configure.ac                                                                   
           |    2 
 download.lst                                                                   
           |   18 
 external/libxml2/ExternalPackage_libxml2.mk                                    
           |    4 
 external/libxml2/ExternalProject_libxml2.mk                                    
           |    2 
 external/libxml2/UnpackedTarball_libxml2.mk                                    
           |    4 
 external/libxml2/deprecated.patch.0                                            
           |   54 
 external/libxml2/libxml2-XMLCALL-redefine.patch.0                              
           |    8 
 external/libxml2/libxml2-android.patch                                         
           |    4 
 external/libxml2/libxml2-global-symbols.patch                                  
           |    8 
 external/libxml2/libxml2-icu-sym.patch.0                                       
           |   10 
 external/libxml2/libxml2-icu.patch.0                                           
           |   10 
 external/libxml2/libxml2-vc10.patch                                            
           |    4 
 external/libxml2/makefile.msvc-entry-point.patch.0                             
           |   32 
 external/libxslt/77.patch.1                                                    
           |  706 ++++++++++
 external/libxslt/ExternalPackage_libxslt.mk                                    
           |    2 
 external/libxslt/README                                                        
           |    2 
 external/libxslt/UnpackedTarball_libxslt.mk                                    
           |    3 
 external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1                        
           |   99 +
 external/libxslt/libxslt-1.1.26-memdump.patch                                  
           |   10 
 external/redland/ExternalProject_raptor.mk                                     
           |   19 
 external/redland/ExternalProject_redland.mk                                    
           |    6 
 external/redland/Library_raptor.mk                                             
           |    2 
 external/redland/README                                                        
           |    2 
 external/redland/UnpackedTarball_raptor.mk                                     
           |    6 
 
external/redland/raptor/0001-CVE-2020-25713-raptor2-malformed-input-file-can-lead.patch.1
 |   33 
 
external/redland/raptor/0001-Calcualte-max-nspace-declarations-correctly-for-XML-.patch.1
 |   43 
 external/redland/raptor/CVE-2024-57823.patch.1                                 
           |   35 
 external/redland/raptor/Wint-conversion.patch                                  
           |   22 
 external/redland/raptor/libtool.patch                                          
           |   27 
 external/redland/raptor/raptor-android.patch.1                                 
           |   10 
 external/redland/raptor/raptor-bundled-soname.patch.1                          
           |   12 
 external/redland/raptor/raptor-emscripten.patch.1                              
           |    8 
 external/redland/raptor/raptor-freebsd.patch.1                                 
           |   31 
 external/redland/raptor/raptor-icu.patch                                       
           |   11 
 external/redland/raptor/raptor-msvc.patch.1                                    
           |   10 
 external/redland/raptor/raptor2.h                                              
           |   32 
 external/redland/raptor/raptor_config.h                                        
           |   46 
 external/redland/raptor/ubsan.patch                                            
           |   14 
 external/redland/raptor/xml2-config.patch                                      
           |    6 
 external/redland/rasqal/rasqal-pkgconfig.patch.1                               
           |    3 
 external/xmlsec/0001-xmlsec-core-Fix-deprecated-LibXML2-warnings-840.patch.1   
           |  424 ++++++
 external/xmlsec/ExternalProject_xmlsec.mk                                      
           |    2 
 external/xmlsec/UnpackedTarball_xmlsec.mk                                      
           |    3 
 filter/source/xsltfilter/LibXSLTTransformer.cxx                                
           |   16 
 helpcompiler/source/HelpCompiler.cxx                                           
           |   14 
 sw/qa/extras/htmlexport/htmlexport.cxx                                         
           |    2 
 unoxml/qa/unit/domtest.cxx                                                     
           |    8 
 xmlsecurity/source/xmlsec/saxhelper.cxx                                        
           |   15 
 48 files changed, 1554 insertions(+), 290 deletions(-)

New commits:
commit abfc3fa94174bb2dd5fe9d326afd1e96c97e9576
Author:     Xisco Fauli <[email protected]>
AuthorDate: Tue Sep 9 17:03:13 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:46 2026 +0100

    libxml2: upgrade to 2.14.6
    
    9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 has been fixed upstream
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.14/libxml2-2.14.6.tar.xz
    
    Change-Id: Ibfd34613bc74644830b2e45c32c16462e7c7bd32
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/190720
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 5e9caecd24636664d3de0a1eff06df540aa70fc4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/190723
    Reviewed-by: Adolfo Jayme Barrientos <[email protected]>
    (cherry picked from commit 4a96bf9864e040ae3afa958a76a8ec3cf7ab2487)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192537
    Reviewed-by: Michael Stahl <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    (cherry picked from commit 83891e5c1d2c2df862e58c3ac441852e2f5a5396)

diff --git a/download.lst b/download.lst
index c21ee5c8b664..3bccc2ca0404 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b
-LIBXML_VERSION_MICRO := 5
+LIBXML_SHA256SUM := 
7ce458a0affeb83f0b55f1f4f9e0e55735dbfc1a9de124ee86fb4a66b597203a
+LIBXML_VERSION_MICRO := 6
 LIBXML_TARBALL := libxml2-2.14.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
diff --git a/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 
b/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
deleted file mode 100644
index 5984d25e957d..000000000000
--- a/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
+++ /dev/null
@@ -1,64 +0,0 @@
-From 9de92ed78d8495527c5d7a4d0cc76c1f83768195 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <[email protected]>
-Date: Tue, 5 Aug 2025 22:26:27 +0200
-Subject: [PATCH] tree: Guard against atype corruption
-
-Always remove ids if `id` member is set.
-
-Untested, but this should fix CVE-2025-7425 reported against libxslt:
-
-https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
----
- tree.c  | 8 ++++----
- valid.c | 2 +-
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/tree.c b/tree.c
-index 2e8df00b8..ddb8bdb3b 100644
---- a/tree.c
-+++ b/tree.c
-@@ -1892,8 +1892,8 @@ xmlFreeProp(xmlAttrPtr cur) {
-       xmlDeregisterNodeDefaultValue((xmlNodePtr)cur);
- 
-     /* Check for ID removal -> leading to invalid references ! */
--    if ((cur->doc != NULL) && (cur->atype == XML_ATTRIBUTE_ID)) {
--          xmlRemoveID(cur->doc, cur);
-+    if (cur->doc != NULL && cur->id != NULL) {
-+        xmlRemoveID(cur->doc, cur);
-     }
-     if (cur->children != NULL) xmlFreeNodeList(cur->children);
-     DICT_FREE(cur->name)
-@@ -2736,7 +2736,7 @@ xmlNodeSetDoc(xmlNodePtr node, xmlDocPtr doc) {
-              * TODO: ID attributes should also be added to the new
-              * document, but it's not clear how to handle clashes.
-              */
--            if (attr->atype == XML_ATTRIBUTE_ID)
-+            if (attr->id != NULL)
-                 xmlRemoveID(oldDoc, attr);
- 
-             break;
-@@ -6919,7 +6919,7 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar 
*name,
-                 return(NULL);
-         }
- 
--      if (prop->atype == XML_ATTRIBUTE_ID) {
-+      if (prop->id != NULL) {
-           xmlRemoveID(node->doc, prop);
-           prop->atype = XML_ATTRIBUTE_ID;
-       }
-diff --git a/valid.c b/valid.c
-index 34b6757cb..e625f0c1b 100644
---- a/valid.c
-+++ b/valid.c
-@@ -4296,7 +4296,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr 
doc,
-              attr->name, elem->name, NULL);
-       return(0);
-     }
--    if (attr->atype == XML_ATTRIBUTE_ID)
-+    if (attr->id != NULL)
-         xmlRemoveID(doc, attr);
-     attr->atype = attrDecl->atype;
- 
--- 
-GitLab
-
diff --git a/external/libxml2/UnpackedTarball_libxml2.mk 
b/external/libxml2/UnpackedTarball_libxml2.mk
index 593556dbc532..223577f7c037 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -23,7 +23,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
        $(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
                external/libxml2/libxml2-icu-sym.patch.0, \
                external/libxml2/libxml2-icu.patch.0) \
-       external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 \
 ))
 
 $(eval $(call 
gb_UnpackedTarball_add_file,libxml2,xml2-config.in,external/libxml2/xml2-config.in))
commit b5b931eee1b433ed24129c00cefc328e2226c361
Author:     Michael Stahl <[email protected]>
AuthorDate: Thu Aug 7 16:28:20 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:45 2026 +0100

    libxml2: add upstream patch for CVE-2025-7425
    
    Change-Id: I84110fc1ed54eac4a0ce4d8b8070a031c761fb39
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189104
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit 88e2be781bc22f8500f57c84cec572ead8af32c4)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192536
    Reviewed-by: Stephan Bergmann <[email protected]>
    (cherry picked from commit 94a106f77c4561c006ba10cf691a0d281add60c3)

diff --git a/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 
b/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
new file mode 100644
index 000000000000..5984d25e957d
--- /dev/null
+++ b/external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1
@@ -0,0 +1,64 @@
+From 9de92ed78d8495527c5d7a4d0cc76c1f83768195 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <[email protected]>
+Date: Tue, 5 Aug 2025 22:26:27 +0200
+Subject: [PATCH] tree: Guard against atype corruption
+
+Always remove ids if `id` member is set.
+
+Untested, but this should fix CVE-2025-7425 reported against libxslt:
+
+https://gitlab.gnome.org/GNOME/libxslt/-/issues/140
+---
+ tree.c  | 8 ++++----
+ valid.c | 2 +-
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/tree.c b/tree.c
+index 2e8df00b8..ddb8bdb3b 100644
+--- a/tree.c
++++ b/tree.c
+@@ -1892,8 +1892,8 @@ xmlFreeProp(xmlAttrPtr cur) {
+       xmlDeregisterNodeDefaultValue((xmlNodePtr)cur);
+ 
+     /* Check for ID removal -> leading to invalid references ! */
+-    if ((cur->doc != NULL) && (cur->atype == XML_ATTRIBUTE_ID)) {
+-          xmlRemoveID(cur->doc, cur);
++    if (cur->doc != NULL && cur->id != NULL) {
++        xmlRemoveID(cur->doc, cur);
+     }
+     if (cur->children != NULL) xmlFreeNodeList(cur->children);
+     DICT_FREE(cur->name)
+@@ -2736,7 +2736,7 @@ xmlNodeSetDoc(xmlNodePtr node, xmlDocPtr doc) {
+              * TODO: ID attributes should also be added to the new
+              * document, but it's not clear how to handle clashes.
+              */
+-            if (attr->atype == XML_ATTRIBUTE_ID)
++            if (attr->id != NULL)
+                 xmlRemoveID(oldDoc, attr);
+ 
+             break;
+@@ -6919,7 +6919,7 @@ xmlSetNsProp(xmlNodePtr node, xmlNsPtr ns, const xmlChar 
*name,
+                 return(NULL);
+         }
+ 
+-      if (prop->atype == XML_ATTRIBUTE_ID) {
++      if (prop->id != NULL) {
+           xmlRemoveID(node->doc, prop);
+           prop->atype = XML_ATTRIBUTE_ID;
+       }
+diff --git a/valid.c b/valid.c
+index 34b6757cb..e625f0c1b 100644
+--- a/valid.c
++++ b/valid.c
+@@ -4296,7 +4296,7 @@ xmlValidateOneAttribute(xmlValidCtxtPtr ctxt, xmlDocPtr 
doc,
+              attr->name, elem->name, NULL);
+       return(0);
+     }
+-    if (attr->atype == XML_ATTRIBUTE_ID)
++    if (attr->id != NULL)
+         xmlRemoveID(doc, attr);
+     attr->atype = attrDecl->atype;
+ 
+-- 
+GitLab
+
diff --git a/external/libxml2/UnpackedTarball_libxml2.mk 
b/external/libxml2/UnpackedTarball_libxml2.mk
index 223577f7c037..593556dbc532 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -23,6 +23,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
        $(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
                external/libxml2/libxml2-icu-sym.patch.0, \
                external/libxml2/libxml2-icu.patch.0) \
+       external/libxml2/9de92ed78d8495527c5d7a4d0cc76c1f83768195.patch.1 \
 ))
 
 $(eval $(call 
gb_UnpackedTarball_add_file,libxml2,xml2-config.in,external/libxml2/xml2-config.in))
commit 2f17aa782aab25acbf6aa9ca20e4c055b55f7557
Author:     Xisco Fauli <[email protected]>
AuthorDate: Tue Jul 15 16:37:01 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:45 2026 +0100

    libxml2: upgrade to 2.14.5
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.14/libxml2-2.14.5.tar.xz
    
    Change-Id: I4e2e3f19479ae3c28801f0aa92adf918d633b6d5
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/187923
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 79034b63b142b3f8bcc5d13ab4a16c0e9c42587a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189103
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 6fd40df9172d9c8ab3272a67789dea586e462370)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192535
    (cherry picked from commit 18538f353fa92c481557cd902791007191fb29bd)

diff --git a/download.lst b/download.lst
index 070e145f675e..c21ee5c8b664 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
24175ec30a97cfa86bdf9befb7ccf4613f8f4b2713c5103e0dd0bc9c711a2773
-LIBXML_VERSION_MICRO := 4
+LIBXML_SHA256SUM := 
03d006f3537616833c16c53addcdc32a0eb20e55443cba4038307e3fa7d8d44b
+LIBXML_VERSION_MICRO := 5
 LIBXML_TARBALL := libxml2-2.14.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 194c7532736f8b5f27a22adec6c5f4716ff5493e
Author:     Xisco Fauli <[email protected]>
AuthorDate: Tue Jun 17 11:17:03 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:45 2026 +0100

    libxml2: upgrade to 2.14.4
    
    * 0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
    has been fixed upstream
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.14/libxml2-2.14.4.tar.xz
    
