurrentByteCount(XML_Parser parser);
 
-/* If XML_CONTEXT_BYTES is >=1, returns the input buffer, sets
+/* If XML_CONTEXT_BYTES is defined, returns the input buffer, sets
    the integer pointed to by offset to the offset within this buffer
    of the current parse position, and sets the integer pointed to by size
    to the size of this buffer (the number of input bytes). Otherwise
@@ -983,9 +965,9 @@ XMLPARSEAPI(const char *)
 XML_GetInputContext(XML_Parser parser, int *offset, int *size);
 
 /* For backwards compatibility with previous versions. */
-#  define XML_GetErrorLineNumber XML_GetCurrentLineNumber
-#  define XML_GetErrorColumnNumber XML_GetCurrentColumnNumber
-#  define XML_GetErrorByteIndex XML_GetCurrentByteIndex
+#define XML_GetErrorLineNumber XML_GetCurrentLineNumber
+#define XML_GetErrorColumnNumber XML_GetCurrentColumnNumber
+#define XML_GetErrorByteIndex XML_GetCurrentByteIndex
 
 /* Frees the content model passed to the element declaration handler */
 XMLPARSEAPI(void)
@@ -1043,12 +1025,7 @@ enum XML_FeatureEnum {
   XML_FEATURE_ATTR_INFO,
   /* Added in Expat 2.4.0. */
   XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_MAXIMUM_AMPLIFICATION_DEFAULT,
-  XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT,
-  /* Added in Expat 2.6.0. */
-  XML_FEATURE_GE,
-  /* Added in Expat 2.7.2. */
-  XML_FEATURE_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION_DEFAULT,
-  XML_FEATURE_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT,
+  XML_FEATURE_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT
   /* Additional features must be added to the end of this enum. */
 };
 
@@ -1061,43 +1038,27 @@ typedef struct {
 XMLPARSEAPI(const XML_Feature *)
 XML_GetFeatureList(void);
 
-#  if defined(XML_DTD) || (defined(XML_GE) && XML_GE == 1)
-/* Added in Expat 2.4.0 for XML_DTD defined and
- * added in Expat 2.6.0 for XML_GE == 1. */
+#ifdef XML_DTD
+/* Added in Expat 2.4.0. */
 XMLPARSEAPI(XML_Bool)
 XML_SetBillionLaughsAttackProtectionMaximumAmplification(
     XML_Parser parser, float maximumAmplificationFactor);
 
-/* Added in Expat 2.4.0 for XML_DTD defined and
- * added in Expat 2.6.0 for XML_GE == 1. */
+/* Added in Expat 2.4.0. */
 XMLPARSEAPI(XML_Bool)
 XML_SetBillionLaughsAttackProtectionActivationThreshold(
     XML_Parser parser, unsigned long long activationThresholdBytes);
-
-/* Added in Expat 2.7.2. */
-XMLPARSEAPI(XML_Bool)
-XML_SetAllocTrackerMaximumAmplification(XML_Parser parser,
-                                        float maximumAmplificationFactor);
-
-/* Added in Expat 2.7.2. */
-XMLPARSEAPI(XML_Bool)
-XML_SetAllocTrackerActivationThreshold(
-    XML_Parser parser, unsigned long long activationThresholdBytes);
-#  endif
-
-/* Added in Expat 2.6.0. */
-XMLPARSEAPI(XML_Bool)
-XML_SetReparseDeferralEnabled(XML_Parser parser, XML_Bool enabled);
+#endif
 
 /* Expat follows the semantic versioning convention.
    See https://semver.org
 */
-#  define XML_MAJOR_VERSION 2
-#  define XML_MINOR_VERSION 8
-#  define XML_MICRO_VERSION 2
+#define XML_MAJOR_VERSION 2
+#define XML_MINOR_VERSION 5
+#define XML_MICRO_VERSION 0
 
-#  ifdef __cplusplus
+#ifdef __cplusplus
 }
-#  endif
+#endif
 
 #endif /* not Expat_INCLUDED */

expat/lib/expat_external.h

@@ -12,10 +12,9 @@
    Copyright (c) 2001-2002 Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2016      Cristian Rodríguez <crrodriguez@opensuse.org>
-   Copyright (c) 2016-2025 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2019 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
-   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -39,14 +38,14 @@
 */
 
 #ifndef Expat_External_INCLUDED
-#  define Expat_External_INCLUDED 1
+#define Expat_External_INCLUDED 1
 
 /* External API definitions */
 
 /* Expat tries very hard to make the API boundary very specifically
    defined.  There are two macros defined to control this boundary;
    each of these can be defined before including this header to
-   achieve some different behavior, but doing so is not recommended or
+   achieve some different behavior, but doing so it not recommended or
    tested frequently.
 
    XMLCALL    - The calling convention to use for all calls across the
@@ -65,12 +64,12 @@
    compiled with the cdecl calling convention as the default since
    system headers may assume the cdecl convention.
 */
-#  ifndef XMLCALL
-#    if defined(_MSC_VER)
-#      define XMLCALL __cdecl
-#    elif defined(__GNUC__) && defined(__i386) && ! defined(__INTEL_COMPILER)
-#      define XMLCALL __attribute__((cdecl))
-#    else
+#ifndef XMLCALL
+#  if defined(_MSC_VER)
+#    define XMLCALL __cdecl
+#  elif defined(__GNUC__) && defined(__i386) && ! defined(__INTEL_COMPILER)
+#    define XMLCALL __attribute__((cdecl))
+#  else
 /* For any platform which uses this definition and supports more than
    one calling convention, we need to extend this definition to
    declare the convention used on that platform, if it's possible to
@@ -81,86 +80,86 @@
    pre-processor and how to specify the same calling convention as the
    platform's malloc() implementation.
 */
-#      define XMLCALL
-#    endif
-#  endif /* not defined XMLCALL */
+#    define XMLCALL
+#  endif
+#endif /* not defined XMLCALL */
 
-#  if ! defined(XML_STATIC) && ! defined(XMLIMPORT)
-#    ifndef XML_BUILDING_EXPAT
+#if ! defined(XML_STATIC) && ! defined(XMLIMPORT)
+#  ifndef XML_BUILDING_EXPAT
 /* using Expat from an application */
 
-#      if defined(_MSC_VER) && ! defined(__BEOS__) && ! defined(__CYGWIN__)
-#        define XMLIMPORT __declspec(dllimport)
-#      endif
-
+#    if defined(_MSC_EXTENSIONS) && ! defined(__BEOS__) && ! defined(__CYGWIN__)
+#      define XMLIMPORT __declspec(dllimport)
 #    endif
-#  endif /* not defined XML_STATIC */
 
-#  ifndef XML_ENABLE_VISIBILITY
-#    define XML_ENABLE_VISIBILITY 0
 #  endif
+#endif /* not defined XML_STATIC */
 
-#  if ! defined(XMLIMPORT) && XML_ENABLE_VISIBILITY
-#    define XMLIMPORT __attribute__((visibility("default")))
-#  endif
+#ifndef XML_ENABLE_VISIBILITY
+#  define XML_ENABLE_VISIBILITY 0
+#endif
+
+#if ! defined(XMLIMPORT) && XML_ENABLE_VISIBILITY
+#  define XMLIMPORT __attribute__((visibility("default")))
+#endif
 
 /* If we didn't define it above, define it away: */
-#  ifndef XMLIMPORT
-#    define XMLIMPORT
-#  endif
+#ifndef XMLIMPORT
+#  define XMLIMPORT
+#endif
 
-#  if defined(__GNUC__)                                                        \
-      && (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 96))
-#    define XML_ATTR_MALLOC __attribute__((__malloc__))
-#  else
-#    define XML_ATTR_MALLOC
-#  endif
+#if defined(__GNUC__)                                                          \
+    && (__GNUC__ > 2 || (__GNUC__ == 2 && __GNUC_MINOR__ >= 96))
+#  define XML_ATTR_MALLOC __attribute__((__malloc__))
+#else
+#  define XML_ATTR_MALLOC
+#endif
 
-#  if defined(__GNUC__)                                                        \
-      && ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3))
-#    define XML_ATTR_ALLOC_SIZE(x) __attribute__((__alloc_size__(x)))
-#  else
-#    define XML_ATTR_ALLOC_SIZE(x)
-#  endif
+#if defined(__GNUC__)                                                          \
+    && ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3))
+#  define XML_ATTR_ALLOC_SIZE(x) __attribute__((__alloc_size__(x)))
+#else
+#  define XML_ATTR_ALLOC_SIZE(x)
+#endif
 
-#  define XMLPARSEAPI(type) XMLIMPORT type XMLCALL
+#define XMLPARSEAPI(type) XMLIMPORT type XMLCALL
 
