From ee42d28ff28965fee01bafb7f66ffa43aa3e6eea Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Mon, 31 Aug 2026 17:48:06 +0200 Subject: [PATCH 1/2] expat: Add 2.8.4 with security fixes --- repos/spack_repo/builtin/packages/expat/package.py | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/repos/spack_repo/builtin/packages/expat/package.py b/repos/spack_repo/builtin/packages/expat/package.py index 6560f98560e..f4e3b135733 100644 --- a/repos/spack_repo/builtin/packages/expat/package.py +++ b/repos/spack_repo/builtin/packages/expat/package.py @@ -18,6 +18,10 @@ class Expat(AutotoolsPackage, CMakePackage): url = "https://github.com/libexpat/libexpat/releases/download/R_2_2_9/expat-2.2.9.tar.bz2" license("MIT") + version( + "2.8.4", + sha256="963250a823c16a498582b4ad82ad0f88926be0769675d3b6956be4d769a1cd8f", + ) version( "2.8.3", sha256="b4cc2483927d5e90bf8c40b44a6b95b368b42a8a96e25883fce188b48a92b670", From 9dc68140a94a4e74976c17bb127909d696cdc803 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Mon, 31 Aug 2026 17:48:28 +0200 Subject: [PATCH 2/2] expat: Deprecate vulnerable Expat 2.8.3 --- repos/spack_repo/builtin/packages/expat/package.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/repos/spack_repo/builtin/packages/expat/package.py b/repos/spack_repo/builtin/packages/expat/package.py index f4e3b135733..d9b8281891b 100644 --- a/repos/spack_repo/builtin/packages/expat/package.py +++ b/repos/spack_repo/builtin/packages/expat/package.py @@ -22,11 +22,12 @@ class Expat(AutotoolsPackage, CMakePackage): "2.8.4", sha256="963250a823c16a498582b4ad82ad0f88926be0769675d3b6956be4d769a1cd8f", ) + # deprecate all releases before 2.8.4 because of various security issues version( "2.8.3", sha256="b4cc2483927d5e90bf8c40b44a6b95b368b42a8a96e25883fce188b48a92b670", + deprecated=True, ) - # deprecate all releases before 2.8.3 because of various security issues version( "2.8.2", sha256="69e7f52417d85b1c2b7fe855e176eec55d0b2d7d92d691372d833a1c7df7923b",