    Change-Id: Icd9ab0d96e8d9299716a16a967c424a565264d68
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/186609
    Reviewed-by: Xisco Fauli <[email protected]>
    Tested-by: Jenkins
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/186641
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 3c92a424982304cdd46fe159556eabfe3cba60c9)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192534
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 2e82ebaac97486f2a3e12980a18427e1bdee1dc2)

diff --git a/download.lst b/download.lst
index c39cda16f980..070e145f675e 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
6de55cacc8c2bc758f2ef6f93c313cb30e4dd5d84ac5d3c7ccbd9344d8cc6833
-LIBXML_VERSION_MICRO := 3
+LIBXML_SHA256SUM := 
24175ec30a97cfa86bdf9befb7ccf4613f8f4b2713c5103e0dd0bc9c711a2773
+LIBXML_VERSION_MICRO := 4
 LIBXML_TARBALL := libxml2-2.14.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
diff --git 
a/external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
 
b/external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
deleted file mode 100644
index 5df7ad6726b7..000000000000
--- 
a/external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
+++ /dev/null
@@ -1,37 +0,0 @@
-From 30375877d981be8ede8620b13c6928342d929b58 Mon Sep 17 00:00:00 2001
-From: Nick Wellnhofer <[email protected]>
-Date: Tue, 3 Jun 2025 15:50:54 +0200
-Subject: [PATCH] parser: Fix custom SAX parsers without cdataBlock handler
-
-Use characters handler if cdataBlock handler is NULL.
-
-Regressed with 57e4bbd8. Should fix #934.
----
- parser.c | 11 +++++------
- 1 file changed, 5 insertions(+), 6 deletions(-)
-
-diff --git a/parser.c b/parser.c
-index e6598413..c96c3bec 100644
---- a/parser.c
-+++ b/parser.c
-@@ -9502,12 +9502,11 @@ xmlParseCDSect(xmlParserCtxt *ctxt) {
-      * OK the buffer is to be consumed as cdata.
-      */
-     if ((ctxt->sax != NULL) && (!ctxt->disableSAX)) {
--        if (ctxt->options & XML_PARSE_NOCDATA) {
--            if (ctxt->sax->characters != NULL)
--                ctxt->sax->characters(ctxt->userData, buf, len);
--        } else {
--            if (ctxt->sax->cdataBlock != NULL)
--                ctxt->sax->cdataBlock(ctxt->userData, buf, len);
-+        if ((ctxt->sax->cdataBlock != NULL) &&
-+            ((ctxt->options & XML_PARSE_NOCDATA) == 0)) {
-+            ctxt->sax->cdataBlock(ctxt->userData, buf, len);
-+        } else if (ctxt->sax->characters != NULL) {
-+            ctxt->sax->characters(ctxt->userData, buf, len);
-         }
-     }
- 
--- 
-2.39.5
-
diff --git a/external/libxml2/UnpackedTarball_libxml2.mk 
b/external/libxml2/UnpackedTarball_libxml2.mk
index 6d63717d7875..223577f7c037 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -19,7 +19,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
        external/libxml2/libxml2-XMLCALL-redefine.patch.0 \
        external/libxml2/makefile.msvc-entry-point.patch.0 \
        external/libxml2/deprecated.patch.0 \
-       
external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
 \
        $(if $(filter ANDROID,$(OS)),external/libxml2/libxml2-android.patch) \
        $(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
                external/libxml2/libxml2-icu-sym.patch.0, \
diff --git a/external/libxml2/deprecated.patch.0 
b/external/libxml2/deprecated.patch.0
index 40f5e2392ca0..0fddc62679b4 100644
--- a/external/libxml2/deprecated.patch.0
+++ b/external/libxml2/deprecated.patch.0
@@ -10,7 +10,7 @@
  XMLPUBVAR double xmlXPathPINF;
 --- include/libxml/parser.h    2025-05-13 16:42:31.000000000 +0200
 +++ include/libxml/parser.h    2025-06-03 14:00:37.833979131 +0200
-@@ -268,20 +268,20 @@
+@@ -268,7 +268,7 @@
      /* Number of current input streams */
      int inputNr;
      /* Max number of input streams */
@@ -18,12 +18,10 @@
 +    int inputMax;
      /* stack of inputs */
      xmlParserInputPtr *inputTab;
-
-     /* Node analysis stack only used for DOM building */
-
+ 
+@@ -277,11 +277,11 @@
      /* Current parsed Node */
--    xmlNodePtr node XML_DEPRECATED_MEMBER;
-+    xmlNodePtr node;
+     xmlNodePtr node;
      /* Depth of the parsing stack */
 -    int nodeNr XML_DEPRECATED_MEMBER;
 +    int nodeNr;
@@ -32,7 +30,7 @@
      /* array of nodes */
 -    xmlNodePtr *nodeTab XML_DEPRECATED_MEMBER;
 +    xmlNodePtr *nodeTab;
-
+ 
      /* Whether node info should be kept */
      int record_info;
 @@ -374,7 +374,7 @@
commit edee8d1437827e7d878301f6ab1b41c67ce938ea
Author:     Jan Holesovsky <[email protected]>
AuthorDate: Mon Jul 21 08:57:23 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:45 2026 +0100

    Fix macOS build after libxml2 upgrade to 2.14.3
    
    Change-Id: I94c8fbfb150a214c7517c849336b0025813a181b
    (cherry picked from commit 8db5b9bf79bb4cf26e2ed8dc37107f2e6ca44f40)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192533
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 9803db67cdf1182e00bebba94d3ab7cf093193a2)

diff --git a/external/libxml2/ExternalPackage_libxml2.mk 
b/external/libxml2/ExternalPackage_libxml2.mk
index 072cfece9a74..0caabe1263af 100644
--- a/external/libxml2/ExternalPackage_libxml2.mk
+++ b/external/libxml2/ExternalPackage_libxml2.mk
@@ -13,7 +13,7 @@ $(eval $(call 
gb_ExternalPackage_use_external_project,libxml2,libxml2))
 
 ifneq ($(DISABLE_DYNLOADING),TRUE)
 ifeq ($(OS),MACOSX)
-$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.2.dylib,.libs/libxml2.2.dylib))
+$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.16.dylib,.libs/libxml2.16.dylib))
 else ifeq ($(OS),WNT)
 ifeq ($(COM),GCC)
 $(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.dll,.libs/libxml2.dll))
commit 36257a7f28076fd0dd5a661f5c7424291a3b21a2
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Apr 23 13:38:50 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:45 2026 +0100

    libxml2: upgrade to 2.14.3
    
    * In 
https://gitlab.gnome.org/GNOME/libxml2/-/commit/712a31abe458eed75f0e2a442b35af58cf7091ca
    some members used by Libreoffice were marked as deprecated.
    Add deprecated.patch.0 to undeprecate them for now.
    Meanwhile
    https://gitlab.gnome.org/GNOME/libxml2/-/issues/936#note_2461334 has been
    opened to discuss it. The necessary code changes
    will be addressed in a follow-up commit
    
    * In 
https://gitlab.gnome.org/GNOME/libxml2/-/commit/bfe6af2eed38564693b35ac5aa60178068f34fbb
    main() was moved from xmllint.c to lintmain.c.
    Add makefile.msvc-entry-point.patch.0 to address that
    
    * 0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
    fixes https://gitlab.gnome.org/GNOME/libxml2/-/issues/934
    
    * Since 
https://gitlab.gnome.org/GNOME/libxml2/-/commit/f070acc56400410a3ad27f4df313526749364962
    android builds in Jenkins fail with "configure: error: libiconv not
    found"
    Run configure with --without-iconv. Same as in Windows
    
    * Adapt testLeadingTabHTML since The HTML parser normalizes newlines
    according to HTML5 now
    See https://gitlab.gnome.org/GNOME/libxml2/-/issues/938#note_2463720
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.14/libxml2-2.14.3.tar.xz
    
    Change-Id: Ie010c236f5dad5156f7f4204033d0c02928742ec
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/184501
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    Signed-off-by: Xisco Fauli <[email protected]>
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/186640
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 459c74286f0a431d5a92e6ceb9ff0462873a388c)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192532
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 739b3691181ff2faa510d4d4fa6b74866d7285b1)

diff --git a/download.lst b/download.lst
index 56e2877553ad..c39cda16f980 100644
--- a/download.lst
+++ b/download.lst
@@ -408,9 +408,9 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
277294cb33119ab71b2bc81f2f445e9bc9435b893ad15bb2cd2b0e859a0ee84a
-LIBXML_VERSION_MICRO := 8
-LIBXML_TARBALL := libxml2-2.13.$(LIBXML_VERSION_MICRO).tar.xz
+LIBXML_SHA256SUM := 
6de55cacc8c2bc758f2ef6f93c313cb30e4dd5d84ac5d3c7ccbd9344d8cc6833
+LIBXML_VERSION_MICRO := 3
+LIBXML_TARBALL := libxml2-2.14.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
diff --git 
a/external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
 
b/external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
new file mode 100644
index 000000000000..5df7ad6726b7
--- /dev/null
+++ 
b/external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
@@ -0,0 +1,37 @@
+From 30375877d981be8ede8620b13c6928342d929b58 Mon Sep 17 00:00:00 2001
+From: Nick Wellnhofer <[email protected]>
+Date: Tue, 3 Jun 2025 15:50:54 +0200
+Subject: [PATCH] parser: Fix custom SAX parsers without cdataBlock handler
+
+Use characters handler if cdataBlock handler is NULL.
+
+Regressed with 57e4bbd8. Should fix #934.
+---
+ parser.c | 11 +++++------
+ 1 file changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/parser.c b/parser.c
+index e6598413..c96c3bec 100644
+--- a/parser.c
++++ b/parser.c
+@@ -9502,12 +9502,11 @@ xmlParseCDSect(xmlParserCtxt *ctxt) {
+      * OK the buffer is to be consumed as cdata.
+      */
+     if ((ctxt->sax != NULL) && (!ctxt->disableSAX)) {
+-        if (ctxt->options & XML_PARSE_NOCDATA) {
+-            if (ctxt->sax->characters != NULL)
+-                ctxt->sax->characters(ctxt->userData, buf, len);
+-        } else {
+-            if (ctxt->sax->cdataBlock != NULL)
+-                ctxt->sax->cdataBlock(ctxt->userData, buf, len);
++        if ((ctxt->sax->cdataBlock != NULL) &&
++            ((ctxt->options & XML_PARSE_NOCDATA) == 0)) {
++            ctxt->sax->cdataBlock(ctxt->userData, buf, len);
++        } else if (ctxt->sax->characters != NULL) {
++            ctxt->sax->characters(ctxt->userData, buf, len);
+         }
+     }
+ 
+-- 
+2.39.5
+
diff --git a/external/libxml2/ExternalPackage_libxml2.mk 
b/external/libxml2/ExternalPackage_libxml2.mk
index 17190c77fd18..072cfece9a74 100644
--- a/external/libxml2/ExternalPackage_libxml2.mk
+++ b/external/libxml2/ExternalPackage_libxml2.mk
@@ -21,7 +21,7 @@ else # COM=MSC
 $(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.dll,win32/bin.msvc/libxml2.dll))
 endif
 else # OS!=WNT
-$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.13.$(LIBXML_VERSION_MICRO)))
+$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.16,.libs/libxml2.so.16.0.$(LIBXML_VERSION_MICRO)))
 endif
 endif # DISABLE_DYNLOADING
 