-#  ifdef __cplusplus
+#ifdef __cplusplus
 extern "C" {
-#  endif
+#endif
 
+#ifdef XML_UNICODE_WCHAR_T
+#  ifndef XML_UNICODE
+#    define XML_UNICODE
+#  endif
+#  if defined(__SIZEOF_WCHAR_T__) && (__SIZEOF_WCHAR_T__ != 2)
+#    error "sizeof(wchar_t) != 2; Need -fshort-wchar for both Expat and libc"
+#  endif
+#endif
+
+#ifdef XML_UNICODE /* Information is UTF-16 encoded. */
 #  ifdef XML_UNICODE_WCHAR_T
-#    ifndef XML_UNICODE
-#      define XML_UNICODE
-#    endif
-#    if defined(__SIZEOF_WCHAR_T__) && (__SIZEOF_WCHAR_T__ != 2)
-#      error "sizeof(wchar_t) != 2; Need -fshort-wchar for both Expat and libc"
-#    endif
-#  endif
-
-#  ifdef XML_UNICODE /* Information is UTF-16 encoded. */
-#    ifdef XML_UNICODE_WCHAR_T
 typedef wchar_t XML_Char;
 typedef wchar_t XML_LChar;
-#    else
+#  else
 typedef unsigned short XML_Char;
 typedef char XML_LChar;
-#    endif /* XML_UNICODE_WCHAR_T */
-#  else    /* Information is UTF-8 encoded. */
+#  endif /* XML_UNICODE_WCHAR_T */
+#else    /* Information is UTF-8 encoded. */
 typedef char XML_Char;
 typedef char XML_LChar;
-#  endif   /* XML_UNICODE */
+#endif   /* XML_UNICODE */
 
-#  ifdef XML_LARGE_SIZE /* Use large integers for file/stream positions. */
+#ifdef XML_LARGE_SIZE /* Use large integers for file/stream positions. */
 typedef long long XML_Index;
 typedef unsigned long long XML_Size;
-#  else
+#else
 typedef long XML_Index;
 typedef unsigned long XML_Size;
-#  endif /* XML_LARGE_SIZE */
+#endif /* XML_LARGE_SIZE */
 
-#  ifdef __cplusplus
+#ifdef __cplusplus
 }
-#  endif
+#endif
 
 #endif /* not Expat_External_INCLUDED */

expat/lib/fallthrough.h

@@ -1,49 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Nick Begg <nick@stunttruck.net>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#ifndef FALLTHROUGH_H
-#  define FALLTHROUGH_H 1
-
-// Explicit fallthrough in switch case to avoid warnings
-// with compiler flag -Wimplicit-fallthrough.
-
-#  define EXPAT_FALLTHROUGH                                                    \
-    do {                                                                       \
-    } while (0)
-
-#  if defined(__has_attribute)
-#    if __has_attribute(fallthrough)
-#      undef EXPAT_FALLTHROUGH
-#      define EXPAT_FALLTHROUGH __attribute__((fallthrough))
-#    endif
-#  endif
-
-#endif // FALLTHROUGH_H

expat/lib/internal.h

@@ -28,11 +28,9 @@
    Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2003      Greg Stein <gstein@users.sourceforge.net>
-   Copyright (c) 2016-2026 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2018      Yury Gribov <tetra2005@gmail.com>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
-   Copyright (c) 2023-2024 Sony Corporation / Snild Dolkow <snild@sony.com>
-   Copyright (c) 2024      Taichi Haradaguchi <20001722@ymail.ne.jp>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -108,12 +106,10 @@
 #endif
 
 #include <limits.h> // ULONG_MAX
-#include <stddef.h> // size_t
 
 #if defined(_WIN32)                                                            \
     && (! defined(__USE_MINGW_ANSI_STDIO)                                      \
         || (1 - __USE_MINGW_ANSI_STDIO - 1 == 0))
-#  define EXPAT_FMT_LLX(midpart) "%" midpart "I64x"
 #  define EXPAT_FMT_ULL(midpart) "%" midpart "I64u"
 #  if defined(_WIN64) // Note: modifiers "td" and "zu" do not work for MinGW
 #    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "I64d"
@@ -123,16 +119,12 @@
 #    define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
 #  endif
 #else
-#  define EXPAT_FMT_LLX(midpart) "%" midpart "llx"
 #  define EXPAT_FMT_ULL(midpart) "%" midpart "llu"
 #  if ! defined(ULONG_MAX)
 #    error Compiler did not define ULONG_MAX for us
 #  elif ULONG_MAX == 18446744073709551615u // 2^64-1
 #    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld"
 #    define EXPAT_FMT_SIZE_T(midpart) "%" midpart "lu"
-#  elif defined(__wasm32__) // 32bit mode Emscripten or WASI SDK
-#    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "ld"
-#    define EXPAT_FMT_SIZE_T(midpart) "%" midpart "zu"
 #  else
 #    define EXPAT_FMT_PTRDIFF_T(midpart) "%" midpart "d"
 #    define EXPAT_FMT_SIZE_T(midpart) "%" midpart "u"
@@ -151,16 +143,6 @@
   100.0f
 #define EXPAT_BILLION_LAUGHS_ATTACK_PROTECTION_ACTIVATION_THRESHOLD_DEFAULT    \
   8388608 // 8 MiB, 2^23
-
-#define EXPAT_ALLOC_TRACKER_MAXIMUM_AMPLIFICATION_DEFAULT 100.0f
-#define EXPAT_ALLOC_TRACKER_ACTIVATION_THRESHOLD_DEFAULT                       \
-  67108864 // 64 MiB, 2^26
-
-// NOTE: If function expat_alloc was user facing, EXPAT_MALLOC_ALIGNMENT would
-//       have to take sizeof(long double) into account
-#define EXPAT_MALLOC_ALIGNMENT sizeof(long long) // largest parser (sub)member
-#define EXPAT_MALLOC_PADDING ((EXPAT_MALLOC_ALIGNMENT) - sizeof(size_t))
-
 /* NOTE END */
 
 #include "expat.h" // so we can use type XML_Parser below
@@ -172,24 +154,12 @@ extern "C" {
 void _INTERNAL_trim_to_complete_utf8_characters(const char *from,
                                                 const char **fromLimRef);
 
-#if defined(XML_GE) && XML_GE == 1
+#if defined(XML_DTD)
 unsigned long long testingAccountingGetCountBytesDirect(XML_Parser parser);
 unsigned long long testingAccountingGetCountBytesIndirect(XML_Parser parser);
 const char *unsignedCharToPrintable(unsigned char c);
 #endif
 
-extern
-#if ! defined(XML_TESTING)
-    const
-#endif
-    XML_Bool g_reparseDeferralEnabledDefault; // written ONLY in runtests.c
-#if defined(XML_TESTING)
-void *expat_malloc(XML_Parser parser, size_t size, int sourceLine);
-void expat_free(XML_Parser parser, void *ptr, int sourceLine);
-void *expat_realloc(XML_Parser parser, void *ptr, size_t size, int sourceLine);
-extern unsigned int g_bytesScanned; // used for testing only
-#endif
-
 #ifdef __cplusplus
 }
 #endif

expat/lib/libexpat.def.cmake

@@ -1,7 +1,6 @@
 ; DEF file for MS VC++
 
 EXPORTS
-; added some time before version 1.95.4
   XML_DefaultCurrent @1
   XML_ErrorString @2
   XML_ExpatVersion @3
@@ -56,8 +55,8 @@ EXPORTS
   XML_SetUserData @52
   XML_SetXmlDeclHandler @53
   XML_UseParserAsHandlerArg @54
+; added with version 1.95.3
   XML_ParserReset @55
-; added with version 1.95.4
   XML_SetSkippedEntityHandler @56
 ; added with version 1.95.5
   XML_GetFeatureList @57
@@ -71,17 +70,10 @@ EXPORTS
   XML_StopParser @63
   XML_ResumeParser @64
   XML_GetParsingStatus @65
-; added with version 2.1.0
+; added with version 2.1.1
 @_EXPAT_COMMENT_ATTR_INFO@ XML_GetAttributeInfo @66
   XML_SetHashSalt @67
 ; internal @68 removed with version 2.3.1
 ; added with version 2.4.0
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionActivationThreshold @69
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70
-; added with version 2.6.0
-  XML_SetReparseDeferralEnabled @71
-; added with version 2.7.2
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerMaximumAmplification @72
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerActivationThreshold @73
-; added with version 2.8.0
-  XML_SetHashSalt16Bytes @74
+@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionActivationThreshold @69
+@_EXPAT_COMMENT_DTD@ XML_SetBillionLaughsAttackProtectionMaximumAmplification @70

