What the developer wrote
Authored by fanquake
depends: expat 2.7.3
Remove the patch, as expat has bumped it's minimum to 3.15.
Remove the lto related workaround. I haven't seen issues with CMakes
TestBigEndian.
What changed, and why it matters
This commit updates the expat XML parsing library used by Bitcoin Core's build system from version 2.4.8 to 2.7.3. Expat is a widely-used library for processing XML data, and newer versions often fix security bugs found in older releases. The change also removes an old build patch and a workaround that were only needed for the older expat version. However, the commit message itself does not say this is a security fix, and no specific vulnerability is mentioned.
Treat this as a standard dependency maintenance update. Verify the published SHA-256 hash for expat 2.7.3 against the upstream libexpat release asset. Review upstream expat release notes between 2.4.8 and 2.7.3 for any security fixes that may affect Bitcoin Core's usage of expat, and consider whether additional backports or a security advisory are warranted. No immediate code-level mitigation is required beyond applying the update.
Security signals we found
Dependency version bump from expat 2.4.8 to 2.7.3
Expat 2.4.8 is an older release with publicly known security advisories in the upstream project
Removal of downstream build patch and LTO workaround consistent with upstream changes
No explicit security claim, CVE reference, or vulnerability description in commit message or diff
Evidence from the diff
The commit bumps the depends-system expat package from 2.4.8 to 2.7.3, switches the download archive from .tar.xz to .tar.gz, updates the SHA-256 hash, drops depends/patches/expat/cmake_minimum.patch, and removes the -D_DEFAULT_SOURCE CPP flag and the patch step from the build recipe. The removed patch raised expat’s CMake minimum from 3.1.3 to 3.16; upstream expat now requires CMake 3.15+, making the patch unnecessary. The -D_DEFAULT_SOURCE workaround was needed for endianness detection under LTO with the old expat build and is no longer required. The diff itself is a routine dependency refresh; it does not identify or patch any specific CVE.
Changed components
depends/packages/expat.mkdepends/patches/expat/cmake_minimum.patchInspect captured patch +3 / −25
diff --git a/depends/packages/expat.mk b/depends/packages/expat.mk
index fb7d5099..88e4d5c8 100644
--- a/depends/packages/expat.mk
+++ b/depends/packages/expat.mk
@@ -1,23 +1,14 @@
package=expat
-$(package)_version=2.4.8
+$(package)_version=2.7.3
$(package)_download_path=https://github.com/libexpat/libexpat/releases/download/R_$(subst .,_,$($(package)_version))/
-$(package)_file_name=$(package)-$($(package)_version).tar.xz
-$(package)_sha256_hash=f79b8f904b749e3e0d20afeadecf8249c55b2e32d4ebb089ae378df479dcaf25
+$(package)_file_name=$(package)-$($(package)_version).tar.gz
+$(package)_sha256_hash=821ac9710d2c073eaf13e1b1895a9c9aa66c1157a99635c639fbff65cdbdd732
$(package)_build_subdir=build
-$(package)_patches += cmake_minimum.patch
-# -D_DEFAULT_SOURCE defines __USE_MISC, which exposes additional
-# definitions in endian.h, which are required for a working
-# endianness check in configure when building with -flto.
define $(package)_set_vars
$(package)_config_opts := -DCMAKE_BUILD_TYPE=None -DEXPAT_BUILD_TOOLS=OFF
$(package)_config_opts += -DEXPAT_BUILD_EXAMPLES=OFF -DEXPAT_BUILD_TESTS=OFF
$(package)_config_opts += -DBUILD_SHARED_LIBS=OFF
- $(package)_cppflags += -D_DEFAULT_SOURCE
-endef
-
-define $(package)_preprocess_cmds
- patch -p1 < $($(package)_patch_dir)/cmake_minimum.patch
endef
define $(package)_config_cmds
diff --git a/depends/patches/expat/cmake_minimum.patch b/depends/patches/expat/cmake_minimum.patch
deleted file mode 100644
index a849a82a..00000000
--- a/depends/patches/expat/cmake_minimum.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-build: set minimum required CMake to 3.16
-
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -33,7 +33,7 @@
- # Unlike most of Expat,
- # this file is copyrighted under the BSD-license for buildsystem files of KDE.
-
--cmake_minimum_required(VERSION 3.1.3)
-+cmake_minimum_required(VERSION 3.16)
-
- # This allows controlling documented build time switches
- # when Expat is pulled in using the add_subdirectory function, e.g.
Why this scored 38/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.