diff --git a/external/libxml2/ExternalProject_libxml2.mk 
b/external/libxml2/ExternalProject_libxml2.mk
index 2fe0e6005724..8548bef0a3d4 100644
--- a/external/libxml2/ExternalProject_libxml2.mk
+++ b/external/libxml2/ExternalProject_libxml2.mk
@@ -35,7 +35,7 @@ else # OS!=WNT
 $(call gb_ExternalProject_get_state_target,libxml2,build):
        $(call gb_Trace_StartRange,libxml2,EXTERNAL)
        $(call gb_ExternalProject_run,build,\
-               $(gb_RUN_CONFIGURE) ./configure --disable-ipv6 --without-python 
--without-zlib --with-sax1 \
+               $(gb_RUN_CONFIGURE) ./configure --disable-ipv6 --without-iconv 
--without-python --without-zlib --with-sax1 \
                        --without-lzma \
                        $(if $(debug),--with-run-debug) \
                        $(if 
$(verbose),--disable-silent-rules,--enable-silent-rules) \
diff --git a/external/libxml2/UnpackedTarball_libxml2.mk 
b/external/libxml2/UnpackedTarball_libxml2.mk
index 489fb007572b..6d63717d7875 100644
--- a/external/libxml2/UnpackedTarball_libxml2.mk
+++ b/external/libxml2/UnpackedTarball_libxml2.mk
@@ -17,6 +17,9 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxml2,\
        $(if $(filter 
SOLARIS,$(OS)),external/libxml2/libxml2-global-symbols.patch) \
        external/libxml2/libxml2-vc10.patch \
        external/libxml2/libxml2-XMLCALL-redefine.patch.0 \
+       external/libxml2/makefile.msvc-entry-point.patch.0 \
+       external/libxml2/deprecated.patch.0 \
+       
external/libxml2/0001-parser-Fix-custom-SAX-parsers-without-cdataBlock-han.patch.1
 \
        $(if $(filter ANDROID,$(OS)),external/libxml2/libxml2-android.patch) \
        $(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED), \
                external/libxml2/libxml2-icu-sym.patch.0, \
diff --git a/external/libxml2/deprecated.patch.0 
b/external/libxml2/deprecated.patch.0
new file mode 100644
index 000000000000..40f5e2392ca0
--- /dev/null
+++ b/external/libxml2/deprecated.patch.0
@@ -0,0 +1,56 @@
+--- include/libxml/xpath.h     2025-05-13 16:42:31.000000000 +0200
++++ include/libxml/xpath.h     2025-06-03 14:10:14.539373167 +0200
+@@ -401,7 +401,6 @@
+  * Objects and Nodesets handling
+  */
+
+-XML_DEPRECATED
+ XMLPUBVAR double xmlXPathNAN;
+ XML_DEPRECATED
+ XMLPUBVAR double xmlXPathPINF;
+--- include/libxml/parser.h    2025-05-13 16:42:31.000000000 +0200
++++ include/libxml/parser.h    2025-06-03 14:00:37.833979131 +0200
+@@ -268,20 +268,20 @@
+     /* Number of current input streams */
+     int inputNr;
+     /* Max number of input streams */
+-    int inputMax XML_DEPRECATED_MEMBER;
++    int inputMax;
+     /* stack of inputs */
+     xmlParserInputPtr *inputTab;
+
+     /* Node analysis stack only used for DOM building */
+
+     /* Current parsed Node */
+-    xmlNodePtr node XML_DEPRECATED_MEMBER;
++    xmlNodePtr node;
+     /* Depth of the parsing stack */
+-    int nodeNr XML_DEPRECATED_MEMBER;
++    int nodeNr;
+     /* Max depth of the parsing stack */
+     int nodeMax XML_DEPRECATED_MEMBER;
+     /* array of nodes */
+-    xmlNodePtr *nodeTab XML_DEPRECATED_MEMBER;
++    xmlNodePtr *nodeTab;
+
+     /* Whether node info should be kept */
+     int record_info;
+@@ -374,7 +374,7 @@
+     /* document's own catalog */
+     void *catalogs XML_DEPRECATED_MEMBER;
+     /* run in recovery mode */
+-    int recovery XML_DEPRECATED_MEMBER;
++    int recovery;
+     /* unused */
+     int progressive XML_DEPRECATED_MEMBER;
+     /* dictionary for the parser */
+@@ -436,7 +436,7 @@
+     /*
+      * the complete error information for the last error.
+      */
+-    xmlError lastError XML_DEPRECATED_MEMBER;
++    xmlError lastError;
+     /* the parser mode */
+     xmlParserMode parseMode XML_DEPRECATED_MEMBER;
+     /* unused */
+
diff --git a/external/libxml2/libxml2-android.patch 
b/external/libxml2/libxml2-android.patch
index acf9b17e02db..f5281778ff29 100644
--- a/external/libxml2/libxml2-android.patch
+++ b/external/libxml2/libxml2-android.patch
@@ -1,7 +1,7 @@
 --- misc/libxml2-2.7.6/Makefile.in
 +++ misc/build/libxml2-2.7.6/Makefile.in
-@@ -1635,7 +1635,7 @@
-       $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS)
+@@ -1775,7 +1775,7 @@
+       $(MAKE) $(AM_MAKEFLAGS) $(check_PROGRAMS) $(check_LTLIBRARIES)
        $(MAKE) $(AM_MAKEFLAGS) check-local
  check: check-recursive
 -all-am: Makefile $(PROGRAMS) $(LTLIBRARIES) $(SCRIPTS) $(DATA) \
diff --git a/external/libxml2/libxml2-icu-sym.patch.0 
b/external/libxml2/libxml2-icu-sym.patch.0
index d89a1c4c544b..32404d7e2b4a 100644
--- a/external/libxml2/libxml2-icu-sym.patch.0
+++ b/external/libxml2/libxml2-icu-sym.patch.0
@@ -10,8 +10,8 @@ diff -up win32/Makefile.msvc.dt win32/Makefile.msvc
 +CFLAGS = $(CFLAGS) /I$(WORKDIR)/UnpackedTarball/icu/source/i18n 
/I$(WORKDIR)/UnpackedTarball/icu/source/common
  !if "$(WITH_THREADS)" == "ctls"
  CFLAGS = $(CFLAGS) /D "XML_THREAD_LOCAL=__declspec(thread)"
- !else if "$(WITH_THREADS)" == "posix"
-@@ -62,7 +63,9 @@
+ !endif
+@@ -51,7 +52,9 @@
  # The linker and its options.
  LD = link.exe
  LDFLAGS = /nologo /VERSION:$(LIBXML_MAJOR_VERSION).$(LIBXML_MINOR_VERSION)
@@ -19,7 +19,7 @@ diff -up win32/Makefile.msvc.dt win32/Makefile.msvc
  LDFLAGS = $(LDFLAGS) /LIBPATH:$(BINDIR) /LIBPATH:$(LIBPREFIX)
 +LDFLAGS = $(LDFLAGS) /DEBUG /OPT:REF
  LIBS =
- !if "$(WITH_FTP)" == "1" || "$(WITH_HTTP)" == "1"
+ !if "$(WITH_HTTP)" == "1"
  LIBS = $(LIBS) wsock32.lib ws2_32.lib
 @@ -74,9 +77,13 @@
  !if "$(STATIC)" == "1"
diff --git a/external/libxml2/libxml2-icu.patch.0 
b/external/libxml2/libxml2-icu.patch.0
index 85ce8b3aba2b..eaabcbd26f5c 100644
--- a/external/libxml2/libxml2-icu.patch.0
+++ b/external/libxml2/libxml2-icu.patch.0
@@ -10,15 +10,15 @@ diff -up win32/Makefile.msvc.dt win32/Makefile.msvc
 +CFLAGS = $(CFLAGS) /I$(WORKDIR)/UnpackedTarball/icu/source/i18n 
/I$(WORKDIR)/UnpackedTarball/icu/source/common
  !if "$(WITH_THREADS)" == "ctls"
  CFLAGS = $(CFLAGS) /D "XML_THREAD_LOCAL=__declspec(thread)"
- !else if "$(WITH_THREADS)" == "posix"
-@@ -67,6 +68,7 @@ CFLAGS = $(CFLAGS) $(SOLARINC)
+ !endif
+@@ -51,6 +52,7 @@
  # The linker and its options.
  LD = link.exe
  LDFLAGS = /nologo /VERSION:$(LIBXML_MAJOR_VERSION).$(LIBXML_MINOR_VERSION)
 +LDFLAGS = $(LDFLAGS) /LIBPATH:$(WORKDIR)/UnpackedTarball/icu/source/lib
  LDFLAGS = $(LDFLAGS) /LIBPATH:$(BINDIR) /LIBPATH:$(LIBPREFIX)
  LIBS =
- !if "$(WITH_FTP)" == "1" || "$(WITH_HTTP)" == "1"
+ !if "$(WITH_HTTP)" == "1"
 @@ -78,7 +78,11 @@ LIBS = $(LIBS) wsock32.lib ws2_32.lib
  !if "$(STATIC)" == "1"
  LIBS = $(LIBS) advapi32.lib sicuuc.lib sicuin.lib sicudt.lib
diff --git a/external/libxml2/libxml2-vc10.patch 
b/external/libxml2/libxml2-vc10.patch
index 15bc4d973ea7..bf46fdbde3bd 100644
--- a/external/libxml2/libxml2-vc10.patch
+++ b/external/libxml2/libxml2-vc10.patch
@@ -2,8 +2,8 @@ Add SOLARINC, and disable SSE2 default for MSVC2012
 
 --- build/libxml2-2.7.6/win32/Makefile.msvc.old        2010-09-20 
20:22:41.500000000 +0200
 +++ build/libxml2-2.7.6/win32/Makefile.msvc    2010-09-20 20:23:00.250000000 
+0200
-@@ -59,6 +59,7 @@
- CFLAGS = $(CFLAGS) /D "HAVE_PTHREAD_H"
+@@ -46,6 +46,7 @@
+ CFLAGS = $(CFLAGS) /D "XML_THREAD_LOCAL=__declspec(thread)"
  !endif
  CFLAGS = $(CFLAGS) /D_CRT_SECURE_NO_DEPRECATE /D_CRT_NONSTDC_NO_DEPRECATE
 +CFLAGS = $(CFLAGS) $(SOLARINC)
diff --git a/external/libxml2/makefile.msvc-entry-point.patch.0 
b/external/libxml2/makefile.msvc-entry-point.patch.0
new file mode 100644
index 000000000000..afcc1aa07a0e
--- /dev/null
+++ b/external/libxml2/makefile.msvc-entry-point.patch.0
@@ -0,0 +1,32 @@
+--- win32/Makefile.msvc        2025-06-06 10:57:06.219160687 +0200
++++ win32/Makefile.msvc        2025-06-06 11:01:45.213981862 +0200
+@@ -235,17 +235,7 @@
+ !endif
+ 
+ # Xmllint and friends executables.
+-UTILS = $(BINDIR)\xmllint.exe\
+-      $(BINDIR)\xmlcatalog.exe\
+-      $(BINDIR)       estModule.exe\
+-      $(BINDIR) untest.exe\
+-      $(BINDIR) unsuite.exe\
+-      $(BINDIR) unxmlconf.exe\
+-      $(BINDIR)       estapi.exe\
+-      $(BINDIR)       estchar.exe\
+-      $(BINDIR)       estdict.exe\
+-      $(BINDIR)       estlimits.exe\
+-      $(BINDIR)       estrecurse.exe
++UTILS = $(BINDIR)\xmllint.exe
+       
+ !if "$(VCMANIFEST)" == "1"
+ _VC_MANIFEST_EMBED_EXE= if exist [email protected] mt.exe -nologo -manifest 
[email protected] -outputresource:$@;1
+@@ -396,8 +386,8 @@
+       @$(_VC_MANIFEST_EMBED_EXE)
+ !else
+ {$(UTILS_SRCDIR)}.c{$(BINDIR)}.exe:
+-      $(CC) $(CFLAGS) /Fo$(UTILS_INTDIR)\ /c $< 
+-      $(LD) $(LDFLAGS) /OUT:$@ $(XML_IMP) $(LIBS) $(UTILS_INTDIR)\$(<B).obj
++      $(CC) $(CFLAGS) /Fo$(UTILS_INTDIR)\ /c $< ..\lintmain.c ..\shell.c
++      $(LD) $(LDFLAGS) /OUT:$@ $(XML_IMP) $(LIBS) $(UTILS_INTDIR)\$(<B).obj  
$(UTILS_INTDIR)\lintmain.obj $(UTILS_INTDIR)\shell.obj
+       @$(_VC_MANIFEST_EMBED_EXE)
+ !endif
+ 
diff --git a/sw/qa/extras/htmlexport/htmlexport.cxx 
b/sw/qa/extras/htmlexport/htmlexport.cxx
index ace894a15a97..fa2627651de4 100644
--- a/sw/qa/extras/htmlexport/htmlexport.cxx
+++ b/sw/qa/extras/htmlexport/htmlexport.cxx
@@ -2256,7 +2256,7 @@ CPPUNIT_TEST_FIXTURE(SwHtmlDomExportTest, 
testLeadingTabHTML)
     // - Expected: <newline><nbsp><nbsp><space>test
     // - Actual  : <newline><tab><space>test
     // i.e. the leading tab was not replaced by 2 nbsps.
-    assertXPathContent(pHtmlDoc, "/html/body/p", SAL_NEWLINE_STRING u"\xa0\xa0 
test");
+    assertXPathContent(pHtmlDoc, "/html/body/p", u"
\xa0\xa0 test");
 }
 
 CPPUNIT_TEST_FIXTURE(HtmlExportTest, testClearingBreak)
commit a63f148a6faf299b756e7adba9e28814fed8c38b
Author:     Michael Stahl <[email protected]>
AuthorDate: Wed Oct 15 16:48:21 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:45 2026 +0100

    libxslt: add patch for CVE-2025-10911
    
    Change-Id: I951aad2bff3911f685f73390e4f42ed29fe49b41
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192444
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Stephan Bergmann <[email protected]>
    (cherry picked from commit fca876c2c369b26244413fafe506acafb9d3b5bf)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192505
    (cherry picked from commit defae28e68100128cdc513ab4fe9ae64f83ee97d)