expat/lib/libexpat.map.in

@@ -1,124 +0,0 @@
-LIBEXPAT_1.0.0 {
- global:
-  XML_DefaultCurrent;
-  XML_ErrorString;
-  XML_ExternalEntityParserCreate;
-  XML_GetBase;
-  XML_GetBuffer;
-  XML_GetCurrentByteIndex;
-  XML_GetCurrentColumnNumber;
-  XML_GetCurrentLineNumber;
-  XML_GetErrorCode;
-  XML_Parse;
-  XML_ParseBuffer;
-  XML_ParserCreate;
-  XML_ParserFree;
-  XML_SetBase;
-  XML_SetCharacterDataHandler;
-  XML_SetDefaultHandler;
-  XML_SetElementHandler;
-  XML_SetExternalEntityRefHandler;
-  XML_SetNotationDeclHandler;
-  XML_SetProcessingInstructionHandler;
-  XML_SetUnknownEncodingHandler;
-  XML_SetUnparsedEntityDeclHandler;
-  XML_SetUserData;
-  XML_UseParserAsHandlerArg;
-};
-
-LIBEXPAT_1.1.0 {
- global:
-  XML_GetCurrentByteCount;
-  XML_GetSpecifiedAttributeCount;
-  XML_ParserCreateNS;
-  XML_SetCdataSectionHandler;
-  XML_SetCommentHandler;
-  XML_SetDefaultHandlerExpand;
-  XML_SetEncoding;
-  XML_SetExternalEntityRefHandlerArg;
-  XML_SetNamespaceDeclHandler;
-  XML_SetNotStandaloneHandler;
-} LIBEXPAT_1.0.0;
-
-LIBEXPAT_1.95.0 {
- global:
-  XML_ExpatVersion;
-  XML_GetIdAttributeIndex;
-  XML_GetInputContext;
-  XML_ParserCreate_MM;
-  XML_SetAttlistDeclHandler;
-  XML_SetDoctypeDeclHandler;
-  XML_SetElementDeclHandler;
-  XML_SetEndCdataSectionHandler;
-  XML_SetEndDoctypeDeclHandler;
-  XML_SetEndElementHandler;
-  XML_SetEndNamespaceDeclHandler;
-  XML_SetEntityDeclHandler;
-  XML_SetParamEntityParsing;
-  XML_SetReturnNSTriplet;
-  XML_SetStartCdataSectionHandler;
-  XML_SetStartDoctypeDeclHandler;
-  XML_SetStartElementHandler;
-  XML_SetStartNamespaceDeclHandler;
-  XML_SetXmlDeclHandler;
-} LIBEXPAT_1.1.0;
-
-LIBEXPAT_1.95.3 {
- global:
-  XML_ExpatVersionInfo;
-  XML_ParserReset;
-} LIBEXPAT_1.95.0;
-
-LIBEXPAT_1.95.4 {
- global:
-  XML_SetSkippedEntityHandler;
-} LIBEXPAT_1.95.3;
-
-LIBEXPAT_1.95.5 {
- global:
-  XML_GetFeatureList;
-  XML_UseForeignDTD;
-} LIBEXPAT_1.95.4;
-
-LIBEXPAT_1.95.6 {
- global:
-  XML_FreeContentModel;
-  XML_MemFree;
-  XML_MemMalloc;
-  XML_MemRealloc;
-} LIBEXPAT_1.95.5;
-
-LIBEXPAT_1.95.8 {
- global:
-  XML_GetParsingStatus;
-  XML_ResumeParser;
-  XML_StopParser;
-} LIBEXPAT_1.95.6;
-
-LIBEXPAT_2.1.0 {
- global:
-@_EXPAT_COMMENT_ATTR_INFO@ XML_GetAttributeInfo;
-  XML_SetHashSalt;
-} LIBEXPAT_1.95.8;
-
-LIBEXPAT_2.4.0 {
- global:
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionActivationThreshold;
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetBillionLaughsAttackProtectionMaximumAmplification;
-} LIBEXPAT_2.1.0;
-
-LIBEXPAT_2.6.0 {
- global:
-  XML_SetReparseDeferralEnabled;
-} LIBEXPAT_2.4.0;
-
-LIBEXPAT_2.7.2 {
- global:
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerActivationThreshold;
-@_EXPAT_COMMENT_DTD_OR_GE@ XML_SetAllocTrackerMaximumAmplification;
-} LIBEXPAT_2.6.0;
-
-LIBEXPAT_2.8.0 {
- global:
-  XML_SetHashSalt16Bytes;
-} LIBEXPAT_2.7.2;

expat/lib/memory_sanitizer.h

@@ -1,51 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#if ! defined(MEMORY_SANITIZER_H)
-#  define MEMORY_SANITIZER_H 1
-
-#  if defined(__has_feature)
-#    if __has_feature(memory_sanitizer)
-#      include <sanitizer/msan_interface.h>
-
-// inform Memory Sanitizer that [base, base + extent) is now initialized
-#      define MSAN_UNPOISON(base, extent) __msan_unpoison((base), (extent))
-
-#    endif
-#  endif
-
-#  if ! defined(MSAN_UNPOISON)
-#    define MSAN_UNPOISON(base, extent)                                        \
-      do {                                                                     \
-      } while (0)
-#  endif
-
-#endif // ! defined(MEMORY_SANITIZER_H)

expat/lib/random_arc4random.c

@@ -1,56 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
-   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "random_arc4random.h"
-
-#if ! defined(_DEFAULT_SOURCE)
-#  define _DEFAULT_SOURCE 1 /* for glibc */
-#endif
-
-#include <stdint.h> // for uint32_t
-#include <stdlib.h> // for arc4random
-#include <string.h> // for memcpy
-
-void
-writeRandomBytes_arc4random(void *target, size_t count) {
-  size_t bytesWrittenTotal = 0;
-
-  while (bytesWrittenTotal < count) {
-    const uint32_t random32 = arc4random();
-
-    size_t toUse = count - bytesWrittenTotal;
-    if (toUse > sizeof(random32))
-      toUse = sizeof(random32);
-    memcpy((char *)target + bytesWrittenTotal, &random32, toUse);
-    bytesWrittenTotal += toUse;
-  }
-}

expat/lib/random_arc4random.h

@@ -1,39 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#if ! defined(RANDOM_ACR4RANDOM_H)
-#  define RANDOM_ACR4RANDOM_H 1
-
-#  include <stddef.h> // for size_t
-
-void writeRandomBytes_arc4random(void *target, size_t count);
-
-#endif // ! defined(RANDOM_ACR4RANDOM_H)

expat/lib/random_arc4random_buf.c

@@ -1,47 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-   Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "random_arc4random_buf.h"
-
-#if ! defined(_DEFAULT_SOURCE)
-#  define _DEFAULT_SOURCE 1 /* for glibc */
-#endif
-
-#include "memory_sanitizer.h"
-#include <stdlib.h> // for arc4random_buf
-
-void
-writeRandomBytes_arc4random_buf(void *target, size_t count) {
-  arc4random_buf(target, count);
-  // MSan does not understand `arc4random_buf`, so explain its effects
-  MSAN_UNPOISON(target, count);
-}

expat/lib/random_arc4random_buf.h

@@ -1,39 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#if ! defined(RANDOM_ACR4RANDOM_BUF_H)
-#  define RANDOM_ACR4RANDOM_BUF_H 1
-
-#  include <stddef.h> // for size_t
-
-void writeRandomBytes_arc4random_buf(void *target, size_t count);
-
-#endif // ! defined(RANDOM_ACR4RANDOM_BUF_H)

expat/lib/random_dev_urandom.c

@@ -1,72 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
-   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "random_dev_urandom.h"
-
-#if ! defined(_POSIX_C_SOURCE)                                                 \
-    || (defined(_POSIX_C_SOURCE) && (_POSIX_C_SOURCE < 200809L))
-#  define _POSIX_C_SOURCE 200809L // for O_CLOEXEC
-#endif
-
-#include <errno.h>
-#include <fcntl.h>  // open
-#include <unistd.h> // close
-
-/* Extract entropy from /dev/urandom */
-bool
-writeRandomBytes_dev_urandom(void *target, size_t count) {
-  int success = false; /* full count bytes written? */
-  size_t bytesWrittenTotal = 0;
-
-  const int fd = open("/dev/urandom", O_RDONLY | O_CLOEXEC);
-  if (fd < 0) {
-    return false;
-  }
-
-  do {
-    void *const currentTarget = (char *)target + bytesWrittenTotal;
-    const size_t bytesToWrite = count - bytesWrittenTotal;
-
-    errno = 0;
-
-    const ssize_t bytesWrittenMore = read(fd, currentTarget, bytesToWrite);
-
-    if (bytesWrittenMore > 0) {
-      bytesWrittenTotal += bytesWrittenMore;
-      if (bytesWrittenTotal >= count)
-        success = true;
-    }
-  } while (! success && (errno == EINTR));
-
-  close(fd);
-  return success;
-}

