[Buildroot] [PATCH 2/3] package/libxml2: bump version to 2.15.0

[Julien Olivain]

Hi Bernd,

THanks for the patch.

On 12/10/2025 23:31, Bernd Kuhls wrote:
> Removed all patches because they are included in this release, although
> with different commits than mentioned in our patch files:
> 
> 0001: 
> https://gitlab.gnome.org/GNOME/libxml2/-/commit/acbbeef9f5dcdcc901c5f3fa14d583ef8cfd22f0
> 0002: 
> https://gitlab.gnome.org/GNOME/libxml2/-/commit/f7ebc65f05bffded58d1e1b2138eb124c2e44f21
> 0003: 
> https://gitlab.gnome.org/GNOME/libxml2/-/commit/c24909ba2601848825b49a60f988222da3019667
> 0004: 
> https://gitlab.gnome.org/GNOME/libxml2/-/commit/c340e419505cf4bf1d9ed7019a87cc00ec200434
> 
> Updated license hash due to upstream commit:
> https://gitlab.gnome.org/GNOME/libxml2/-/commit/4bd66d4549b2e8925a752e0daac3a189d2fec8f7
> 
> Removed python3 bindings due to their pending removal in 2.16:
> https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.0.news
> which prevents us from adding a dependency on host-doxygen due to
> upstream commit
> https://gitlab.gnome.org/GNOME/libxml2/-/commit/bbe5827c94cc9b0e393ff3e6eef6dec2376317e2
> "Doxygen will also be required to build the Python bindings."
> 
> Removed lzma support due to upstream removal:
> https://gitlab.gnome.org/GNOME/libxml2/-/commit/1763281cd65ded4067ddf123eb7358690c214b0b
> 
> Signed-off-by: Bernd Kuhls <bernd at kuhls.net>
> ---
>  ...ix-integer-overflow-in-xmlBuildQName.patch |  59 ------
>  ...emory-safety-issues-in-xmlSchematron.patch | 186 ------------------
>  ...ull-pointer-dereference-leading-to-D.patch |  70 -------
>  ...uffer-overflows-of-interactive-shell.patch | 103 ----------
>  package/libxml2/libxml2.hash                  |   6 +-
>  package/libxml2/libxml2.mk                    |  39 +---
>  6 files changed, 6 insertions(+), 457 deletions(-)
>  delete mode 100644 
> package/libxml2/0001-tree-Fix-integer-overflow-in-xmlBuildQName.patch
>  delete mode 100644 
> package/libxml2/0002-schematron-Fix-memory-safety-issues-in-xmlSchematron.patch
>  delete mode 100644 
> package/libxml2/0003-Schematron-Fix-null-pointer-dereference-leading-to-D.patch
>  delete mode 100644 
> package/libxml2/0004-fix-potential-buffer-overflows-of-interactive-shell.patch
[...]
> diff --git a/package/libxml2/libxml2.mk b/package/libxml2/libxml2.mk
> index 36cdd5a63d..09c5fcc163 100644
> --- a/package/libxml2/libxml2.mk
> +++ b/package/libxml2/libxml2.mk
> @@ -4,8 +4,8 @@
>  #
>  
> ################################################################################
> 
> -LIBXML2_VERSION_MAJOR = 2.13
> -LIBXML2_VERSION = $(LIBXML2_VERSION_MAJOR).8
> +LIBXML2_VERSION_MAJOR = 2.15
> +LIBXML2_VERSION = $(LIBXML2_VERSION_MAJOR).0

This new version introduces build failures. See:
https://gitlab.com/jolivain/buildroot/-/pipelines/2097179479

For reference, the v2.13.0 build correctly:
https://gitlab.com/jolivain/buildroot/-/pipelines/2097205593

This is likely due to:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/f070acc56400410a3ad27f4df313526749364962

libxml2 enables by default --with-modules, which requires dlopen(), 
which
cannot build in static builds.

Maybe the same comment applies for pthread support.

Could you have a look please?

>  LIBXML2_SOURCE = libxml2-$(LIBXML2_VERSION).tar.xz
>  LIBXML2_SITE = \
>  	https://download.gnome.org/sources/libxml2/$(LIBXML2_VERSION_MAJOR)
> @@ -15,18 +15,6 @@ LIBXML2_LICENSE_FILES = Copyright
>  LIBXML2_CPE_ID_VENDOR = xmlsoft
>  LIBXML2_CONFIG_SCRIPTS = xml2-config
> 
> -#0001-tree-Fix-integer-overflow-in-xmlBuildQName.patch
> -LIBXML2_IGNORE_CVES += CVE-2025-6021
> -
> -#0002-schematron-Fix-memory-safety-issues-in-xmlSchematron.patch
> -LIBXML2_IGNORE_CVES += CVE-2025-49794 CVE-2025-49796
> -
> -#0003-Schematron-Fix-null-pointer-dereference-leading-to-D.patch
> -LIBXML2_IGNORE_CVES += CVE-2025-49795
> -
> -# 0004-fix-potential-buffer-overflows-of-interactive-shell.patch
> -LIBXML2_IGNORE_CVES += CVE-2025-6170
> -
>  # relocation truncated to fit: R_68K_GOT16O
>  ifeq ($(BR2_m68k_cf),y)
>  LIBXML2_CONF_ENV += CFLAGS="$(TARGET_CFLAGS) -mxgot"
> @@ -37,21 +25,7 @@ LIBXML2_CONF_OPTS = --with-http --with-gnu-ld 
> --without-debug
>  HOST_LIBXML2_DEPENDENCIES = host-pkgconf
>  LIBXML2_DEPENDENCIES = host-pkgconf
> 
> -HOST_LIBXML2_CONF_OPTS = --without-zlib --without-lzma
> -
> -ifeq ($(BR2_PACKAGE_PYTHON3),y)
> -LIBXML2_DEPENDENCIES += python3
> -LIBXML2_CONF_OPTS += --with-python
> -else
> -LIBXML2_CONF_OPTS += --without-python
> -endif
> -
> -ifeq ($(BR2_PACKAGE_HOST_PYTHON3),y)
> -HOST_LIBXML2_DEPENDENCIES += host-python3
> -HOST_LIBXML2_CONF_OPTS += --with-python
> -else
> -HOST_LIBXML2_CONF_OPTS += --without-python
> -endif
> +HOST_LIBXML2_CONF_OPTS = --without-zlib
> 
>  ifeq ($(BR2_PACKAGE_ICU),y)
>  LIBXML2_DEPENDENCIES += icu
> @@ -67,13 +41,6 @@ else
>  LIBXML2_CONF_OPTS += --without-zlib
>  endif
> 
> -ifeq ($(BR2_PACKAGE_XZ),y)
> -LIBXML2_DEPENDENCIES += xz
> -LIBXML2_CONF_OPTS += --with-lzma
> -else
> -LIBXML2_CONF_OPTS += --without-lzma
> -endif
> -
>  LIBXML2_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBICONV),libiconv)
> 
>  ifeq ($(BR2_ENABLE_LOCALE)$(BR2_PACKAGE_LIBICONV),y)
> --
> 2.47.3

Best regards,

Julien.