diff --git a/external/libxslt/77.patch.1 b/external/libxslt/77.patch.1
new file mode 100644
index 000000000000..a5d77a6a96e0
--- /dev/null
+++ b/external/libxslt/77.patch.1
@@ -0,0 +1,706 @@
+From a3139eabb3e204f62e42ae226c8eeea964611733 Mon Sep 17 00:00:00 2001
+From: Daniel Cheng <[email protected]>
+Date: Thu, 5 Jun 2025 09:43:53 -0700
+Subject: [PATCH] Use a dedicated node type to maintain the list of cached RVTs
+
+While evaluating a stylesheet, result value trees (result tree fragments
+in the XSLT spec) are represented as xmlDocs and cached on the transform
+context in a linked list, using xmlDoc's prev and next pointers to
+maintain the list.
+
+However, XPath evaluations can inadvertently traverse these links, which
+are an implementation detail and do not reflect the actual document
+structure. Using a dedicated node type avoids these unintended
+traversals.
+
+Fixes #144.
+---
+ libxslt/transform.c     |  87 ++++++++--------
+ libxslt/variables.c     | 219 +++++++++++++++++++++++++---------------
+ libxslt/xsltInternals.h |  23 +++--
+ 3 files changed, 199 insertions(+), 130 deletions(-)
+
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 54ef821b..2d06ae77 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -518,19 +518,20 @@ xsltTransformCacheFree(xsltTransformCachePtr cache)
+     /*
+     * Free tree fragments.
+     */
+-    if (cache->RVT) {
+-      xmlDocPtr tmp, cur = cache->RVT;
++    if (cache->rvtList) {
++      xsltRVTListPtr tmp, cur = cache->rvtList;
+       while (cur) {
+           tmp = cur;
+-          cur = (xmlDocPtr) cur->next;
+-          if (tmp->_private != NULL) {
++          cur = cur->next;
++          if (tmp->RVT->_private != NULL) {
+               /*
+-              * Tree the document info.
++              * Free the document info.
+               */
+-              xsltFreeDocumentKeys((xsltDocumentPtr) tmp->_private);
+-              xmlFree(tmp->_private);
++              xsltFreeDocumentKeys((xsltDocumentPtr) tmp->RVT->_private);
++              xmlFree(tmp->RVT->_private);
+           }
+-          xmlFreeDoc(tmp);
++            xmlFreeDoc(tmp->RVT);
++            xmlFree(tmp);
+       }
+     }
+     /*
+@@ -2263,38 +2264,36 @@ xsltLocalVariablePush(xsltTransformContextPtr ctxt,
+  * are preserved; all other fragments are freed/cached.
+  */
+ static void
+-xsltReleaseLocalRVTs(xsltTransformContextPtr ctxt, xmlDocPtr base)
++xsltReleaseLocalRVTs(xsltTransformContextPtr ctxt, xsltRVTListPtr base)
+ {
+-    xmlDocPtr cur = ctxt->localRVT, tmp;
++    xsltRVTListPtr cur = ctxt->localRVTList, tmp;
+ 
+     if (cur == base)
+         return;
+-    if (cur->prev != NULL)
+-        xsltTransformError(ctxt, NULL, NULL, "localRVT not head of list
");
+ 
+-    /* Reset localRVT early because some RVTs might be registered again. */
+-    ctxt->localRVT = base;
+-    if (base != NULL)
+-        base->prev = NULL;
++    /* Reset localRVTList early because some RVTs might be registered again. 
*/
++    ctxt->localRVTList = base;
+ 
+     do {
+         tmp = cur;
+-        cur = (xmlDocPtr) cur->next;
+-        if (tmp->compression == XSLT_RVT_LOCAL) {
+-            xsltReleaseRVT(ctxt, tmp);
+-        } else if (tmp->compression == XSLT_RVT_GLOBAL) {
+-            xsltRegisterPersistRVT(ctxt, tmp);
+-        } else if (tmp->compression == XSLT_RVT_FUNC_RESULT) {
++        cur = cur->next;
++        if (tmp->RVT->compression == XSLT_RVT_LOCAL) {
++            xsltReleaseRVTList(ctxt, tmp);
++        } else if (tmp->RVT->compression == XSLT_RVT_GLOBAL) {
++            xsltRegisterPersistRVT(ctxt, tmp->RVT);
++            xmlFree(tmp);
++        } else if (tmp->RVT->compression == XSLT_RVT_FUNC_RESULT) {
+             /*
+              * This will either register the RVT again or move it to the
+              * context variable.
+              */
+-            xsltRegisterLocalRVT(ctxt, tmp);
+-            tmp->compression = XSLT_RVT_FUNC_RESULT;
++            xsltRegisterLocalRVT(ctxt, tmp->RVT);
++            tmp->RVT->compression = XSLT_RVT_FUNC_RESULT;
++            xmlFree(tmp);
+         } else {
+             xmlGenericError(xmlGenericErrorContext,
+-                    "xsltReleaseLocalRVTs: Unexpected RVT flag %p
",
+-                    tmp->psvi);
++                    "xsltReleaseLocalRVTs: Unexpected RVT flag %d
",
++                    tmp->RVT->compression);
+         }
+     } while (cur != base);
+ }
+@@ -2322,7 +2321,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr 
ctxt,
+     xmlNodePtr oldInsert, oldInst, oldCurInst, oldContextNode;
+     xmlNodePtr cur, insert, copy = NULL;
+     int level = 0, oldVarsNr;
+-    xmlDocPtr oldLocalFragmentTop;
++    xsltRVTListPtr oldLocalFragmentTop;
+ 
+ #ifdef XSLT_REFACTORED
+     xsltStylePreCompPtr info;
+@@ -2368,7 +2367,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr 
ctxt,
+     }
+     ctxt->depth++;
+ 
+-    oldLocalFragmentTop = ctxt->localRVT;
++    oldLocalFragmentTop = ctxt->localRVTList;
+     oldInsert = insert = ctxt->insert;
+     oldInst = oldCurInst = ctxt->inst;
+     oldContextNode = ctxt->node;
+@@ -2602,7 +2601,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr 
ctxt,
+                   /*
+                   * Cleanup temporary tree fragments.
+                   */
+-                  if (oldLocalFragmentTop != ctxt->localRVT)
++                  if (oldLocalFragmentTop != ctxt->localRVTList)
+                       xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+                   ctxt->insert = oldInsert;
+@@ -2697,7 +2696,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr 
ctxt,
+                   /*
+                   * Cleanup temporary tree fragments.
+                   */
+-                  if (oldLocalFragmentTop != ctxt->localRVT)
++                  if (oldLocalFragmentTop != ctxt->localRVTList)
+                       xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+                   ctxt->insert = oldInsert;
+@@ -2763,7 +2762,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr 
ctxt,
+               /*
+               * Cleanup temporary tree fragments.
+               */
+-              if (oldLocalFragmentTop != ctxt->localRVT)
++              if (oldLocalFragmentTop != ctxt->localRVTList)
+                   xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+                 ctxt->insert = oldInsert;
+@@ -2893,7 +2892,7 @@ xsltApplySequenceConstructor(xsltTransformContextPtr 
ctxt,
+               /*
+               * Cleanup temporary tree fragments.
+               */
+-              if (oldLocalFragmentTop != ctxt->localRVT)
++              if (oldLocalFragmentTop != ctxt->localRVTList)
+                   xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+ 
+                 ctxt->insert = oldInsert;
+@@ -3072,7 +3071,7 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
+     int oldVarsBase = 0;
+     xmlNodePtr cur;
+     xsltStackElemPtr tmpParam = NULL;
+-    xmlDocPtr oldUserFragmentTop;
++    xsltRVTListPtr oldUserFragmentTop;
+ #ifdef WITH_PROFILER
+     long start = 0;
+ #endif
+@@ -3120,8 +3119,8 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
+         return;
+       }
+ 
+-    oldUserFragmentTop = ctxt->tmpRVT;
+-    ctxt->tmpRVT = NULL;
++    oldUserFragmentTop = ctxt->tmpRVTList;
++    ctxt->tmpRVTList = NULL;
+ 
+     /*
+     * Initiate a distinct scope of local params/variables.
+@@ -3232,16 +3231,16 @@ xsltApplyXSLTTemplate(xsltTransformContextPtr ctxt,
+     * user code should now use xsltRegisterLocalRVT() instead
+     * of the obsolete xsltRegisterTmpRVT().
+     */
+-    if (ctxt->tmpRVT) {
+-      xmlDocPtr curdoc = ctxt->tmpRVT, tmp;
++    if (ctxt->tmpRVTList) {
++      xsltRVTListPtr curRVTList = ctxt->tmpRVTList, tmp;
+ 
+-      while (curdoc != NULL) {
+-          tmp = curdoc;
+-          curdoc = (xmlDocPtr) curdoc->next;
+-          xsltReleaseRVT(ctxt, tmp);
++      while (curRVTList != NULL) {
++          tmp = curRVTList;
++          curRVTList = curRVTList->next;
++          xsltReleaseRVTList(ctxt, tmp);
+       }
+     }
+-    ctxt->tmpRVT = oldUserFragmentTop;
++    ctxt->tmpRVTList = oldUserFragmentTop;
+ 
+     /*
+     * Pop the xsl:template declaration from the stack.
+@@ -5319,7 +5318,7 @@ xsltIf(xsltTransformContextPtr ctxt, xmlNodePtr 
contextNode,
+ 
+ #ifdef XSLT_FAST_IF
+     {
+-      xmlDocPtr oldLocalFragmentTop = ctxt->localRVT;
++      xsltRVTListPtr oldLocalFragmentTop = ctxt->localRVTList;
+ 
+       res = xsltPreCompEvalToBoolean(ctxt, contextNode, comp);
+ 
+@@ -5327,7 +5326,7 @@ xsltIf(xsltTransformContextPtr ctxt, xmlNodePtr 
contextNode,
+       * Cleanup fragments created during evaluation of the
+       * "select" expression.
+       */
+-      if (oldLocalFragmentTop != ctxt->localRVT)
++      if (oldLocalFragmentTop != ctxt->localRVTList)
+           xsltReleaseLocalRVTs(ctxt, oldLocalFragmentTop);
+     }
+ 
+diff --git a/libxslt/variables.c b/libxslt/variables.c
+index eb98aab2..6696d9a1 100644
+--- a/libxslt/variables.c
++++ b/libxslt/variables.c
+@@ -47,6 +47,21 @@ static const xmlChar *xsltComputingGlobalVarMarker =
+ #define XSLT_VAR_IN_SELECT (1<<1)
+ #define XSLT_TCTXT_VARIABLE(c) ((xsltStackElemPtr) (c)->contextVariable)
+ 
++static xsltRVTListPtr
++xsltRVTListCreate(void)
++{
++    xsltRVTListPtr ret;
++
++    ret = (xsltRVTListPtr) xmlMalloc(sizeof(xsltRVTList));
++    if (ret == NULL) {
++      xsltTransformError(NULL, NULL, NULL,
++          "xsltRVTListCreate: malloc failed
");
++      return(NULL);
++    }
++    memset(ret, 0, sizeof(xsltRVTList));
++    return(ret);
++}
++
+ /************************************************************************
+  *                                                                    *
+  *  Result Value Tree (Result Tree Fragment) interfaces                       
*
+@@ -64,6 +79,7 @@ static const xmlChar *xsltComputingGlobalVarMarker =
+ xmlDocPtr
+ xsltCreateRVT(xsltTransformContextPtr ctxt)
+ {
++    xsltRVTListPtr rvtList;
+     xmlDocPtr container;
+ 
+     /*
+@@ -76,12 +92,11 @@ xsltCreateRVT(xsltTransformContextPtr ctxt)
+     /*
+     * Reuse a RTF from the cache if available.
+     */
+-    if (ctxt->cache->RVT) {
+-      container = ctxt->cache->RVT;
+-      ctxt->cache->RVT = (xmlDocPtr) container->next;
+-      /* clear the internal pointers */
+-      container->next = NULL;
+-      container->prev = NULL;
++    if (ctxt->cache->rvtList) {
++        rvtList = ctxt->cache->rvtList;
++      container = ctxt->cache->rvtList->RVT;
++      ctxt->cache->rvtList = rvtList->next;
++        xmlFree(rvtList);
+       if (ctxt->cache->nbRVT > 0)
+           ctxt->cache->nbRVT--;
+ #ifdef XSLT_DEBUG_PROFILE_CACHE
+@@ -119,11 +134,16 @@ xsltCreateRVT(xsltTransformContextPtr ctxt)
+ int
+ xsltRegisterTmpRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+ {
++    xsltRVTListPtr list;
++
+     if ((ctxt == NULL) || (RVT == NULL))
+       return(-1);
+ 
+-    RVT->prev = NULL;
++    list = xsltRVTListCreate();
++    if (list == NULL) return(-1);
++
+     RVT->compression = XSLT_RVT_LOCAL;
++    list->RVT = RVT;
+ 
+     /*
+     * We'll restrict the lifetime of user-created fragments
+@@ -131,15 +151,13 @@ xsltRegisterTmpRVT(xsltTransformContextPtr ctxt, 
xmlDocPtr RVT)
+     * var/param itself.
+     */
+     if (ctxt->contextVariable != NULL) {
+-      RVT->next = (xmlNodePtr) XSLT_TCTXT_VARIABLE(ctxt)->fragment;
+-      XSLT_TCTXT_VARIABLE(ctxt)->fragment = RVT;
++      list->next = XSLT_TCTXT_VARIABLE(ctxt)->fragment;
++      XSLT_TCTXT_VARIABLE(ctxt)->fragment = list;
+       return(0);
+     }
+ 
+-    RVT->next = (xmlNodePtr) ctxt->tmpRVT;
+-    if (ctxt->tmpRVT != NULL)
+-      ctxt->tmpRVT->prev = (xmlNodePtr) RVT;
+-    ctxt->tmpRVT = RVT;
++    list->next = ctxt->tmpRVTList;
++    ctxt->tmpRVTList = list;
+     return(0);
+ }
+ 
+@@ -159,11 +177,16 @@ int
+ xsltRegisterLocalRVT(xsltTransformContextPtr ctxt,
+                    xmlDocPtr RVT)
+ {
++    xsltRVTListPtr list;
++
+     if ((ctxt == NULL) || (RVT == NULL))
+       return(-1);
+ 
+-    RVT->prev = NULL;
++    list = xsltRVTListCreate();
++    if (list == NULL) return(-1);
++
+     RVT->compression = XSLT_RVT_LOCAL;
++    list->RVT = RVT;
+ 
+     /*
+     * When evaluating "select" expressions of xsl:variable
+@@ -174,8 +197,8 @@ xsltRegisterLocalRVT(xsltTransformContextPtr ctxt,
+     if ((ctxt->contextVariable != NULL) &&
+       (XSLT_TCTXT_VARIABLE(ctxt)->flags & XSLT_VAR_IN_SELECT))
+     {
+-      RVT->next = (xmlNodePtr) XSLT_TCTXT_VARIABLE(ctxt)->fragment;
+-      XSLT_TCTXT_VARIABLE(ctxt)->fragment = RVT;
++      list->next = XSLT_TCTXT_VARIABLE(ctxt)->fragment;
++      XSLT_TCTXT_VARIABLE(ctxt)->fragment = list;
+       return(0);
+     }
+     /*
+@@ -183,10 +206,8 @@ xsltRegisterLocalRVT(xsltTransformContextPtr ctxt,
+     * If not reference by a returning instruction (like EXSLT's function),