expat/lib/random_getentropy.c

@@ -1,60 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-   Copyright (c) 2026 Matthew Fernandez <matthew.fernandez@gmail.com>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "random_getentropy.h"
-
-// NOTE: Please keep this block in sync with its two siblings in files
-//       `configure.ac` and `ConfigureChecks.cmake`!
-#if defined(__APPLE__)
-#  include <sys/random.h>
-#else
-#  if defined(__GLIBC__) && ! defined(_DEFAULT_SOURCE)
-#    define _DEFAULT_SOURCE 1
-#  endif
-#  if ! defined(_GNU_SOURCE)
-#    define _GNU_SOURCE 1 /* for musl */
-#  endif
-#  include <unistd.h>
-#endif // ! defined(__APPLE__)
-
-#include "memory_sanitizer.h"
-#include <errno.h>
-
-bool
-writeRandomBytes_getentropy(void *target, size_t count) {
-  errno = 0;
-  const bool success = getentropy(target, count);
-  // MSan does not understand `getentropy`, so explain its effects
-  if (success)
-    MSAN_UNPOISON(target, count);
-  return success;
-}

expat/lib/random_getentropy.h

@@ -1,40 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#if ! defined(RANDOM_GETENTROPY_H)
-#  define RANDOM_GETENTROPY_H 1
-
-#  include <stdbool.h>
-#  include <stddef.h> // for size_t
-
-bool writeRandomBytes_getentropy(void *target, size_t count);
-
-#endif // ! defined(RANDOM_GETENTROPY_H)

expat/lib/random_getrandom.c

@@ -1,95 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2017-2026 Sebastian Pipping <sebastian@pipping.org>
-   Copyright (c) 2017      Chanho Park <chanho61.park@samsung.com>
-   Copyright (c) 2022      Sean McBride <sean@rogue-research.com>
-   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "expat_config.h" // for HAVE_GETRANDOM, HAVE_SYSCALL_GETRANDOM
-
-#include "random_getrandom.h"
-
-#if defined(HAVE_GETRANDOM)
-#  include <sys/random.h> /* getrandom */
-#endif
-
-#if defined(HAVE_SYSCALL_GETRANDOM)
-#  if ! defined(_GNU_SOURCE)
-#    define _GNU_SOURCE 1 /* syscall prototype */
-#  endif
-#  include <unistd.h>      /* syscall */
-#  include <sys/syscall.h> /* SYS_getrandom */
-#endif                     // defined(HAVE_SYSCALL_GETRANDOM)
-
-#if ! defined(GRND_NONBLOCK)
-#  define GRND_NONBLOCK 0x0001
-#endif /* defined(GRND_NONBLOCK) */
-
-#include "memory_sanitizer.h"
-#include <assert.h>
-#include <errno.h>
-#include <limits.h> // for INT_MAX
-
-/* Obtain entropy on Linux 3.17+ */
-bool
-writeRandomBytes_getrandom_nonblock(void *target, size_t count) {
-  int success = false; /* full count bytes written? */
-  size_t bytesWrittenTotal = 0;
-  const unsigned int getrandomFlags = GRND_NONBLOCK;
-
-  do {
-    void *const currentTarget = (char *)target + bytesWrittenTotal;
-    const size_t bytesToWrite = count - bytesWrittenTotal;
-
-    assert(bytesToWrite <= INT_MAX);
-
-    errno = 0;
-
-    const int bytesWrittenMore =
-#if defined(HAVE_GETRANDOM)
-        (int)getrandom(currentTarget, bytesToWrite, getrandomFlags);
-    // MSan understands `getrandom`, so does not need extra guidance
-#else
-        (int)syscall(SYS_getrandom, currentTarget, bytesToWrite,
-                     getrandomFlags);
-    // MSan does not understand `syscall`, so explain its effects
-    if (bytesWrittenMore > 0)
-      MSAN_UNPOISON(currentTarget, bytesWrittenMore);
-#endif
-
-    if (bytesWrittenMore > 0) {
-      bytesWrittenTotal += bytesWrittenMore;
-      if (bytesWrittenTotal >= count)
-        success = true;
-    }
-  } while (! success && (errno == EINTR));
-
-  return success;
-}

expat/lib/random_getrandom.h

@@ -1,40 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#if ! defined(RANDOM_GETRANDOM_H)
-#  define RANDOM_GETRANDOM_H 1
-
-#  include <stdbool.h>
-#  include <stddef.h> // for size_t
-
-bool writeRandomBytes_getrandom_nonblock(void *target, size_t count);
-
-#endif // ! defined(RANDOM_GETRANDOM_H)

expat/lib/random_rand_s.c

@@ -1,88 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
-   Copyright (c) 2019-2026 Sebastian Pipping <sebastian@pipping.org>
-   Copyright (c) 2019      Ben Wagner <bungeman@chromium.org>
-   Copyright (c) 2019      Vadim Zeitlin <vadim@zeitlins.org>
-   Copyright (c) 2026      Matthew Fernandez <matthew.fernandez@gmail.com>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#include "random_rand_s.h"
-
-/* force stdlib to define rand_s() */
-#if ! defined(_CRT_RAND_S)
-#  define _CRT_RAND_S
-#endif
-
-// Workaround MinGW GCC trouble with recognizing `rand_s`, likely related
-// to return type `error_t`; the symptom was:
-// > error: implicit declaration of function ‘rand_s’
-#if defined(__MINGW32__)
-#  include <errno.h>
-#endif
-
-#include <stdlib.h> // for rand_s
-#include <string.h> // for memcpy
-
-// Help clang-tidy out with prototype of function `rand_s`
-#if defined(XML_CLANG_TIDY)
-int rand_s(unsigned int *);
-#endif
-
-/* Provide declaration of rand_s() for MinGW-32 (not 64, which has it),
-   as it didn't declare it in its header prior to version 5.3.0 of its
-   runtime package (mingwrt, containing stdlib.h).  The upstream fix
-   was introduced at https://osdn.net/projects/mingw/ticket/39658 . */
-#if defined(__MINGW32__) && defined(__MINGW32_VERSION)                         \
-    && __MINGW32_VERSION < 5003000L && ! defined(__MINGW64_VERSION_MAJOR)
-__declspec(dllimport) int rand_s(unsigned int *);
-#endif
-
-/* Obtain entropy on Windows using the rand_s() function which
- * generates cryptographically secure random numbers.  Internally it
- * uses RtlGenRandom API which is present in Windows XP and later.
- */
-bool
-writeRandomBytes_rand_s(void *target, size_t count) {
-  size_t bytesWrittenTotal = 0;
-
-  while (bytesWrittenTotal < count) {
-    unsigned int random32 = 0;
-
-    if (rand_s(&random32))
-      return false; /* failure */
-
-    size_t toUse = count - bytesWrittenTotal;
-    if (toUse > sizeof(random32))
-      toUse = sizeof(random32);
-    memcpy((char *)target + bytesWrittenTotal, &random32, toUse);
-    bytesWrittenTotal += toUse;
-  }
-  return true; /* success */
-}

expat/lib/random_rand_s.h

@@ -1,41 +0,0 @@
-/*
-                            __  __            _
-                         ___\ \/ /_ __   __ _| |_
-                        / _ \\  /| '_ \ / _` | __|
-                       |  __//  \| |_) | (_| | |_
-                        \___/_/\_\ .__/ \__,_|\__|
-                                 |_| XML parser
-
-   Copyright (c) 2019 David Loffredo <loffredo@steptools.com>
-   Copyright (c) 2026 Sebastian Pipping <sebastian@pipping.org>
-   Licensed under the MIT license:
-
-   Permission is  hereby granted,  free of charge,  to any  person obtaining
-   a  copy  of  this  software   and  associated  documentation  files  (the
-   "Software"),  to  deal in  the  Software  without restriction,  including
-   without  limitation the  rights  to use,  copy,  modify, merge,  publish,
-   distribute, sublicense, and/or sell copies of the Software, and to permit
-   persons  to whom  the Software  is  furnished to  do so,  subject to  the
-   following conditions:
-
-   The above copyright  notice and this permission notice  shall be included
-   in all copies or substantial portions of the Software.
-
-   THE  SOFTWARE  IS  PROVIDED  "AS  IS",  WITHOUT  WARRANTY  OF  ANY  KIND,
-   EXPRESS  OR IMPLIED,  INCLUDING  BUT  NOT LIMITED  TO  THE WARRANTIES  OF
-   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-   NO EVENT SHALL THE AUTHORS OR  COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-   DAMAGES OR  OTHER LIABILITY, WHETHER  IN AN  ACTION OF CONTRACT,  TORT OR
-   OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-   USE OR OTHER DEALINGS IN THE SOFTWARE.
-*/
-
-#if ! defined(RANDOM_RAND_S_H)
-#  define RANDOM_RAND_S_H 1
-
-#  include <stdbool.h>
-#  include <stddef.h> // for size_t
-
-bool writeRandomBytes_rand_s(void *target, size_t count);
-
-#endif // ! defined(RANDOM_RAND_S_H)

expat/lib/siphash.h

@@ -100,7 +100,6 @@
 
 #include <stddef.h> /* size_t */
 #include <stdint.h> /* uint64_t uint32_t uint8_t */
-#include "fallthrough.h"
 
