This is an automated email from the git hooks/post-receive script.
guix_mirror_bot pushed a commit to branch master
in repository guix.
The following commit(s) were added to refs/heads/master by this push:
new 3a058615937 gnu: expat: graft with expat-2.8.4 [security-fixes]
3a058615937 is described below
commit 3a05861593793275d13be848042c322e0a342497
Author: Zheng Junjie <[email protected]>
AuthorDate: Fri Sep 18 10:07:37 2026 +0800
gnu: expat: graft with expat-2.8.4 [security-fixes]
Fixed: CVE-2026-66046, CVE-2026-76641, CVE-2026-76957, CVE-2026-76956,
CVE-2026-72522, CVE-2026-50219, CVE-2026-56131, CVE-2026-56132,
CVE-2026-56403, CVE-2026-56404, CVE-2026-56405, CVE-2026-56406,
CVE-2026-56407, CVE-2026-56408, CVE-2026-56409, CVE-2026-56410,
CVE-2026-56411, CVE-2026-56412, CVE-2026-45186, CVE-2026-41080,
CVE-2026-32776, CVE-2026-32777, CVE-2026-32778, CVE-2026-24515,
CVE-2026-25210, CVE-2025-59375.
* gnu/packages/xml.scm (expat-2.8.4): New Variable.
(expat)[replacement]: Use it.
---
gnu/packages/xml.scm | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/gnu/packages/xml.scm b/gnu/packages/xml.scm
index 9933d0102be..8e50bd8ee25 100644
--- a/gnu/packages/xml.scm
+++ b/gnu/packages/xml.scm
@@ -40,6 +40,7 @@
;;; Copyright © 2025 John Kehayias <[email protected]>
;;; Copyright © 2025 Remco van 't Veer <[email protected]>
;;; Copyright © 2025 pinoaffe <[email protected]>
+;;; Copyright © 2025, 2026 zhengjunjie <[email protected]>
;;;
;;; This file is part of GNU Guix.
;;;
@@ -132,6 +133,7 @@ the entire document.")
(package
(name "expat")
(version "2.7.1")
+ (replacement expat-2.8.4)
(source (let ((dot->underscore (lambda (c) (if (char=? #\. c) #\_ c))))
(origin
(method url-fetch)
@@ -167,6 +169,23 @@ stream-oriented parser in which an application registers
handlers for
things the parser might find in the XML document (like start tags).")
(license license:expat)))
+(define expat-2.8.4
+ (hidden-package
+ (package
+ (inherit expat)
+ (name "expat")
+ (version "2.8.4")
+ (source (let ((dot->underscore (lambda (c) (if (char=? #\. c) #\_ c))))
+ (origin
+ (method url-fetch)
+ (uri (string-append
+
"https://github.com/libexpat/libexpat/releases/download/R_";
+ (string-map dot->underscore version)
+ "/expat-" version ".tar.xz"))
+ (sha256
+ (base32
+
"19w5k6q7ccw7v8wn5v60hj096hv27vrm9qml7d8ymd53ip6f2sk5"))))))))
+
(define-public libebml
(package
(name "libebml")