+     * then this fragment will be freed, when the instruction exits.
+     */
+-    RVT->next = (xmlNodePtr) ctxt->localRVT;
+-    if (ctxt->localRVT != NULL)
+-      ctxt->localRVT->prev = (xmlNodePtr) RVT;
+-    ctxt->localRVT = RVT;
++    list->next = ctxt->localRVTList;
++    ctxt->localRVTList = list;
+     return(0);
+ }
+ 
+@@ -344,8 +365,9 @@ xsltFlagRVTs(xsltTransformContextPtr ctxt, 
xmlXPathObjectPtr obj, int val) {
+  * @ctxt:  an XSLT transformation context
+  * @RVT:  a result value tree (Result Tree Fragment)
+  *
+- * Either frees the RVT (which is an xmlDoc) or stores
+- * it in the context's cache for later reuse.
++ * Either frees the RVT (which is an xmlDoc) or stores it in the context's
++ * cache for later reuse. Preserved for ABI/API compatibility; internal use
++ * has all migrated to xsltReleaseRVTList().
+  */
+ void
+ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+@@ -353,36 +375,64 @@ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr 
RVT)
+     if (RVT == NULL)
+       return;
+ 
++    xsltRVTListPtr list = xsltRVTListCreate();
++    if (list == NULL) {
++        if (RVT->_private != NULL) {
++            xsltFreeDocumentKeys((xsltDocumentPtr) RVT->_private);
++            xmlFree(RVT->_private);
++        }
++        xmlFreeDoc(RVT);
++        return;
++    }
++
++    xsltReleaseRVTList(ctxt, list);
++}
++
++/**
++ * xsltReleaseRVTList:
++ * @ctxt:  an XSLT transformation context
++ * @list:  a list node containing a result value tree (Result Tree Fragment)
++ *
++ * Either frees the list node or stores it in the context's cache for later
++ * reuse. Optimization to avoid adding a fallible allocation path when the
++ * caller already has a RVT list node.
++ */
++void
++xsltReleaseRVTList(xsltTransformContextPtr ctxt, xsltRVTListPtr list)
++{
++    if (list == NULL)
++      return;
++
+     if (ctxt && (ctxt->cache->nbRVT < 40)) {
+       /*
+       * Store the Result Tree Fragment.
+       * Free the document info.
+       */
+-      if (RVT->_private != NULL) {
+-          xsltFreeDocumentKeys((xsltDocumentPtr) RVT->_private);
+-          xmlFree(RVT->_private);
+-          RVT->_private = NULL;
++      if (list->RVT->_private != NULL) {
++          xsltFreeDocumentKeys((xsltDocumentPtr) list->RVT->_private);
++          xmlFree(list->RVT->_private);
++          list->RVT->_private = NULL;
+       }
+       /*
+       * Clear the document tree.
+       */
+-      if (RVT->children != NULL) {
+-          xmlFreeNodeList(RVT->children);
+-          RVT->children = NULL;
+-          RVT->last = NULL;
++      if (list->RVT->children != NULL) {
++          xmlFreeNodeList(list->RVT->children);
++          list->RVT->children = NULL;
++          list->RVT->last = NULL;
+       }
+-      if (RVT->ids != NULL) {
+-          xmlFreeIDTable((xmlIDTablePtr) RVT->ids);
+-          RVT->ids = NULL;
++      if (list->RVT->ids != NULL) {
++          xmlFreeIDTable((xmlIDTablePtr) list->RVT->ids);
++          list->RVT->ids = NULL;
+       }
+ 
+       /*
+       * Reset the ownership information.
+       */
+-      RVT->compression = 0;
++      list->RVT->compression = 0;
+ 
+-      RVT->next = (xmlNodePtr) ctxt->cache->RVT;
+-      ctxt->cache->RVT = RVT;
++      list->next = ctxt->cache->rvtList;
++      ctxt->cache->rvtList = list;
+ 
+       ctxt->cache->nbRVT++;
+ 
+@@ -394,11 +444,12 @@ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr 
RVT)
+     /*
+     * Free it.
+     */
+-    if (RVT->_private != NULL) {
+-      xsltFreeDocumentKeys((xsltDocumentPtr) RVT->_private);
+-      xmlFree(RVT->_private);
++    if (list->RVT->_private != NULL) {
++      xsltFreeDocumentKeys((xsltDocumentPtr) list->RVT->_private);
++      xmlFree(list->RVT->_private);
+     }
+-    xmlFreeDoc(RVT);
++    xmlFreeDoc(list->RVT);
++    xmlFree(list);
+ }
+ 
+ /**
+@@ -416,14 +467,17 @@ xsltReleaseRVT(xsltTransformContextPtr ctxt, xmlDocPtr 
RVT)
+ int
+ xsltRegisterPersistRVT(xsltTransformContextPtr ctxt, xmlDocPtr RVT)
+ {
++    xsltRVTListPtr list;
++
+     if ((ctxt == NULL) || (RVT == NULL)) return(-1);
+ 
++    list = xsltRVTListCreate();
++    if (list == NULL) return(-1);
++
+     RVT->compression = XSLT_RVT_GLOBAL;
+-    RVT->prev = NULL;
+-    RVT->next = (xmlNodePtr) ctxt->persistRVT;
+-    if (ctxt->persistRVT != NULL)
+-      ctxt->persistRVT->prev = (xmlNodePtr) RVT;
+-    ctxt->persistRVT = RVT;
++    list->RVT = RVT;
++    list->next = ctxt->persistRVTList;
++    ctxt->persistRVTList = list;
+     return(0);
+ }
+ 
+@@ -438,52 +492,55 @@ xsltRegisterPersistRVT(xsltTransformContextPtr ctxt, 
xmlDocPtr RVT)
+ void
+ xsltFreeRVTs(xsltTransformContextPtr ctxt)
+ {
+-    xmlDocPtr cur, next;
++    xsltRVTListPtr cur, next;
+ 
+     if (ctxt == NULL)
+       return;
+     /*
+     * Local fragments.
+     */
+-    cur = ctxt->localRVT;
++    cur = ctxt->localRVTList;
+     while (cur != NULL) {
+-        next = (xmlDocPtr) cur->next;
+-      if (cur->_private != NULL) {
+-          xsltFreeDocumentKeys(cur->_private);
+-          xmlFree(cur->_private);
++        next = cur->next;
++      if (cur->RVT->_private != NULL) {
++          xsltFreeDocumentKeys(cur->RVT->_private);
++          xmlFree(cur->RVT->_private);
+       }
+-      xmlFreeDoc(cur);
++      xmlFreeDoc(cur->RVT);
++        xmlFree(cur);
+       cur = next;
+     }
+-    ctxt->localRVT = NULL;
++    ctxt->localRVTList = NULL;
+     /*
+     * User-created per-template fragments.
+     */
+-    cur = ctxt->tmpRVT;
++    cur = ctxt->tmpRVTList;
+     while (cur != NULL) {
+-        next = (xmlDocPtr) cur->next;
+-      if (cur->_private != NULL) {
+-          xsltFreeDocumentKeys(cur->_private);
+-          xmlFree(cur->_private);
++        next = cur->next;
++      if (cur->RVT->_private != NULL) {
++          xsltFreeDocumentKeys(cur->RVT->_private);
++          xmlFree(cur->RVT->_private);
+       }
+-      xmlFreeDoc(cur);
++      xmlFreeDoc(cur->RVT);
++        xmlFree(cur);
+       cur = next;
+     }
+-    ctxt->tmpRVT = NULL;
++    ctxt->tmpRVTList = NULL;
+     /*
+     * Global fragments.
+     */
+-    cur = ctxt->persistRVT;
++    cur = ctxt->persistRVTList;
+     while (cur != NULL) {
+-        next = (xmlDocPtr) cur->next;
+-      if (cur->_private != NULL) {
+-          xsltFreeDocumentKeys(cur->_private);
+-          xmlFree(cur->_private);
++        next = cur->next;
++      if (cur->RVT->_private != NULL) {
++          xsltFreeDocumentKeys(cur->RVT->_private);
++          xmlFree(cur->RVT->_private);
+       }
+-      xmlFreeDoc(cur);
++      xmlFreeDoc(cur->RVT);
++        xmlFree(cur);
+       cur = next;
+     }
+-    ctxt->persistRVT = NULL;
++    ctxt->persistRVTList = NULL;
+ }
+ 
+ /************************************************************************
+@@ -571,21 +628,22 @@ xsltFreeStackElem(xsltStackElemPtr elem) {
+     * Release the list of temporary Result Tree Fragments.
+     */
+     if (elem->context) {
+-      xmlDocPtr cur;
++      xsltRVTListPtr cur;
+ 
+       while (elem->fragment != NULL) {
+           cur = elem->fragment;
+-          elem->fragment = (xmlDocPtr) cur->next;
+-
+-            if (cur->compression == XSLT_RVT_LOCAL) {
+-              xsltReleaseRVT(elem->context, cur);
+-            } else if (cur->compression == XSLT_RVT_FUNC_RESULT) {
+-                xsltRegisterLocalRVT(elem->context, cur);
+-                cur->compression = XSLT_RVT_FUNC_RESULT;
++          elem->fragment = cur->next;
++
++            if (cur->RVT->compression == XSLT_RVT_LOCAL) {
++              xsltReleaseRVTList(elem->context, cur);
++            } else if (cur->RVT->compression == XSLT_RVT_FUNC_RESULT) {
++                xsltRegisterLocalRVT(elem->context, cur->RVT);
++                cur->RVT->compression = XSLT_RVT_FUNC_RESULT;
++                xmlFree(cur);
+             } else {
+                 xmlGenericError(xmlGenericErrorContext,
+                         "xsltFreeStackElem: Unexpected RVT flag %d
",
+-                        cur->compression);
++                        cur->RVT->compression);
+             }
+       }
+     }
+@@ -944,6 +1002,7 @@ xsltEvalVariable(xsltTransformContextPtr ctxt, 
xsltStackElemPtr variable,
+       } else {
+           if (variable->tree) {
+               xmlDocPtr container;
++                xsltRVTListPtr rvtList;
+               xmlNodePtr oldInsert;
+               xmlDocPtr  oldOutput;
+                 const xmlChar *oldLastText;
+@@ -968,7 +1027,11 @@ xsltEvalVariable(xsltTransformContextPtr ctxt, 
xsltStackElemPtr variable,
+               * when the variable is freed, it will also free
+               * the Result Tree Fragment.
+               */
+-              variable->fragment = container;
++                rvtList = xsltRVTListCreate();
++                if (rvtList == NULL)
++                    goto error;
++                rvtList->RVT = container;
++              variable->fragment = rvtList;
+                 container->compression = XSLT_RVT_LOCAL;
+ 
+               oldOutput = ctxt->output;
+@@ -2361,5 +2424,3 @@ local_variable_found:
+ 
+     return(valueObj);
+ }
+-
+-
+diff --git a/libxslt/xsltInternals.h b/libxslt/xsltInternals.h
+index 6faa07db..ec84e1df 100644
+--- a/libxslt/xsltInternals.h
++++ b/libxslt/xsltInternals.h
+@@ -1410,6 +1410,8 @@ struct _xsltStylePreComp {
+ 
+ #endif /* XSLT_REFACTORED */
+ 
++typedef struct _xsltRVTList xsltRVTList;
++typedef xsltRVTList *xsltRVTListPtr;
+ 
+ /*
+  * The in-memory structure corresponding to an XSLT Variable
+@@ -1427,7 +1429,7 @@ struct _xsltStackElem {
+     xmlNodePtr tree;          /* the sequence constructor if no eval
+                                   string or the location */
+     xmlXPathObjectPtr value;  /* The value if computed */
+-    xmlDocPtr fragment;               /* The Result Tree Fragments (needed 
for XSLT 1.0)
++    xsltRVTListPtr fragment;  /* The Result Tree Fragments (needed for XSLT 
1.0)
+                                  which are bound to the variable's lifetime. 
*/
+     int level;                  /* the depth in the tree;
+                                    -1 if persistent (e.g. a given 
xsl:with-param) */
+@@ -1639,10 +1641,15 @@ struct _xsltStylesheet {
+     unsigned long opCount;
+ };
+ 
++struct _xsltRVTList {
++  xmlDocPtr RVT;
++  xsltRVTListPtr next;
++};
++
+ typedef struct _xsltTransformCache xsltTransformCache;
+ typedef xsltTransformCache *xsltTransformCachePtr;
+ struct _xsltTransformCache {
+-    xmlDocPtr RVT;
++    xsltRVTListPtr rvtList;
+     int nbRVT;
+     xsltStackElemPtr stackItems;
+     int nbStackItems;
+@@ -1749,8 +1756,8 @@ struct _xsltTransformContext {
+      * handling of temporary Result Value Tree
+      * (XSLT 1.0 term: "Result Tree Fragment")
+      */
+-    xmlDocPtr       tmpRVT;           /* list of RVT without persistance */
+-    xmlDocPtr       persistRVT;               /* list of persistant RVTs */
++    xsltRVTListPtr  tmpRVTList;               /* list of RVT without 
persistance */
++    xsltRVTListPtr  persistRVTList;     /* list of persistant RVTs */
+     int             ctxtflags;          /* context processing flags */
+ 
+     /*
+@@ -1783,7 +1790,7 @@ struct _xsltTransformContext {
+     xmlDocPtr initialContextDoc;
+     xsltTransformCachePtr cache;
+     void *contextVariable; /* the current variable item */
+-    xmlDocPtr localRVT; /* list of local tree fragments; will be freed when
++    xsltRVTListPtr localRVTList; /* list of local tree fragments; will be 
freed when
+                          the instruction which created the fragment
+                            exits */
+     xmlDocPtr localRVTBase; /* Obsolete */
+@@ -1932,8 +1939,11 @@ XSLTPUBFUN int XSLTCALL
+ XSLTPUBFUN void XSLTCALL
+                       xsltFreeRVTs            (xsltTransformContextPtr ctxt);
+ XSLTPUBFUN void XSLTCALL
+-                      xsltReleaseRVT          (xsltTransformContextPtr ctxt,
++                      xsltReleaseRVT          (xsltTransformContextPtr ctxt,
+                                                xmlDocPtr RVT);
++XSLTPUBFUN void XSLTCALL
++                      xsltReleaseRVTList      (xsltTransformContextPtr ctxt,
++                                               xsltRVTListPtr list);
+ /*
+  * Extra functions for Attribute Value Templates
+  */
+@@ -1992,4 +2002,3 @@ XSLTPUBFUN int XSLTCALL
+ #endif
+ 
+ #endif /* __XML_XSLT_H__ */
+-
+-- 
+GitLab
+
diff --git a/external/libxslt/UnpackedTarball_libxslt.mk 
b/external/libxslt/UnpackedTarball_libxslt.mk
index 06519e74ae4b..bd2417841e07 100644
--- a/external/libxslt/UnpackedTarball_libxslt.mk
+++ b/external/libxslt/UnpackedTarball_libxslt.mk
@@ -21,6 +21,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxslt,\
                external/libxslt/libxslt-msvc.patch.2) \
        external/libxslt/rpath.patch.0 \
        external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 \
+       external/libxslt/77.patch.1 \
 ))
 