 /*
  * Workaround to not require a C++11 compiler for using ULL suffix
@@ -127,7 +126,8 @@
    | ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40)                   \
    | ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56))
 
-#define SIPHASH_INITIALIZER {0, 0, 0, 0, {0}, 0, 0}
+#define SIPHASH_INITIALIZER                                                    \
+  { 0, 0, 0, 0, {0}, 0, 0 }
 
 struct siphash {
   uint64_t v0, v1, v2, v3;
@@ -235,25 +235,25 @@ sip24_final(struct siphash *H) {
   switch (left) {
   case 7:
     b |= (uint64_t)H->buf[6] << 48;
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case 6:
     b |= (uint64_t)H->buf[5] << 40;
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case 5:
     b |= (uint64_t)H->buf[4] << 32;
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case 4:
     b |= (uint64_t)H->buf[3] << 24;
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case 3:
     b |= (uint64_t)H->buf[2] << 16;
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case 2:
     b |= (uint64_t)H->buf[1] << 8;
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case 1:
     b |= (uint64_t)H->buf[0] << 0;
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case 0:
     break;
   }

expat/lib/winconfig.h

@@ -9,8 +9,7 @@
    Copyright (c) 2000      Clark Cooper <coopercc@users.sourceforge.net>
    Copyright (c) 2002      Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2005      Karl Waclawek <karl@waclawek.net>
-   Copyright (c) 2017-2023 Sebastian Pipping <sebastian@pipping.org>
-   Copyright (c) 2023      Orgad Shaneh <orgad.shaneh@audiocodes.com>
+   Copyright (c) 2017-2021 Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining

expat/lib/xmlrole.c

@@ -12,11 +12,10 @@
    Copyright (c) 2002-2006 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2002-2003 Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2005-2009 Steven Solie <steven@solie.ca>
-   Copyright (c) 2016-2023 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2021 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
-   Copyright (c) 2021      Donghee Na <donghee.na@python.org>
-   Copyright (c) 2025      Alfonso Gregory <gfunni234@gmail.com>
+   Copyright (c) 2021      Dong-hee Na <donghee.na@python.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -39,7 +38,7 @@
    USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 
-#include "expat_config.h"
+#include <expat_config.h>
 
 #include <stddef.h>
 
@@ -47,6 +46,7 @@
 #  include "winconfig.h"
 #endif
 
+#include "expat_external.h"
 #include "internal.h"
 #include "xmlrole.h"
 #include "ascii.h"

expat/lib/xmlrole.h

@@ -10,7 +10,7 @@
    Copyright (c) 2000      Clark Cooper <coopercc@users.sourceforge.net>
    Copyright (c) 2002      Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2002      Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
-   Copyright (c) 2017-2025 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2017      Sebastian Pipping <sebastian@pipping.org>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -34,13 +34,19 @@
 */
 
 #ifndef XmlRole_INCLUDED
-#  define XmlRole_INCLUDED 1
+#define XmlRole_INCLUDED 1
 
-#  include "xmltok.h"
+#ifdef __VMS
+/*      0        1         2         3      0        1         2         3
+        1234567890123456789012345678901     1234567890123456789012345678901 */
+#  define XmlPrologStateInitExternalEntity XmlPrologStateInitExternalEnt
+#endif
 
-#  ifdef __cplusplus
+#include "xmltok.h"
+
+#ifdef __cplusplus
 extern "C" {
-#  endif
+#endif
 
 enum {
   XML_ROLE_ERROR = -1,
@@ -101,11 +107,11 @@ enum {
   XML_ROLE_CONTENT_ELEMENT_PLUS,
   XML_ROLE_PI,
   XML_ROLE_COMMENT,
-#  ifdef XML_DTD
+#ifdef XML_DTD
   XML_ROLE_TEXT_DECL,
   XML_ROLE_IGNORE_SECT,
   XML_ROLE_INNER_PARAM_ENTITY_REF,
-#  endif /* XML_DTD */
+#endif /* XML_DTD */
   XML_ROLE_PARAM_ENTITY_REF
 };
 
@@ -114,23 +120,23 @@ typedef struct prolog_state {
                         const char *end, const ENCODING *enc);
   unsigned level;
   int role_none;
-#  ifdef XML_DTD
+#ifdef XML_DTD
   unsigned includeLevel;
   int documentEntity;
   int inEntityValue;
-#  endif /* XML_DTD */
+#endif /* XML_DTD */
 } PROLOG_STATE;
 
-void XmlPrologStateInit(PROLOG_STATE *state);
-#  ifdef XML_DTD
-void XmlPrologStateInitExternalEntity(PROLOG_STATE *state);
-#  endif /* XML_DTD */
+void XmlPrologStateInit(PROLOG_STATE *);
+#ifdef XML_DTD
+void XmlPrologStateInitExternalEntity(PROLOG_STATE *);
+#endif /* XML_DTD */
 
-#  define XmlTokenRole(state, tok, ptr, end, enc)                              \
-    (((state)->handler)(state, tok, ptr, end, enc))
+#define XmlTokenRole(state, tok, ptr, end, enc)                                \
+  (((state)->handler)(state, tok, ptr, end, enc))
 
-#  ifdef __cplusplus
+#ifdef __cplusplus
 }
-#  endif
+#endif
 
 #endif /* not XmlRole_INCLUDED */

expat/lib/xmltok.c

@@ -12,7 +12,7 @@
    Copyright (c) 2002      Greg Stein <gstein@users.sourceforge.net>
    Copyright (c) 2002-2016 Karl Waclawek <karl@waclawek.net>
    Copyright (c) 2005-2009 Steven Solie <steven@solie.ca>
-   Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2022 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2016      Pascal Cuoq <cuoq@trust-in-soft.com>
    Copyright (c) 2016      Don Lewis <truckman@apache.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
@@ -20,12 +20,8 @@
    Copyright (c) 2017      Benbuck Nason <bnason@netflix.com>
    Copyright (c) 2017      José Gutiérrez de la Concha <jose@zeroc.com>
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
-   Copyright (c) 2021      Donghee Na <donghee.na@python.org>
+   Copyright (c) 2021      Dong-hee Na <donghee.na@python.org>
    Copyright (c) 2022      Martin Ettl <ettl.martin78@googlemail.com>
-   Copyright (c) 2022      Sean McBride <sean@rogue-research.com>
-   Copyright (c) 2023      Hanno Böck <hanno@gentoo.org>
-   Copyright (c) 2025      Alfonso Gregory <gfunni234@gmail.com>
-   Copyright (c) 2026      Nick Begg <nick@stunttruck.net>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -48,7 +44,7 @@
    USE OR OTHER DEALINGS IN THE SOFTWARE.
 */
 
-#include "expat_config.h"
+#include <expat_config.h>
 
 #include <stddef.h>
 #include <string.h> /* memcpy */
@@ -58,8 +54,8 @@
 #  include "winconfig.h"
 #endif
 
+#include "expat_external.h"
 #include "internal.h"
-#include "fallthrough.h"
 #include "xmltok.h"
 #include "nametab.h"
 
@@ -80,7 +76,7 @@
 #define VTABLE VTABLE1, PREFIX(toUtf8), PREFIX(toUtf16)
 
 #define UCS2_GET_NAMING(pages, hi, lo)                                         \
-  (namingBitmap[(pages[hi] << 3) + ((lo) >> 5)] & (1u << ((lo) & 0x1F)))
+  (namingBitmap[(pages[hi] << 3) + ((lo) >> 5)] & (1u << ((lo)&0x1F)))
 
 /* A 2 byte UTF-8 representation splits the characters 11 bits between
    the bottom 5 and 6 bits of the bytes.  We need 8 bits to index into
@@ -229,7 +225,7 @@ struct normal_encoding {
       /* isNmstrt2 */ NULL, /* isNmstrt3 */ NULL, /* isNmstrt4 */ NULL,        \
       /* isInvalid2 */ NULL, /* isInvalid3 */ NULL, /* isInvalid4 */ NULL
 
