Re: [OE-core] [wrynose][PATCH 1/3] expat: fix CVE-2026-50219

[Adarsh Jagadish Kamini <adarsh.jagadish.kamini@est.tech>]

On 8/27/26 09:27, Daniel Turull wrote:
> On Wed, 2026-08-26 at 01:14 -0700, Jakub Szczudlo (Nokia) wrote:
>> Hi,
>>
>> I understand this CVE is bigger than I thought CVE patch can be.
>> Maybe we can think about updating expat beyond the fixed version?
>> I now it's not the best because it is stable branch but I can't think about correct solution.
> 
> Hi,
> 
> Upgrading expat on wrynose & scarthgap may be possible. We are carrying
> a *lot* of patches for expat, especially on scarthgap, so it's worth
> considering.
> 
> It would need a few things:
> 
> - Review of the delta between the current version on these branches,
>    including the patches we're carrying, and the latest version. Check
>    that there are no features removed or other backwards-incompatible
>    changes.
> 
> - Confirmation that the SONAME changes won't break anything.
> 
> - Testing.
> 
> - RFC patch on the mailing list with a clear subject so people can see
>    it's an exception to the usual stable upgrade policy, explain the
>    review and testing done. This gives chance for people to object if it
>    will cause issues for them.
> 
> - Agreement from the Yocto TSC, based on the above info.
> 
> That all needs some time investment beyond what we currently have
> available, so if you have the bandwidth to look in to it then that would
> be welcome.
> 
> Best regards,
> 

Hi all,
I agree that expat should be uplifted to 2.8.3.

I have some comments/suggestions regarding this.
To verify ABI compatibility, I ran abidiff 
(https://sourceware.org/libabigail/manual/abidiff.html) for expat 2.7.5 
and 2.8.3, and can conclude that there is no ABI break, and can also 
confirm that there has not been a major bump in the SONAME.

I want to point to our fork of 
meta-binaryaudit(https://github.com/nordix/meta-binaryaudit), which 
wraps abidw and abidiff into a Yocto layer, which then can be used to 
compare ABI breaks in the packages.

I have also analysed the Changelog as suggested, there has not been any 
feature removal, but there are some opt-in feature additions (disabled 
by default), and new Autotools flags. I don't see any 
backward-incompatible changes.

I will prepare a patch to uplift to expat 2.8.3, test it, and include 
these results, and mark it RFC as mentioned.

Thanks!
Adarsh Jagadish Kamini
Ericsson Software Technology AB