 # vim: set noet sw=4 ts=4:
commit aebef2b56cbc87f90c9b8e2e0af49da8dba9d62b
Author:     Michael Stahl <[email protected]>
AuthorDate: Thu Aug 7 16:50:26 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:44 2026 +0100

    libxslt: add patch for CVE-2025-7424
    
    See https://gitlab.gnome.org/GNOME/libxslt/-/issues/139
    
    Change-Id: I68f01dcb6b540ddf3d2e74927ec21c0ca4fc865f
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/189105
    Reviewed-by: Caolán McNamara <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    (cherry picked from commit 0f59405c5b255e80707a550129045c3dadd3c46f)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192504
    Reviewed-by: Stephan Bergmann <[email protected]>
    (cherry picked from commit bb73b14b38db1b485f293cfec65d278690ea4986)

diff --git a/external/libxslt/UnpackedTarball_libxslt.mk 
b/external/libxslt/UnpackedTarball_libxslt.mk
index edfb266f2f17..06519e74ae4b 100644
--- a/external/libxslt/UnpackedTarball_libxslt.mk
+++ b/external/libxslt/UnpackedTarball_libxslt.mk
@@ -20,6 +20,7 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxslt,\
                external/libxslt/libxslt-msvc-sym.patch.2, \
                external/libxslt/libxslt-msvc.patch.2) \
        external/libxslt/rpath.patch.0 \
+       external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 \
 ))
 
 # vim: set noet sw=4 ts=4:
diff --git a/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1 
b/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1
new file mode 100644
index 000000000000..62a34fa61d39
--- /dev/null
+++ b/external/libxslt/gnome-libxslt-bug-139-apple-fix.diff.1
@@ -0,0 +1,99 @@
+From 345d6826d0eae6f0a962456b8ed6f6a1bad0877d Mon Sep 17 00:00:00 2001
+From: David Kilzer <[email protected]>
+Date: Sat, 24 May 2025 15:06:42 -0700
+Subject: [PATCH] libxslt: Type confusion in xmlNode.psvi between stylesheet
+ and source nodes
+
+* libxslt/functions.c:
+(xsltDocumentFunctionLoadDocument):
+- Implement fix suggested by Ivan Fratric.  This copies the xmlDoc,
+  calls xsltCleanupSourceDoc() to remove pvsi fields, then adds the
+  xmlDoc to tctxt->docList.
+- Add error handling for functions that may return NULL.
+* libxslt/transform.c:
+- Remove static keyword so this can be called from
+  xsltDocumentFunctionLoadDocument().
+* libxslt/transformInternals.h: Add.
+(xsltCleanupSourceDoc): Add declaration.
+
+Fixes #139.
+---
+ libxslt/functions.c          | 16 +++++++++++++++-
+ libxslt/transform.c          |  3 ++-
+ libxslt/transformInternals.h |  9 +++++++++
+ 3 files changed, 26 insertions(+), 2 deletions(-)
+ create mode 100644 libxslt/transformInternals.h
+
+diff --git a/libxslt/functions.c b/libxslt/functions.c
+index 72a58dc4..11ec039f 100644
+--- a/libxslt/functions.c
++++ b/libxslt/functions.c
+@@ -34,6 +34,7 @@
+ #include "numbersInternals.h"
+ #include "keys.h"
+ #include "documents.h"
++#include "transformInternals.h"
+ 
+ #ifdef WITH_XSLT_DEBUG
+ #define WITH_XSLT_DEBUG_FUNCTION
+@@ -125,7 +126,20 @@ xsltDocumentFunctionLoadDocument(xmlXPathParserContextPtr 
ctxt,
+           /*
+           * This selects the stylesheet's doc itself.
+           */
+-          doc = tctxt->style->doc;
++          doc = xmlCopyDoc(tctxt->style->doc, 1);
++          if (doc == NULL) {
++              xsltTransformError(tctxt, NULL, NULL,
++                  "document() : failed to copy style doc
");
++              goto out_fragment;
++          }
++          xsltCleanupSourceDoc(doc); /* Remove psvi fields. */
++          idoc = xsltNewDocument(tctxt, doc);
++          if (idoc == NULL) {
++              xsltTransformError(tctxt, NULL, NULL,
++                  "document() : failed to create xsltDocument
");
++              xmlFreeDoc(doc);
++              goto out_fragment;
++          }
+       } else {
+             goto out_fragment;
+       }
+diff --git a/libxslt/transform.c b/libxslt/transform.c
+index 54ef821b..38c2dce6 100644
+--- a/libxslt/transform.c
++++ b/libxslt/transform.c
+@@ -43,6 +43,7 @@
+ #include "xsltlocale.h"
+ #include "pattern.h"
+ #include "transform.h"
++#include "transformInternals.h"
+ #include "variables.h"
+ #include "numbersInternals.h"
+ #include "namespaces.h"
+@@ -5757,7 +5758,7 @@ xsltCountKeys(xsltTransformContextPtr ctxt)
+  *
+  * Resets source node flags and ids stored in 'psvi' member.
+  */
+-static void
++void
+ xsltCleanupSourceDoc(xmlDocPtr doc) {
+     xmlNodePtr cur = (xmlNodePtr) doc;
+     void **psviPtr;
+diff --git a/libxslt/transformInternals.h b/libxslt/transformInternals.h
+new file mode 100644
+index 00000000..d0f42823
+--- /dev/null
++++ b/libxslt/transformInternals.h
+@@ -0,0 +1,9 @@
++/*
++ * Summary: set of internal interfaces for the XSLT engine transformation 
part.
++ *
++ * Copy: See Copyright for the status of this software.
++ *
++ * Author: David Kilzer <[email protected]>
++ */
++
++void xsltCleanupSourceDoc(xmlDocPtr doc);
+-- 
+2.39.5 (Apple Git-154)
+
commit fcfdf79f4eab2795043e08facbfa6ae03e844571
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Apr 23 10:18:37 2025 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:44 2026 +0100

    libxml2: upgrade to 2.13.8
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.8.tar.xz
    
    Change-Id: I24dc935a4a878ec3f5de996cecd3615cbed92321
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/184462
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit ace0eff7d9b091eeb22258a49c1ddbd77b1e9f62)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/184475
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit de01ebb8caa4d3381cc32b9000900d12cd74a09e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192531
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 4cbb4bea62a0dc61b6d36e06fff5ed56c880ad9a)

diff --git a/download.lst b/download.lst
index 4f61b22bb84b..56e2877553ad 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
14796d24402108e99d8de4e974d539bed62e23af8c4233317274ce073ceff93b
-LIBXML_VERSION_MICRO := 7
+LIBXML_SHA256SUM := 
277294cb33119ab71b2bc81f2f445e9bc9435b893ad15bb2cd2b0e859a0ee84a
+LIBXML_VERSION_MICRO := 8
 LIBXML_TARBALL := libxml2-2.13.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 11fae913d7003c30ff1d8fa951ecdf654ba33801
Author:     Xisco Fauli <[email protected]>
AuthorDate: Thu Mar 27 16:32:52 2025 +0100
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:44 2026 +0100

    libxml2: upgrade to 2.13.7
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.7.tar.xz
    
    Change-Id: Ic65581fd80ebc73d052f934afcf61954fc6e6527
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/183408
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 63098d0bd802fb0cdbfcd0c9505fe2c4019bf5ad)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192530
    Reviewed-by: Michael Stahl <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    (cherry picked from commit 73fb28212e9918ba37fbc243c90d669e4be61930)

diff --git a/download.lst b/download.lst
index f9460ecb4851..4f61b22bb84b 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96
-LIBXML_VERSION_MICRO := 6
+LIBXML_SHA256SUM := 
14796d24402108e99d8de4e974d539bed62e23af8c4233317274ce073ceff93b
+LIBXML_VERSION_MICRO := 7
 LIBXML_TARBALL := libxml2-2.13.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit fb6b14f5c23667847211e8ceee1193ad969319c5
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Feb 19 09:38:27 2025 +0100
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:44 2026 +0100

    libxml2: upgrade to 2.13.6
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.6.tar.xz
    
    Change-Id: Ia52a7fd49d9db7a339e5defacce866e4aad34efc
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/181867
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 09721edb1c48c996b965b2e533f271d9df401414)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/181874
    Reviewed-by: Michael Weghorn <[email protected]>
    (cherry picked from commit a023afdad6888b39c6efaaaebfc3c70f736b7a0b)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192529
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 134626f09af28f58f483844ea4a5ca92341651f2)

diff --git a/download.lst b/download.lst
index b6c2769389c8..f9460ecb4851 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
74fc163217a3964257d3be39af943e08861263c4231f9ef5b496b6f6d4c7b2b6
-LIBXML_VERSION_MICRO := 5
+LIBXML_SHA256SUM := 
f453480307524968f7a04ec65e64f2a83a825973bcd260a2e7691be82ae70c96
+LIBXML_VERSION_MICRO := 6
 LIBXML_TARBALL := libxml2-2.13.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit e4b1f45c2fa99b9c043c2fd6aecf39095cee030d
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Nov 13 09:49:58 2024 +0100
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:44 2026 +0100

    libxml2: upgrade to 2.13.5
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.5.tar.xz
    
    Change-Id: I8b88b49fdda737c74bc0c2b3b18b14ada3389f20
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/176519
    Reviewed-by: Xisco Fauli <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit d7c396771303c772bb8ed8c01b3b76d74946f179)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192528
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 4f648041fcfee783336fecdd6a7e16f781dbbf0e)

diff --git a/download.lst b/download.lst
index 6d9fe4100678..b6c2769389c8 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
65d042e1c8010243e617efb02afda20b85c2160acdbfbcb5b26b80cec6515650
-LIBXML_VERSION_MICRO := 4
+LIBXML_SHA256SUM := 
74fc163217a3964257d3be39af943e08861263c4231f9ef5b496b6f6d4c7b2b6
+LIBXML_VERSION_MICRO := 5
 LIBXML_TARBALL := libxml2-2.13.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 8f36b57519c3e326586efd67e3b3eff56e2dd078
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Sep 18 15:54:25 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:44 2026 +0100

    libxml2: upgrade to 2.13.4
    
    * 0001-ofz-70675-XML_ERR_FATAL-not-ending-parse.patch.0
    is no longer needed. fixed upstream
    
    Downloaded from 
https://download-fallback.gnome.org/sources/libxml2/2.13/libxml2-2.13.4.tar.xz
    
    Change-Id: I7d39940ad5b197b302c57110e147aef7d2b911d6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/173621
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit d500848976b6244048684a9972322b582559910a)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192527
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit d14a50fb8556bf33acf6b0bb85a321e9279afd53)

diff --git a/download.lst b/download.lst
index 62035447ddc5..6d9fe4100678 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
0805d7c180cf09caad71666c7a458a74f041561a532902454da5047d83948138
-LIBXML_VERSION_MICRO := 3
+LIBXML_SHA256SUM := 
65d042e1c8010243e617efb02afda20b85c2160acdbfbcb5b26b80cec6515650
+LIBXML_VERSION_MICRO := 4
 LIBXML_TARBALL := libxml2-2.13.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 66d20c1864b80dd285dbccb6311836bc0c72857c
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Jul 24 17:37:25 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:43 2026 +0100

    libxml2: upgrade to 2.13.3
    
    it fixes CVE-2024-40896
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.13/libxml2-2.13.3.tar.xz
    
    Change-Id: Icba636106cc9d1f096f5479bd80d5e30712c2e6a
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/170975
    Reviewed-by: Xisco Fauli <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit 6ddd8287d27736032c02084f124dab95c4715dda)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192526
    Reviewed-by: Michael Stahl <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    (cherry picked from commit 88559570d1eaf3c33e210c982574b4449f788a32)

diff --git a/download.lst b/download.lst
index 9259f66536a5..62035447ddc5 100644
--- a/download.lst
+++ b/download.lst
@@ -408,9 +408,9 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590
-LIBXML_VERSION_MICRO := 9
-LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
+LIBXML_SHA256SUM := 
0805d7c180cf09caad71666c7a458a74f041561a532902454da5047d83948138
+LIBXML_VERSION_MICRO := 3
+LIBXML_TARBALL := libxml2-2.13.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
diff --git a/external/libxml2/ExternalPackage_libxml2.mk 
b/external/libxml2/ExternalPackage_libxml2.mk
index 799044575f9a..17190c77fd18 100644
--- a/external/libxml2/ExternalPackage_libxml2.mk
+++ b/external/libxml2/ExternalPackage_libxml2.mk
@@ -21,7 +21,7 @@ else # COM=MSC
 $(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.dll,win32/bin.msvc/libxml2.dll))
 endif
 else # OS!=WNT
-$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.12.$(LIBXML_VERSION_MICRO)))
+$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.13.$(LIBXML_VERSION_MICRO)))
 endif
 endif # DISABLE_DYNLOADING
 
diff --git a/external/libxml2/libxml2-XMLCALL-redefine.patch.0 
b/external/libxml2/libxml2-XMLCALL-redefine.patch.0
index d9ca23be7ce4..57d23d885943 100644
--- a/external/libxml2/libxml2-XMLCALL-redefine.patch.0
+++ b/external/libxml2/libxml2-XMLCALL-redefine.patch.0
@@ -1,11 +1,11 @@
 --- include/libxml/xmlexports.h        2023-05-24 12:48:46.179570708 +0100
 +++ include/libxml/xmlexports.h        2023-05-24 12:48:56.563577488 +0100
-@@ -38,8 +38,6 @@
+@@ -31,8 +31,6 @@
+ #define XMLPUBVAR XMLPUBLIC extern
  