-static int FASTCALL checkCharRefNumber(int result);
+static int FASTCALL checkCharRefNumber(int);
 
 #include "xmltok_impl.h"
 #include "ascii.h"
@@ -643,7 +639,7 @@ unicode_byte_type(char hi, char lo) {
           *(*toP)++ = lo;                                                      \
           break;                                                               \
         }                                                                      \
-        EXPAT_FALLTHROUGH;                                                     \
+        /* fall through */                                                     \
       case 0x1:                                                                \
       case 0x2:                                                                \
       case 0x3:                                                                \
@@ -1177,13 +1173,6 @@ doParseXmlDecl(const ENCODING *(*encodingFinder)(const ENCODING *, const char *,
       *versionPtr = val;
     if (versionEndPtr)
       *versionEndPtr = ptr;
-    /* The version number must not be empty; VersionNum requires at least
-       one character.  The encoding and standalone pseudo-attributes below
-       already reject an empty value, so keep version consistent. */
-    if (val == ptr - enc->minBytesPerChar) {
-      *badPtr = val;
-      return 0;
-    }
     if (! parsePseudoAttribute(enc, ptr, end, &name, &nameEnd, &val, &ptr)) {
       *badPtr = ptr;
       return 0;
@@ -1407,7 +1396,7 @@ unknown_toUtf16(const ENCODING *enc, const char **fromP, const char *fromLim,
 }
 
 ENCODING *
-XmlInitUnknownEncoding(void *mem, const int *table, CONVERTER convert,
+XmlInitUnknownEncoding(void *mem, int *table, CONVERTER convert,
                        void *userData) {
   int i;
   struct unknown_encoding *e = (struct unknown_encoding *)mem;
@@ -1566,7 +1555,7 @@ initScan(const ENCODING *const *encodingTable, const INIT_ENCODING *enc,
     case 0xEF: /* possibly first byte of UTF-8 BOM */
       if (INIT_ENC_INDEX(enc) == ISO_8859_1_ENC && state == XML_CONTENT_STATE)
         break;
-      EXPAT_FALLTHROUGH;
+      /* fall through */
     case 0x00:
     case 0x3C:
       return XML_TOK_PARTIAL;
@@ -1670,7 +1659,7 @@ initScan(const ENCODING *const *encodingTable, const INIT_ENCODING *enc,
 #  undef ns
 
 ENCODING *
-XmlInitUnknownEncodingNS(void *mem, const int *table, CONVERTER convert,
+XmlInitUnknownEncodingNS(void *mem, int *table, CONVERTER convert,
                          void *userData) {
   ENCODING *enc = XmlInitUnknownEncoding(mem, table, convert, userData);
   if (enc)

expat/lib/xmltok.h

@@ -10,7 +10,7 @@
    Copyright (c) 2000      Clark Cooper <coopercc@users.sourceforge.net>
    Copyright (c) 2002      Fred L. Drake, Jr. <fdrake@users.sourceforge.net>
    Copyright (c) 2002-2005 Karl Waclawek <karl@waclawek.net>
-   Copyright (c) 2016-2024 Sebastian Pipping <sebastian@pipping.org>
+   Copyright (c) 2016-2017 Sebastian Pipping <sebastian@pipping.org>
    Copyright (c) 2017      Rhodri James <rhodri@wildebeest.org.uk>
    Licensed under the MIT license:
 
@@ -35,113 +35,113 @@
 */
 
 #ifndef XmlTok_INCLUDED
-#  define XmlTok_INCLUDED 1
+#define XmlTok_INCLUDED 1
 
-#  ifdef __cplusplus
+#ifdef __cplusplus
 extern "C" {
-#  endif
+#endif
 
 /* The following token may be returned by XmlContentTok */
-#  define XML_TOK_TRAILING_RSQB                                                \
-    -5 /* ] or ]] at the end of the scan; might be                             \
-          start of illegal ]]> sequence */
+#define XML_TOK_TRAILING_RSQB                                                  \
+  -5 /* ] or ]] at the end of the scan; might be                               \
+        start of illegal ]]> sequence */
 /* The following tokens may be returned by both XmlPrologTok and
    XmlContentTok.
 */
-#  define XML_TOK_NONE -4 /* The string to be scanned is empty */
-#  define XML_TOK_TRAILING_CR                                                  \
-    -3                            /* A CR at the end of the scan;              \
-                                     might be part of CRLF sequence */
-#  define XML_TOK_PARTIAL_CHAR -2 /* only part of a multibyte sequence */
-#  define XML_TOK_PARTIAL -1      /* only part of a token */
-#  define XML_TOK_INVALID 0
+#define XML_TOK_NONE -4 /* The string to be scanned is empty */
+#define XML_TOK_TRAILING_CR                                                    \
+  -3                            /* A CR at the end of the scan;                \
+                                   might be part of CRLF sequence */
+#define XML_TOK_PARTIAL_CHAR -2 /* only part of a multibyte sequence */
+#define XML_TOK_PARTIAL -1      /* only part of a token */
+#define XML_TOK_INVALID 0
 
 /* The following tokens are returned by XmlContentTok; some are also
    returned by XmlAttributeValueTok, XmlEntityTok, XmlCdataSectionTok.
 */
-#  define XML_TOK_START_TAG_WITH_ATTS 1
-#  define XML_TOK_START_TAG_NO_ATTS 2
-#  define XML_TOK_EMPTY_ELEMENT_WITH_ATTS 3 /* empty element tag <e/> */
-#  define XML_TOK_EMPTY_ELEMENT_NO_ATTS 4
-#  define XML_TOK_END_TAG 5
-#  define XML_TOK_DATA_CHARS 6
-#  define XML_TOK_DATA_NEWLINE 7
-#  define XML_TOK_CDATA_SECT_OPEN 8
-#  define XML_TOK_ENTITY_REF 9
-#  define XML_TOK_CHAR_REF 10 /* numeric character reference */
+#define XML_TOK_START_TAG_WITH_ATTS 1
+#define XML_TOK_START_TAG_NO_ATTS 2
+#define XML_TOK_EMPTY_ELEMENT_WITH_ATTS 3 /* empty element tag <e/> */
+#define XML_TOK_EMPTY_ELEMENT_NO_ATTS 4
+#define XML_TOK_END_TAG 5
+#define XML_TOK_DATA_CHARS 6
+#define XML_TOK_DATA_NEWLINE 7
+#define XML_TOK_CDATA_SECT_OPEN 8
+#define XML_TOK_ENTITY_REF 9
+#define XML_TOK_CHAR_REF 10 /* numeric character reference */
 
 /* The following tokens may be returned by both XmlPrologTok and
    XmlContentTok.
 */
-#  define XML_TOK_PI 11       /* processing instruction */
-#  define XML_TOK_XML_DECL 12 /* XML decl or text decl */
-#  define XML_TOK_COMMENT 13
-#  define XML_TOK_BOM 14 /* Byte order mark */
+#define XML_TOK_PI 11       /* processing instruction */
+#define XML_TOK_XML_DECL 12 /* XML decl or text decl */
+#define XML_TOK_COMMENT 13
+#define XML_TOK_BOM 14 /* Byte order mark */
 
 /* The following tokens are returned only by XmlPrologTok */
-#  define XML_TOK_PROLOG_S 15
-#  define XML_TOK_DECL_OPEN 16  /* <!foo */
-#  define XML_TOK_DECL_CLOSE 17 /* > */
-#  define XML_TOK_NAME 18
-#  define XML_TOK_NMTOKEN 19
-#  define XML_TOK_POUND_NAME 20 /* #name */
-#  define XML_TOK_OR 21         /* | */
-#  define XML_TOK_PERCENT 22
-#  define XML_TOK_OPEN_PAREN 23
-#  define XML_TOK_CLOSE_PAREN 24
-#  define XML_TOK_OPEN_BRACKET 25
-#  define XML_TOK_CLOSE_BRACKET 26
-#  define XML_TOK_LITERAL 27
-#  define XML_TOK_PARAM_ENTITY_REF 28
-#  define XML_TOK_INSTANCE_START 29
+#define XML_TOK_PROLOG_S 15
+#define XML_TOK_DECL_OPEN 16  /* <!foo */
+#define XML_TOK_DECL_CLOSE 17 /* > */
+#define XML_TOK_NAME 18
+#define XML_TOK_NMTOKEN 19
+#define XML_TOK_POUND_NAME 20 /* #name */
+#define XML_TOK_OR 21         /* | */
+#define XML_TOK_PERCENT 22
+#define XML_TOK_OPEN_PAREN 23
+#define XML_TOK_CLOSE_PAREN 24
+#define XML_TOK_OPEN_BRACKET 25
+#define XML_TOK_CLOSE_BRACKET 26
+#define XML_TOK_LITERAL 27
+#define XML_TOK_PARAM_ENTITY_REF 28
+#define XML_TOK_INSTANCE_START 29
 