- /** DOC_DISABLE */
  /* Compatibility */
 -#define XMLCALL
 -#define XMLCDECL
- #if !defined(LIBXML_DLL_IMPORT)
- #define LIBXML_DLL_IMPORT XMLPUBVAR
+ #ifndef LIBXML_DLL_IMPORT
+   #define LIBXML_DLL_IMPORT XMLPUBVAR
  #endif
diff --git a/external/libxml2/libxml2-icu-sym.patch.0 
b/external/libxml2/libxml2-icu-sym.patch.0
index 07676228da19..d89a1c4c544b 100644
--- a/external/libxml2/libxml2-icu-sym.patch.0
+++ b/external/libxml2/libxml2-icu-sym.patch.0
@@ -3,14 +3,14 @@ Find bundled ICU in workdir and use debug .libs when needed
 diff -up win32/Makefile.msvc.dt win32/Makefile.msvc
 --- win32/Makefile.msvc.dt     2014-07-18 19:00:23.372103963 +0200
 +++ win32/Makefile.msvc        2014-07-18 19:01:39.347982929 +0200
-@@ -46,6 +46,7 @@ CPPFLAGS = $(CPPFLAGS) /D "_REENTRANT"
+@@ -42,6 +42,7 @@
  CC = cl.exe
  CFLAGS = /nologo /D "_WINDOWS" /D "_MBCS" /D "NOLIBTOOL" /W3 /wd4244 /wd4267 
$(CRUNTIME)
  CFLAGS = $(CFLAGS) /I$(XML_SRCDIR) /I$(XML_SRCDIR)\include /I$(INCPREFIX)
 +CFLAGS = $(CFLAGS) /I$(WORKDIR)/UnpackedTarball/icu/source/i18n 
/I$(WORKDIR)/UnpackedTarball/icu/source/common
- !if "$(WITH_THREADS)" != "no"
- CFLAGS = $(CFLAGS) /D "_REENTRANT"
- !endif
+ !if "$(WITH_THREADS)" == "ctls"
+ CFLAGS = $(CFLAGS) /D "XML_THREAD_LOCAL=__declspec(thread)"
+ !else if "$(WITH_THREADS)" == "posix"
 @@ -62,7 +63,9 @@
  # The linker and its options.
  LD = link.exe
diff --git a/external/libxml2/libxml2-icu.patch.0 
b/external/libxml2/libxml2-icu.patch.0
index 84197763f878..85ce8b3aba2b 100644
--- a/external/libxml2/libxml2-icu.patch.0
+++ b/external/libxml2/libxml2-icu.patch.0
@@ -3,14 +3,14 @@ Find bundled ICU in workdir and use debug .libs when needed
 diff -up win32/Makefile.msvc.dt win32/Makefile.msvc
 --- win32/Makefile.msvc.dt     2014-07-18 19:00:23.372103963 +0200
 +++ win32/Makefile.msvc        2014-07-18 19:01:39.347982929 +0200
-@@ -45,6 +45,7 @@ CPPFLAGS = $(CPPFLAGS) /D "_REENTRANT"
+@@ -42,6 +42,7 @@
  CC = cl.exe
  CFLAGS = /nologo /D "_WINDOWS" /D "_MBCS" /D "NOLIBTOOL" /W3 /wd4244 /wd4267 
$(CRUNTIME)
  CFLAGS = $(CFLAGS) /I$(XML_SRCDIR) /I$(XML_SRCDIR)\include /I$(INCPREFIX)
 +CFLAGS = $(CFLAGS) /I$(WORKDIR)/UnpackedTarball/icu/source/i18n 
/I$(WORKDIR)/UnpackedTarball/icu/source/common
- !if "$(WITH_THREADS)" != "no"
- CFLAGS = $(CFLAGS) /D "_REENTRANT"
- !endif
+ !if "$(WITH_THREADS)" == "ctls"
+ CFLAGS = $(CFLAGS) /D "XML_THREAD_LOCAL=__declspec(thread)"
+ !else if "$(WITH_THREADS)" == "posix"
 @@ -67,6 +68,7 @@ CFLAGS = $(CFLAGS) $(SOLARINC)
  # The linker and its options.
  LD = link.exe
commit b711496d26ce89064d422940b163cfb6d4ab0161
Author:     Xisco Fauli <[email protected]>
AuthorDate: Thu Mar 13 09:44:07 2025 +0100
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:43 2026 +0100

    libxslt: upgrade to 1.1.43
    
    Downloaded from 
https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.43.tar.xz
    
    Change-Id: Iadab2934e3b1e8178a4912ef9a56c4a3c158c7ba
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/182857
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 6668fa2266aad21469a383eaed872efb9b13ebde)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192503
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit a4dcc73fd3f72cfc384a975c7e56331bb77386a4)

diff --git a/download.lst b/download.lst
index 8a67c148603b..9259f66536a5 100644
--- a/download.lst
+++ b/download.lst
@@ -414,8 +414,8 @@ LIBXML_TARBALL := 
libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXSLT_SHA256SUM := 
85ca62cac0d41fc77d3f6033da9df6fd73d20ea2fc18b0a3609ffb4110e1baeb
-LIBXSLT_VERSION_MICRO := 42
+LIBXSLT_SHA256SUM := 
5a3d6b383ca5afc235b171118e90f5ff6aa27e9fea3303065231a6d403f0183a
+LIBXSLT_VERSION_MICRO := 43
 LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
diff --git a/external/libxslt/ExternalPackage_libxslt.mk 
b/external/libxslt/ExternalPackage_libxslt.mk
index b11ee72bfe1a..6d34589ea71a 100644
--- a/external/libxslt/ExternalPackage_libxslt.mk
+++ b/external/libxslt/ExternalPackage_libxslt.mk
@@ -25,7 +25,7 @@ $(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.dl
 endif
 else # OS!=WNT
 $(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libxslt.so.1,libxslt/.libs/libxslt.so.1.1.$(LIBXSLT_VERSION_MICRO)))
-$(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.23))
+$(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.24))
 endif
 endif # DISABLE_DYNLOADING
 
commit 795b990eb6374c2f9ac338f81fa05505cc3d9358
Author:     Xisco Fauli <[email protected]>
AuthorDate: Fri Jul 5 11:01:05 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:43 2026 +0100

    libxslt: upgrade to 1.1.42
    
    Downloaded from 
https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.42.tar.xz
    
    Change-Id: I77de8a0922c5271161640eae5c92b425c5be82c0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/170011
    Reviewed-by: Xisco Fauli <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit 355e553505a250f137b8bfc714b13084b83f0465)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192502
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 7d588c5fd139084f34bbbee543a7f45e384a8203)

diff --git a/download.lst b/download.lst
index fec849e7355e..8a67c148603b 100644
--- a/download.lst
+++ b/download.lst
@@ -414,8 +414,8 @@ LIBXML_TARBALL := 
libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXSLT_SHA256SUM := 
3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda
-LIBXSLT_VERSION_MICRO := 41
+LIBXSLT_SHA256SUM := 
85ca62cac0d41fc77d3f6033da9df6fd73d20ea2fc18b0a3609ffb4110e1baeb
+LIBXSLT_VERSION_MICRO := 42
 LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
diff --git a/external/libxslt/ExternalPackage_libxslt.mk 
b/external/libxslt/ExternalPackage_libxslt.mk
index 42b2004728e5..b11ee72bfe1a 100644
--- a/external/libxslt/ExternalPackage_libxslt.mk
+++ b/external/libxslt/ExternalPackage_libxslt.mk
@@ -25,7 +25,7 @@ $(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.dl
 endif
 else # OS!=WNT
 $(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libxslt.so.1,libxslt/.libs/libxslt.so.1.1.$(LIBXSLT_VERSION_MICRO)))
-$(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.22))
+$(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.23))
 endif
 endif # DISABLE_DYNLOADING
 
commit 361b9888856c7551327400394784d48e915f9d97
Author:     Stephan Bergmann <[email protected]>
AuthorDate: Thu Jun 20 15:46:51 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:43 2026 +0100

    Fix build
    
    ...after 4eb9cde4db28616e0b0c9cd6825830ab7d2f3c96 "libxslt: uprade to 
1.1.41",
    
    > external/libxslt/ExternalPackage_libxslt.mk:28: *** file 
workdir_for_build/UnpackedTarball/libxslt/libexslt/.libs/libexslt.so.0.8.21 
does not exist in the tarball.  Stop.
    
    at least during an Emscripten cross-build
    
    Change-Id: I7fcde7f8708fba68d5d9b751420e402c5da41f3d
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169280
    Reviewed-by: Stephan Bergmann <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit 9288a75f716972bb5d65031c624cb22ea4cb8ee8)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192501
    Reviewed-by: Michael Stahl <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    (cherry picked from commit c3465fcbf91d6361d4ecfdaf8352e1e25b4a438c)

diff --git a/external/libxslt/ExternalPackage_libxslt.mk 
b/external/libxslt/ExternalPackage_libxslt.mk
index c1a8ee1217f1..42b2004728e5 100644
--- a/external/libxslt/ExternalPackage_libxslt.mk
+++ b/external/libxslt/ExternalPackage_libxslt.mk
@@ -25,7 +25,7 @@ $(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.dl
 endif
 else # OS!=WNT
 $(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libxslt.so.1,libxslt/.libs/libxslt.so.1.1.$(LIBXSLT_VERSION_MICRO)))
-$(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.21))
+$(eval $(call 
gb_ExternalPackage_add_file,libxslt,$(LIBO_LIB_FOLDER)/libexslt.so.0,libexslt/.libs/libexslt.so.0.8.22))
 endif
 endif # DISABLE_DYNLOADING
 
commit 4d5e054ee37d3d3a8a23946ca0b4593654fa737b
Author:     Xisco Fauli <[email protected]>
AuthorDate: Thu Jun 20 12:22:55 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:43 2026 +0100

    libxslt: uprade to 1.1.41
    
    Downloaded from 
https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.41.tar.xz
    
    Change-Id: Ib06a013d85cc47a901fbe55a880f3ad6a5edcea8
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/169265
    Reviewed-by: Xisco Fauli <[email protected]>
    Tested-by: Jenkins
    (cherry picked from commit 4eb9cde4db28616e0b0c9cd6825830ab7d2f3c96)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192500
    Reviewed-by: Michael Stahl <[email protected]>
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    (cherry picked from commit d9e8a0c22d20ce733045fcf344e5b9c5c02a9dc7)

diff --git a/download.lst b/download.lst
index 4e0cd6428d69..fec849e7355e 100644
--- a/download.lst
+++ b/download.lst
@@ -414,8 +414,8 @@ LIBXML_TARBALL := 
libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXSLT_SHA256SUM := 
194715db023035f65fb566402f2ad2b5eab4c29d541f511305c40b29b1f48d13
-LIBXSLT_VERSION_MICRO := 40
+LIBXSLT_SHA256SUM := 
3ad392af91115b7740f7b50d228cc1c5fc13afc1da7f16cb0213917a37f71bda
+LIBXSLT_VERSION_MICRO := 41
 LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 8422b9c1bb5b5cf1ac1c74d730af4130d4831014
Author:     Xisco Fauli <[email protected]>
AuthorDate: Thu Jun 13 13:39:46 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:43 2026 +0100

    libxslt: upgrade to 1.1.40
    
    Downloaded from 
https://download.gnome.org/sources/libxslt/1.1/libxslt-1.1.40.tar.xz
    
    * libxslt-1.1.26-memdump.patch is no longer needed
    
    Change-Id: I72829ce590d7fd73a1364139bf3c373d6cd4d1b4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168782
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit cdde0d59ac67cd9a26671822b02d04b07b2dd754)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/192499
    Tested-by: Jenkins CollaboraOffice <[email protected]>
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 030a7e7db518dffbe331af258a3e99a9e46fb697)

diff --git a/download.lst b/download.lst
index 955bd0945419..4e0cd6428d69 100644
--- a/download.lst
+++ b/download.lst
@@ -414,8 +414,8 @@ LIBXML_TARBALL := 
libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXSLT_SHA256SUM := 
2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0
-LIBXSLT_VERSION_MICRO := 39
+LIBXSLT_SHA256SUM := 
194715db023035f65fb566402f2ad2b5eab4c29d541f511305c40b29b1f48d13
+LIBXSLT_VERSION_MICRO := 40
 LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
diff --git a/external/libxslt/UnpackedTarball_libxslt.mk 
b/external/libxslt/UnpackedTarball_libxslt.mk
index 7d39cb1e3478..edfb266f2f17 100644
--- a/external/libxslt/UnpackedTarball_libxslt.mk
+++ b/external/libxslt/UnpackedTarball_libxslt.mk
@@ -19,7 +19,6 @@ $(eval $(call gb_UnpackedTarball_add_patches,libxslt,\
        $(if $(gb_Module_CURRENTMODULE_SYMBOLS_ENABLED),\
                external/libxslt/libxslt-msvc-sym.patch.2, \
                external/libxslt/libxslt-msvc.patch.2) \
-       external/libxslt/libxslt-1.1.26-memdump.patch \
        external/libxslt/rpath.patch.0 \
 ))
 
diff --git a/external/libxslt/libxslt-1.1.26-memdump.patch 
b/external/libxslt/libxslt-1.1.26-memdump.patch
deleted file mode 100644
index 28724f749a38..000000000000
--- a/external/libxslt/libxslt-1.1.26-memdump.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- misc/libxslt-1.1.26/xsltproc/xsltproc.c    2009-08-23 14:53:33.000000000 
+0200
-+++ misc/build/libxslt-1.1.26/xsltproc/xsltproc.c      2013-01-18 
14:16:12.202767222 +0100
-@@ -877,7 +877,6 @@
-     xsltFreeSecurityPrefs(sec);
-     xsltCleanupGlobals();
-     xmlCleanupParser();
--    xmlMemoryDump();
-     return(errorno);
- }
- 
commit 8dc102de89b892929af3c77ea70629c36a89358f
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Jul 24 18:27:38 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:42 2026 +0100

    libxml2: upgrade to 2.12.9
    
    it fixes CVE-2024-40896
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.12/libxml2-2.12.9.tar.xz
    
    Change-Id: I73f2e480026b695f9fb7f684b11bc138046ab868
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/170949
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit a3482be66de6c0a3975f6cf98162b6ea67d98dd0)

diff --git a/download.lst b/download.lst
index 4a39829206c6..955bd0945419 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93
-LIBXML_VERSION_MICRO := 8
+LIBXML_SHA256SUM := 
59912db536ab56a3996489ea0299768c7bcffe57169f0235e7f962a91f483590
+LIBXML_VERSION_MICRO := 9
 LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 5c502610b5ca19614eb29b12a6aed560972c88fe
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Jun 12 14:31:26 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:42 2026 +0100

    libxml2: upgrade to 2.12.8
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.12/libxml2-2.12.8.tar.xz
    
    Change-Id: Ie6c0d102b44eaec14fabaf932ba140a113ff5073
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168718
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit a96d0ef1bd9727c0723e903b8337f43a7618f089)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/168721
    Reviewed-by: Christian Lohmaier <[email protected]>
    (cherry picked from commit 09d55f39db8b0d175b56466348ee90a4951a26e2)

diff --git a/download.lst b/download.lst
index cf4bf47de528..4a39829206c6 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
24ae78ff1363a973e6d8beba941a7945da2ac056e19b53956aeb6927fd6cfb56
-LIBXML_VERSION_MICRO := 7
+LIBXML_SHA256SUM := 
43ad877b018bc63deb2468d71f95219c2fac196876ef36d1bee51d226173ec93
+LIBXML_VERSION_MICRO := 8
 LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit aa6b7fe1fc99490a814d19ba2c65de8836d8ad2f
Author:     Xisco Fauli <[email protected]>
AuthorDate: Mon May 13 12:45:05 2024 +0200
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:42 2026 +0100

    libxml2: upgrade to 2.12.7
    
    * Fixes CVE-2024-34459
    
    Downloaded from 
https://download.gnome.org/sources/libxml2/2.12/libxml2-2.12.7.tar.xz
    
    Change-Id: Ie45ad54b3f781a54a278e2542fccafb8d06542bb
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167585
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 02dc762466c655e9ca6fb7cef92b1495915b34ed)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/167460
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit 6f33df3f243d6012730fccd644f3c386526a3363)

diff --git a/download.lst b/download.lst
index 3428ea447916..cf4bf47de528 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
889c593a881a3db5fdd96cc9318c87df34eb648edfc458272ad46fd607353fbb
-LIBXML_VERSION_MICRO := 6
+LIBXML_SHA256SUM := 
24ae78ff1363a973e6d8beba941a7945da2ac056e19b53956aeb6927fd6cfb56
+LIBXML_VERSION_MICRO := 7
 LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 97a7eac7f568c2e2478535adcaedfe4648d79730
Author:     Xisco Fauli <[email protected]>
AuthorDate: Wed Mar 20 10:26:11 2024 +0100
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:42 2026 +0100

    libxml2: upgrade to release 2.12.6
    
    Change-Id: I7372b276f74bc760c99580ffc509fde1031cb3a6
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165049
    Tested-by: Jenkins
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 832b98cedda2cd1631651f9397a871fb50d9cb1f)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/165183
    Reviewed-by: Taichi Haradaguchi <[email protected]>
    (cherry picked from commit 880076e806ead26ede716b48fd2502235dc41c08)

diff --git a/download.lst b/download.lst
index 3a4100679a16..3428ea447916 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21
-LIBXML_VERSION_MICRO := 5
+LIBXML_SHA256SUM := 
889c593a881a3db5fdd96cc9318c87df34eb648edfc458272ad46fd607353fbb
+LIBXML_VERSION_MICRO := 6
 LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit fedf6f434d55ef305fc0568ea45781552c406a9e
Author:     Michael Stahl <[email protected]>
AuthorDate: Thu Feb 22 11:57:37 2024 +0100
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:42 2026 +0100

    libxml2: upgrade to release 2.12.5
    
    Fixes CVE-2024-25062
    
    Change-Id: I0e98fd919328e9633a602c4872de0b06eb972cc0
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163734
    Tested-by: Jenkins
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit 4c3ee61e3eda0cbfd812443f80af89aa3a24ac73)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163753
    Reviewed-by: Xisco Fauli <[email protected]>
    (cherry picked from commit 5705650010689b301c2cec2655eda42ef32563c8)

diff --git a/download.lst b/download.lst
index 8bb154dbd413..3a4100679a16 100644
--- a/download.lst
+++ b/download.lst
@@ -408,8 +408,8 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
8c8f1092340a89ff32bc44ad5c9693aff9bc8a7a3e161bb239666e5d15ac9aaa
-LIBXML_VERSION_MICRO := 3
+LIBXML_SHA256SUM := 
a972796696afd38073e0f59c283c3a2f5a560b5268b4babc391b286166526b21
+LIBXML_VERSION_MICRO := 5
 LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
commit 0a0209abf12849af24cc8f622ea5f262b35be7e7
Author:     Caolán McNamara <[email protected]>
AuthorDate: Wed Jan 3 20:45:14 2024 +0000
Commit:     Michael Stahl <[email protected]>
CommitDate: Fri Jan 23 18:44:42 2026 +0100

    upgrade libxml2, libxslt & liblangtag
    
    what I'm really after is some vexating not-reproducible oss-fuzz msan
    warnings when using libxml2 in the fodt2pdf fuzzer. So lets upgrade
    libxml2 to the latest, which requires bumping libxslt, and then requires
    a newer liblangtag because of no longer implicit includes that it
    depended on.
    
    xmlKeepBlanksDefaultValue and xmlSubstituteEntitiesDefault are
    deprecated, we should get around to updating those uses
    
    Change-Id: I8fda0dffda0a7ea65407d246a3121875cb8ad4a4
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/161598
    Tested-by: Jenkins
    Reviewed-by: Caolán McNamara <[email protected]>
    (cherry picked from commit 6875c975f80d8b813b1829a530162869a1e2d92e)
    Reviewed-on: https://gerrit.libreoffice.org/c/core/+/163751
    Reviewed-by: Michael Stahl <[email protected]>
    (cherry picked from commit d10a4155cb2234fbf90ced1ecf7a1d96fef8847e)

diff --git a/download.lst b/download.lst
index 45e635f563fe..8bb154dbd413 100644
--- a/download.lst
+++ b/download.lst
@@ -383,8 +383,8 @@ LIBGPGERROR_TARBALL := libgpg-error-1.43.tar.bz2
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBLANGTAG_SHA256SUM := 
1f12a20a02ec3a8d22e54dedb8b683a43c9c160bda1ba337bf1060607ae733bd
-LIBLANGTAG_TARBALL := liblangtag-0.6.3.tar.bz2
+LIBLANGTAG_SHA256SUM := 
5ed6bcd4ae3f3c05c912e62f216cd1a44123846147f729a49fb5668da51e030e
+LIBLANGTAG_TARBALL := liblangtag-0.6.7.tar.bz2
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
@@ -408,14 +408,14 @@ XMLSEC_TARBALL := xmlsec1-1.2.37.tar.gz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXML_SHA256SUM := 
737e1d7f8ab3f139729ca13a2494fd17bf30ddb4b7a427cf336252cab57f57f7
-LIBXML_VERSION_MICRO := 4
-LIBXML_TARBALL := libxml2-2.11.$(LIBXML_VERSION_MICRO).tar.xz
+LIBXML_SHA256SUM := 
8c8f1092340a89ff32bc44ad5c9693aff9bc8a7a3e161bb239666e5d15ac9aaa
+LIBXML_VERSION_MICRO := 3
+LIBXML_TARBALL := libxml2-2.12.$(LIBXML_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
 # will not run into conflicts
-LIBXSLT_SHA256SUM := 
1f32450425819a09acaff2ab7a5a7f8a2ec7956e505d7beeb45e843d0e1ecab1
-LIBXSLT_VERSION_MICRO := 38
+LIBXSLT_SHA256SUM := 
2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0
+LIBXSLT_VERSION_MICRO := 39
 LIBXSLT_TARBALL := libxslt-1.1.$(LIBXSLT_VERSION_MICRO).tar.xz
 # three static lines
 # so that git cherry-pick
diff --git a/external/libxml2/ExternalPackage_libxml2.mk 
b/external/libxml2/ExternalPackage_libxml2.mk
index 3c399970cd5b..799044575f9a 100644
--- a/external/libxml2/ExternalPackage_libxml2.mk
+++ b/external/libxml2/ExternalPackage_libxml2.mk
@@ -21,7 +21,7 @@ else # COM=MSC
 $(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.dll,win32/bin.msvc/libxml2.dll))
 endif
 else # OS!=WNT
-$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.11.$(LIBXML_VERSION_MICRO)))
+$(eval $(call 
gb_ExternalPackage_add_file,libxml2,$(LIBO_URE_LIB_FOLDER)/libxml2.so.2,.libs/libxml2.so.2.12.$(LIBXML_VERSION_MICRO)))
 endif
 endif # DISABLE_DYNLOADING
 
diff --git a/external/libxml2/libxml2-global-symbols.patch 
b/external/libxml2/libxml2-global-symbols.patch
index cbbe5a622284..32146da4b3d7 100644
--- a/external/libxml2/libxml2-global-symbols.patch
+++ b/external/libxml2/libxml2-global-symbols.patch
@@ -13,7 +13,7 @@
  } LIBXML2_2.6.28;
  
  LIBXML2_2.6.32 {
-@@ -2231,3 +2231,49 @@
+@@ -2231,3 +2231,55 @@
    xmlPopOutputCallbacks;
  } LIBXML2_2.9.8;
  
@@ -23,6 +23,12 @@
 +    xmlNewSAXParserCtxt;
 +} LIBXML2_2.9.11;
 +
++LIBXML2_2.12.3 {
++    global:
++    xmlCtxtSetMaxAmplification;
++    xmlTextReaderSetMaxAmplification;
++} LIBXML2_2.11.4;
++
 +# HACK: export global variable accessor functions (globals.h)
 +LIBXML2_GLOBAL_VARIABLES {
 +    global:
diff --git a/filter/source/xsltfilter/LibXSLTTransformer.cxx 
b/filter/source/xsltfilter/LibXSLTTransformer.cxx
index 5e9a7c4bcd35..28803b68e840 100644
--- a/filter/source/xsltfilter/LibXSLTTransformer.cxx
+++ b/filter/source/xsltfilter/LibXSLTTransformer.cxx
@@ -503,7 +503,23 @@ namespace XSLT
         {   // backward compatibility for old clients using createInstance
             params = args;
         }
+
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
         xmlSubstituteEntitiesDefault(0);
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
+
         m_parameters.clear();
         for (const Any& p : std::as_const(params))
         {
diff --git a/helpcompiler/source/HelpCompiler.cxx 
b/helpcompiler/source/HelpCompiler.cxx
index b2329c0678f7..d32e1e05a42c 100644
--- a/helpcompiler/source/HelpCompiler.cxx
+++ b/helpcompiler/source/HelpCompiler.cxx
@@ -39,7 +39,21 @@ HelpCompiler::HelpCompiler(StreamTable &in_streamTable, 
fs::path in_inputFile,
     src(std::move(in_src)), zipdir(std::move(in_zipdir)), 
module(std::move(in_module)), lang(std::move(in_lang)), 
resCompactStylesheet(std::move(in_resCompactStylesheet)),
     resEmbStylesheet(std::move(in_resEmbStylesheet)), bExtensionMode( 
in_bExtensionMode )
 {
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
     xmlKeepBlanksDefaultValue = 0;
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
     char* os = getenv("OS");
     if (os)
     {
diff --git a/xmlsecurity/source/xmlsec/saxhelper.cxx 
b/xmlsecurity/source/xmlsec/saxhelper.cxx
index ff576db49673..0d395848941d 100644
--- a/xmlsecurity/source/xmlsec/saxhelper.cxx
+++ b/xmlsecurity/source/xmlsec/saxhelper.cxx
@@ -118,11 +118,24 @@ SAXHelper::SAXHelper( )
      * compile error:
      * xmlLoadExtDtdDefaultValue = XML_DETECT_IDS | XML_COMPLETE_ATTRS ;
      */
+#ifdef __GNUC__
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#endif
+#if defined(_MSC_VER)
+#pragma warning(push)
+#pragma warning(disable:4996)
+#endif
     xmlSubstituteEntitiesDefault(0) ;
-
 #ifndef XMLSEC_NO_XSLT
     xmlIndentTreeOutput = 1 ;
 #endif /* XMLSEC_NO_XSLT */
+#if defined(_MSC_VER)
+#pragma warning(pop)
+#endif
+#ifdef __GNUC__
+#pragma GCC diagnostic pop
+#endif
 
     m_pParserCtxt = xmlNewParserCtxt() ;
 
commit a3677553f9e31508a9603b0c7082a051ef78b5a8
Author:     Stephan Bergmann <[email protected]>
-e 
... etc. - the rest is truncated

Reply via email to