 /* The following occur only in element type declarations */
-#  define XML_TOK_NAME_QUESTION 30        /* name? */
-#  define XML_TOK_NAME_ASTERISK 31        /* name* */
-#  define XML_TOK_NAME_PLUS 32            /* name+ */
-#  define XML_TOK_COND_SECT_OPEN 33       /* <![ */
-#  define XML_TOK_COND_SECT_CLOSE 34      /* ]]> */
-#  define XML_TOK_CLOSE_PAREN_QUESTION 35 /* )? */
-#  define XML_TOK_CLOSE_PAREN_ASTERISK 36 /* )* */
-#  define XML_TOK_CLOSE_PAREN_PLUS 37     /* )+ */
-#  define XML_TOK_COMMA 38
+#define XML_TOK_NAME_QUESTION 30        /* name? */
+#define XML_TOK_NAME_ASTERISK 31        /* name* */
+#define XML_TOK_NAME_PLUS 32            /* name+ */
+#define XML_TOK_COND_SECT_OPEN 33       /* <![ */
+#define XML_TOK_COND_SECT_CLOSE 34      /* ]]> */
+#define XML_TOK_CLOSE_PAREN_QUESTION 35 /* )? */
+#define XML_TOK_CLOSE_PAREN_ASTERISK 36 /* )* */
+#define XML_TOK_CLOSE_PAREN_PLUS 37     /* )+ */
+#define XML_TOK_COMMA 38
 
 /* The following token is returned only by XmlAttributeValueTok */
-#  define XML_TOK_ATTRIBUTE_VALUE_S 39
+#define XML_TOK_ATTRIBUTE_VALUE_S 39
 
 /* The following token is returned only by XmlCdataSectionTok */
-#  define XML_TOK_CDATA_SECT_CLOSE 40
+#define XML_TOK_CDATA_SECT_CLOSE 40
 
 /* With namespace processing this is returned by XmlPrologTok for a
    name with a colon.
 */
-#  define XML_TOK_PREFIXED_NAME 41
+#define XML_TOK_PREFIXED_NAME 41
 
-#  ifdef XML_DTD
-#    define XML_TOK_IGNORE_SECT 42
-#  endif /* XML_DTD */
+#ifdef XML_DTD
+#  define XML_TOK_IGNORE_SECT 42
+#endif /* XML_DTD */
 
-#  ifdef XML_DTD
-#    define XML_N_STATES 4
-#  else /* not XML_DTD */
-#    define XML_N_STATES 3
-#  endif /* not XML_DTD */
+#ifdef XML_DTD
+#  define XML_N_STATES 4
+#else /* not XML_DTD */
+#  define XML_N_STATES 3
+#endif /* not XML_DTD */
 
-#  define XML_PROLOG_STATE 0
-#  define XML_CONTENT_STATE 1
-#  define XML_CDATA_SECTION_STATE 2
-#  ifdef XML_DTD
-#    define XML_IGNORE_SECTION_STATE 3
-#  endif /* XML_DTD */
+#define XML_PROLOG_STATE 0
+#define XML_CONTENT_STATE 1
+#define XML_CDATA_SECTION_STATE 2
+#ifdef XML_DTD
+#  define XML_IGNORE_SECTION_STATE 3
+#endif /* XML_DTD */
 
-#  define XML_N_LITERAL_TYPES 2
-#  define XML_ATTRIBUTE_VALUE_LITERAL 0
-#  define XML_ENTITY_VALUE_LITERAL 1
+#define XML_N_LITERAL_TYPES 2
+#define XML_ATTRIBUTE_VALUE_LITERAL 0
+#define XML_ENTITY_VALUE_LITERAL 1
 
 /* The size of the buffer passed to XmlUtf8Encode must be at least this. */
-#  define XML_UTF8_ENCODE_MAX 4
+#define XML_UTF8_ENCODE_MAX 4
 /* The size of the buffer passed to XmlUtf16Encode must be at least this. */
-#  define XML_UTF16_ENCODE_MAX 2
+#define XML_UTF16_ENCODE_MAX 2
 
 typedef struct position {
   /* first line and first column are 0 not 1 */
@@ -220,63 +220,63 @@ struct encoding {
    the prolog outside literals, comments and processing instructions.
 */
 
-#  define XmlTok(enc, state, ptr, end, nextTokPtr)                             \
-    (((enc)->scanners[state])(enc, ptr, end, nextTokPtr))
+#define XmlTok(enc, state, ptr, end, nextTokPtr)                               \
+  (((enc)->scanners[state])(enc, ptr, end, nextTokPtr))
 
-#  define XmlPrologTok(enc, ptr, end, nextTokPtr)                              \
-    XmlTok(enc, XML_PROLOG_STATE, ptr, end, nextTokPtr)
+#define XmlPrologTok(enc, ptr, end, nextTokPtr)                                \
+  XmlTok(enc, XML_PROLOG_STATE, ptr, end, nextTokPtr)
 
-#  define XmlContentTok(enc, ptr, end, nextTokPtr)                             \
-    XmlTok(enc, XML_CONTENT_STATE, ptr, end, nextTokPtr)
+#define XmlContentTok(enc, ptr, end, nextTokPtr)                               \
+  XmlTok(enc, XML_CONTENT_STATE, ptr, end, nextTokPtr)
 
-#  define XmlCdataSectionTok(enc, ptr, end, nextTokPtr)                        \
-    XmlTok(enc, XML_CDATA_SECTION_STATE, ptr, end, nextTokPtr)
+#define XmlCdataSectionTok(enc, ptr, end, nextTokPtr)                          \
+  XmlTok(enc, XML_CDATA_SECTION_STATE, ptr, end, nextTokPtr)
 
-#  ifdef XML_DTD
+#ifdef XML_DTD
 
-#    define XmlIgnoreSectionTok(enc, ptr, end, nextTokPtr)                     \
-      XmlTok(enc, XML_IGNORE_SECTION_STATE, ptr, end, nextTokPtr)
+#  define XmlIgnoreSectionTok(enc, ptr, end, nextTokPtr)                       \
+    XmlTok(enc, XML_IGNORE_SECTION_STATE, ptr, end, nextTokPtr)
 
-#  endif /* XML_DTD */
+#endif /* XML_DTD */
 
 /* This is used for performing a 2nd-level tokenization on the content
    of a literal that has already been returned by XmlTok.
 */
-#  define XmlLiteralTok(enc, literalType, ptr, end, nextTokPtr)                \
-    (((enc)->literalScanners[literalType])(enc, ptr, end, nextTokPtr))
+#define XmlLiteralTok(enc, literalType, ptr, end, nextTokPtr)                  \
+  (((enc)->literalScanners[literalType])(enc, ptr, end, nextTokPtr))
 
-#  define XmlAttributeValueTok(enc, ptr, end, nextTokPtr)                      \
-    XmlLiteralTok(enc, XML_ATTRIBUTE_VALUE_LITERAL, ptr, end, nextTokPtr)
+#define XmlAttributeValueTok(enc, ptr, end, nextTokPtr)                        \
+  XmlLiteralTok(enc, XML_ATTRIBUTE_VALUE_LITERAL, ptr, end, nextTokPtr)
 
-#  define XmlEntityValueTok(enc, ptr, end, nextTokPtr)                         \
-    XmlLiteralTok(enc, XML_ENTITY_VALUE_LITERAL, ptr, end, nextTokPtr)
+#define XmlEntityValueTok(enc, ptr, end, nextTokPtr)                           \
+  XmlLiteralTok(enc, XML_ENTITY_VALUE_LITERAL, ptr, end, nextTokPtr)
 
-#  define XmlNameMatchesAscii(enc, ptr1, end1, ptr2)                           \
-    (((enc)->nameMatchesAscii)(enc, ptr1, end1, ptr2))
+#define XmlNameMatchesAscii(enc, ptr1, end1, ptr2)                             \
+  (((enc)->nameMatchesAscii)(enc, ptr1, end1, ptr2))
 
-#  define XmlNameLength(enc, ptr) (((enc)->nameLength)(enc, ptr))
+#define XmlNameLength(enc, ptr) (((enc)->nameLength)(enc, ptr))
 
-#  define XmlSkipS(enc, ptr) (((enc)->skipS)(enc, ptr))
+#define XmlSkipS(enc, ptr) (((enc)->skipS)(enc, ptr))
 
-#  define XmlGetAttributes(enc, ptr, attsMax, atts)                            \
-    (((enc)->getAtts)(enc, ptr, attsMax, atts))
+#define XmlGetAttributes(enc, ptr, attsMax, atts)                              \
+  (((enc)->getAtts)(enc, ptr, attsMax, atts))
 
-#  define XmlCharRefNumber(enc, ptr) (((enc)->charRefNumber)(enc, ptr))
+#define XmlCharRefNumber(enc, ptr) (((enc)->charRefNumber)(enc, ptr))
 
-#  define XmlPredefinedEntityName(enc, ptr, end)                               \
-    (((enc)->predefinedEntityName)(enc, ptr, end))
+#define XmlPredefinedEntityName(enc, ptr, end)                                 \
+  (((enc)->predefinedEntityName)(enc, ptr, end))
 
-#  define XmlUpdatePosition(enc, ptr, end, pos)                                \
-    (((enc)->updatePosition)(enc, ptr, end, pos))
+#define XmlUpdatePosition(enc, ptr, end, pos)                                  \
+  (((enc)->updatePosition)(enc, ptr, end, pos))
 
-#  define XmlIsPublicId(enc, ptr, end, badPtr)                                 \
-    (((enc)->isPublicId)(enc, ptr, end, badPtr))
+#define XmlIsPublicId(enc, ptr, end, badPtr)                                   \
+  (((enc)->isPublicId)(enc, ptr, end, badPtr))
 
-#  define XmlUtf8Convert(enc, fromP, fromLim, toP, toLim)                      \
-    (((enc)->utf8Convert)(enc, fromP, fromLim, toP, toLim))
+#define XmlUtf8Convert(enc, fromP, fromLim, toP, toLim)                        \
+  (((enc)->utf8Convert)(enc, fromP, fromLim, toP, toLim))
 
-#  define XmlUtf16Convert(enc, fromP, fromLim, toP, toLim)                     \
-    (((enc)->utf16Convert)(enc, fromP, fromLim, toP, toLim))
+#define XmlUtf16Convert(enc, fromP, fromLim, toP, toLim)                       \
+  (((enc)->utf16Convert)(enc, fromP, fromLim, toP, toLim))
 
 typedef struct {
   ENCODING initEnc;
@@ -289,8 +289,7 @@ int XmlParseXmlDecl(int isGeneralTextEntity, const ENCODING *enc,
                     const char **encodingNamePtr,
                     const ENCODING **namedEncodingPtr, int *standalonePtr);
 
-int XmlInitEncoding(INIT_ENCODING *p, const ENCODING **encPtr,
-                    const char *name);
+int XmlInitEncoding(INIT_ENCODING *, const ENCODING **, const char *name);
 const ENCODING *XmlGetUtf8InternalEncoding(void);
 const ENCODING *XmlGetUtf16InternalEncoding(void);
 int FASTCALL XmlUtf8Encode(int charNumber, char *buf);
@@ -299,7 +298,7 @@ int XmlSizeOfUnknownEncoding(void);
 
 typedef int(XMLCALL *CONVERTER)(void *userData, const char *p);
 
-ENCODING *XmlInitUnknownEncoding(void *mem, const int *table, CONVERTER convert,
+ENCODING *XmlInitUnknownEncoding(void *mem, int *table, CONVERTER convert,
                                  void *userData);
 
 int XmlParseXmlDeclNS(int isGeneralTextEntity, const ENCODING *enc,
@@ -308,14 +307,13 @@ int XmlParseXmlDeclNS(int isGeneralTextEntity, const ENCODING *enc,
                       const char **encodingNamePtr,
                       const ENCODING **namedEncodingPtr, int *standalonePtr);
 
-int XmlInitEncodingNS(INIT_ENCODING *p, const ENCODING **encPtr,
-                      const char *name);
+int XmlInitEncodingNS(INIT_ENCODING *, const ENCODING **, const char *name);
 const ENCODING *XmlGetUtf8InternalEncodingNS(void);
 const ENCODING *XmlGetUtf16InternalEncodingNS(void);
-ENCODING *XmlInitUnknownEncodingNS(void *mem, const int *table,
-                                   CONVERTER convert, void *userData);
-#  ifdef __cplusplus
+ENCODING *XmlInitUnknownEncodingNS(void *mem, int *table, CONVERTER convert,
+                                   void *userData);
+#ifdef __cplusplus
 }
-#  endif
+#endif
 
 #endif /* not XmlTok_INCLUDED */

expat/lib/xmltok_impl.c

@@ -17,7 +17,6 @@
    Copyright (c) 2019      David Loffredo <loffredo@steptools.com>
    Copyright (c) 2020      Boris Kolpackov <boris@codesynthesis.com>
    Copyright (c) 2022      Martin Ettl <ettl.martin78@googlemail.com>
-   Copyright (c) 2026      Nick Begg <nick@stunttruck.net>
    Licensed under the MIT license:
 
    Permission is  hereby granted,  free of charge,  to any  person obtaining
@@ -84,7 +83,7 @@
       *nextTokPtr = ptr;                                                       \
       return XML_TOK_INVALID;                                                  \
     }                                                                          \
-    EXPAT_FALLTHROUGH;                                                         \
+    /* fall through */                                                         \
   case BT_NMSTRT:                                                              \
   case BT_HEX:                                                                 \
   case BT_DIGIT:                                                               \
@@ -113,7 +112,7 @@
       *nextTokPtr = ptr;                                                       \
       return XML_TOK_INVALID;                                                  \
     }                                                                          \
-    EXPAT_FALLTHROUGH;                                                         \
+    /* fall through */                                                         \
   case BT_NMSTRT:                                                              \
   case BT_HEX:                                                                 \
     ptr += MINBPC(enc);                                                        \
@@ -127,7 +126,7 @@
 #  endif
 
 #  define HAS_CHARS(enc, ptr, end, count)                                      \
-    ((end) - (ptr) >= ((count) * MINBPC(enc)))
+    ((end) - (ptr) >= ((count)*MINBPC(enc)))
 
 #  define HAS_CHAR(enc, ptr, end) HAS_CHARS(enc, ptr, end, 1)
 
@@ -210,7 +209,7 @@ PREFIX(scanDecl)(const ENCODING *enc, const char *ptr, const char *end,
         *nextTokPtr = ptr;
         return XML_TOK_INVALID;
       }
-      EXPAT_FALLTHROUGH;
+      /* fall through */
     case BT_S:
     case BT_CR:
     case BT_LF:
@@ -324,7 +323,7 @@ PREFIX(scanPi)(const ENCODING *enc, const char *ptr, const char *end,
         *nextTokPtr = ptr + MINBPC(enc);
         return tok;
       }
-      EXPAT_FALLTHROUGH;
+      /* fall through */
     default:
       *nextTokPtr = ptr;
       return XML_TOK_INVALID;
@@ -616,7 +615,7 @@ PREFIX(scanAtts)(const ENCODING *enc, const char *ptr, const char *end,
           return XML_TOK_INVALID;
         }
       }
-      EXPAT_FALLTHROUGH;
+      /* fall through */
     case BT_EQUALS: {
       int open;
 #  ifdef XML_NS
@@ -899,7 +898,7 @@ PREFIX(contentTok)(const ENCODING *enc, const char *ptr, const char *end,
           return XML_TOK_INVALID;
         }
       }
-      EXPAT_FALLTHROUGH;
+      /* fall through */
     case BT_AMP:
     case BT_LT:
     case BT_NONXML:
@@ -1060,7 +1059,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
       /* indicate that this might be part of a CR/LF pair */
       return -XML_TOK_PROLOG_S;
     }
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   case BT_S:
   case BT_LF:
     for (;;) {
@@ -1075,7 +1074,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
         /* don't split CR/LF pair */
         if (ptr + MINBPC(enc) != end)
           break;
-        EXPAT_FALLTHROUGH;
+        /* fall through */
       default:
         *nextTokPtr = ptr;
         return XML_TOK_PROLOG_S;
@@ -1190,7 +1189,7 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
       tok = XML_TOK_NMTOKEN;
       break;
     }
-    EXPAT_FALLTHROUGH;
+    /* fall through */
   default:
     *nextTokPtr = ptr;
     return XML_TOK_INVALID;
@@ -1485,7 +1484,7 @@ PREFIX(isPublicId)(const ENCODING *enc, const char *ptr, const char *end,
     case BT_NMSTRT:
       if (! (BYTE_TO_ASCII(enc, ptr) & ~0x7f))
         break;
-      EXPAT_FALLTHROUGH;
+      /* fall through */
     default:
       switch (BYTE_TO_ASCII(enc, ptr)) {
       case 0x24: /* $ */